Privacy Policy

Last updated: 16 July 2026

1. Data controller

Controller: GOLDEN NUGGETS, SLU
NRT: L-720723-W
Address: Carrer Major, Núm. 1, Casa Bonet, Pal — La Massana, AD400, Andorra
Email: hola@kooby.io
Phone: +376 668 737

2. Personal data we collect

2.1 Data provided directly by the User

Registration data: first name, surname, email, phone, business name.
Billing data: fiscal address, payment data (processed by Monei; the Company does not store card data).
Contact data: information provided through forms, WhatsApp or email.
Business operational data: menus, recipe costs, recipes, suppliers, sales, bookings, end-customer files (name, phone, preferences) — entered by the User in the framework of the contracted services.

2.2 Data collected automatically

Navigation data: IP address, browser type, operating system, pages visited, time spent.
Cookies: as described in our Cookie Policy.

3. Purposes of processing

Management of the registration and user account in the Kontrola, Kooby POS and Kooby Bookings platforms.
Provision of the contracted services, including access to the applications, synchronization between ecosystem products and operation of the Kooby Connect Box.
Management of billing and collection of subscriptions and the device, through Monei.
Sending of commercial communications and newsletters, provided that the User has given prior consent.
Attention to enquiries, complaints or requests from the User.
Service improvement and statistical analysis of platform use (anonymized data).
Compliance with applicable legal obligations (fiscal, accounting, VERI·FACTU and equivalents).

4. Legal basis for processing

Performance of the contract: for the provision of the service, account management and billing [art. 6.1.b) GDPR].
Consent: for the sending of commercial communications [art. 6.1.a) GDPR].
Legitimate interest: for service improvement and fraud prevention [art. 6.1.f) GDPR].
Legal obligation: for compliance with fiscal, accounting and electronic invoicing obligations [art. 6.1.c) GDPR].

5. Data retention

Contractual data: for the duration of the contractual relationship and the 5 years following its termination.
Fiscal and electronic invoicing data: for the periods established by applicable fiscal legislation (between 4 and 6 years).
Business operational data: while the account is active. After cancellation, the User has 30 days to export them before deletion.
Consent data: until the User revokes consent.

6. Recipients of the data

Monei: payment service provider, for transaction processing.
Supabase: database infrastructure provider.
Netlify: web hosting provider.
Systeme.io: for the management of commercial communications and email marketing, when the User has given consent.
Public administrations and competent authorities (VERI·FACTU/AEAT and equivalents): when a legal obligation exists.

No international transfers of data are made outside the European Economic Area without adequate guarantees in accordance with the GDPR.

7. User rights

Access: know what personal data we are processing.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your data when it is no longer necessary.
Objection: object to processing in certain circumstances.
Restriction: request restriction of processing.
Portability: receive your data in a structured, commonly used format.
Withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, the User can send a request to hola@kooby.io, accompanied by a copy of their identity document.

The User also has the right to lodge a complaint before the Spanish Data Protection Agency (www.aepd.es) or before the Andorran Data Protection Agency (www.apda.ad).

8. Security

The Company adopts the appropriate technical and organizational measures to guarantee the security, integrity and confidentiality of personal data, including encryption in transit (SSL/TLS), role-based access control, periodic backups and per-venue isolation for operational data.