Privacy Policy

1. Data controller

This Privacy Policy governs the processing of the personal data that the User provides to Asociación Junior Empresa KAN (hereinafter, "KAN" or "Let's Box It") through the website letsboxit.es, as well as through any other means of communication.

Identification details of the Controller:

• Name: Asociación Junior Empresa KAN
• NIF: G56511942
• Address: Plaza San Martín 1, 28013 Madrid, Spain
• Registration: Register of Associations of the Community of Madrid, number 41345
• Email: hola@letsboxit.es / kan.labmadrid@gmail.com
• Phone: +34 664 530 600

KAN undertakes to process the User's personal data with the utmost diligence and in accordance with current data protection legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights (Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales, "LOPDGDD").

2. Data we process and purposes

KAN processes the User's personal data for the following purposes and on the following legal bases:

2.1. Management of the contracted service

• Data processed: first name and surname, email address, telephone number, pick-up and delivery addresses or the origin and destination addresses of the move, number of boxes and items, inventory and, where applicable, photos of the belongings and of the access routes that the User sends for a moving quote, and payment details.
• Purpose: to manage the booking, pick-up, storage and delivery of the customer's belongings or, where applicable, the quote for and carrying out of their move; to issue invoices; to communicate with the customer during the service.
• Legal basis: performance of a contract (Article 6.1.b GDPR).

2.2. Handling enquiries through the web form or WhatsApp

• Data processed: name, email address, telephone number, content of the enquiry.
• Purpose: to reply to the User's enquiries.
• Legal basis: the data subject's consent (Article 6.1.a GDPR).

2.3. Compliance with legal obligations

• Data processed: the data necessary to comply with tax, accounting and administrative obligations.
• Purpose: to comply with tax, accounting and consumer protection regulations.
• Legal basis: legal obligation (Article 6.1.c GDPR).

2.4. Sending commercial communications (only if the User consents)

• Data processed: name, email address, telephone number.
• Purpose: sending information about Let's Box It's services, offers and news.
• Legal basis: the data subject's consent (Article 6.1.a GDPR).

The User may withdraw this consent at any time by emailing hola@letsboxit.es or through the unsubscribe link included in every communication.

2.5. Website analysis and improvement

• Data processed: browsing data collected through cookies (see Cookie Policy).
• Purpose: to improve the user experience and the operation of the Website.
• Legal basis: the data subject's consent (Article 6.1.a GDPR).

2.6. Moving quote calculation with photos (optional)

In short: if you use the photo-based calculation, the images are sent to Anthropic, our artificial intelligence provider, only to identify the furniture; they are not used to train the AI. If you do not book, we do not keep them. If you do book, they are kept with your booking so that the quote can be reviewed.

• Data processed: the photos that the User chooses to upload of what needs to be moved and the inventory obtained from them. We recommend that photos do not show people or documents.
• Purpose: to fill in the move inventory automatically so that the quote can be calculated faster. The User reviews and confirms that inventory before booking.
• Legal basis: taking steps at the request of the data subject prior to entering into a contract (Article 6.1.b GDPR). It is optional: the User can fill in the inventory by hand without uploading photos.

3. Retention period

KAN will keep the User's personal data for the time necessary to fulfil the purpose for which it was collected:

• Contract data: for the duration of the service and, afterwards, for the applicable legal periods (up to 6 years for tax and accounting obligations).
• Enquiry data: until the enquiry has been resolved and for a maximum of 1 additional year.
• Data for commercial communications: until the User withdraws their consent.
• Browsing data (cookies): as set out in the Cookie Policy.
• Photos from the photo-based calculation: if the User does not book, KAN does not keep them: they are analysed and deleted immediately. If the User books, they are kept with the booking as contract data.

4. Recipients and data disclosures

KAN may disclose the User's personal data to the following recipients, where necessary to provide the service:

• Stripe Payments Europe Ltd. — payment service provider. Processing is carried out in accordance with its privacy policy: stripe.com/es/privacy
• Google Ireland Ltd. — web analytics tools (Google Analytics). Processing is carried out in accordance with: policies.google.com/privacy
• Anthropic — artificial intelligence provider, only if the User uses the photo-based calculation (section 2.6): it receives the photos to identify the furniture and does not use them to train its models. Processing is carried out in accordance with: anthropic.com/legal/privacy
• Physical storage providers contracted by KAN to safeguard the customer's belongings during the summer. These providers act as data processors under a contract signed in accordance with Article 28 GDPR.
• Collaborating transport and moving professionals (for example, self-employed carriers) who carry out the pick-up, the delivery or the move, with the data strictly necessary to do so (name, telephone number, addresses, inventory). They act as data processors in accordance with Article 28 GDPR.
• The competent public authorities, where there is a legal obligation to disclose the information.

KAN does not make international transfers of data outside the European Economic Area (EEA), except those arising from the use of Google Analytics and, if the User uses the photo-based calculation, Anthropic, which have appropriate safeguards under the GDPR (standard contractual clauses approved by the European Commission).

5. User rights

The User may exercise the following rights at any time:

• Right of access to their personal data.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") of their data where applicable.
• Right to object to processing based on legitimate interest.
• Right to restriction of processing in certain circumstances.
• Right to data portability in a structured format.
• Right not to be subject to automated decisions with legal effects.
• Right to withdraw consent at any time, without affecting the lawfulness of the processing carried out before.

To exercise these rights, the User may contact KAN by email at hola@letsboxit.es or by post at Plaza San Martín 1, 28013 Madrid, stating the right they wish to exercise and attaching a copy of their national ID card (DNI) or equivalent document.

KAN will reply to the request within a maximum of one month of receiving it, extendable by a further two months in cases of particular complexity.

Complaint to the supervisory authority: the User has the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) if they consider that the processing of their personal data does not comply with the regulations. Contact details:

• Website: www.aepd.es
• Address: C/ Jorge Juan 6, 28001 Madrid
• Telephone: 901 100 099 / 91 266 35 17

6. Security measures

KAN has implemented the technical and organisational measures necessary to guarantee the security, integrity and confidentiality of the personal data processed, preventing its alteration, loss, or unauthorised processing or access, as required by the GDPR and the LOPDGDD.

KAN undertakes to comply with its duty of secrecy regarding personal data and to keep it with the utmost diligence.

7. Minors

The Website is aimed at people aged over 18. KAN does not knowingly collect data from minors. If the User is under 18, they must have the prior consent of their parents or legal guardians to use the service.

If KAN becomes aware that it has collected data from a minor without such consent, it will delete it immediately.

8. Changes to the Privacy Policy

KAN may amend this Privacy Policy to adapt it to changes in regulations, case law or its service model. Any amendment will be notified to the User through the Website and, where legally required, by direct communication.

Users are advised to consult this Privacy Policy periodically to stay informed of any updates.