Privacy Policy

1. Data controller

KOLAB-METAL SL is the data controller for personal data processed through the Kostelle website.

2. Data we process

When you send an inquiry, we process the information you provide: your name, company if supplied, e-mail address, phone number if supplied, message, and the relevant product or collection context when you open the form from a product.

For website security and abuse prevention, we also process limited technical data such as your IP address. The form rate limiter uses a one-way hash derived from the IP address rather than storing the raw address in its state file. The hosting infrastructure may produce ordinary server logs containing technical request data.

3. Why we process data

• To respond to contact, partnership, catalog, product and collection inquiries.
• To take steps you request before a possible contract or business relationship.
• To secure the website, prevent abuse and diagnose technical problems.

4. Legal bases

Depending on the inquiry and context, processing is based on taking steps at your request before entering into a contract, our legitimate interests in responding to genuine business inquiries and protecting the website, and compliance with legal obligations where applicable.

The required form acknowledgement confirms that you have read this policy. It is not consent to receive marketing.

5. Service providers and recipients

Personal data may be processed by service providers required to operate the website and e-mail infrastructure, such as hosting and e-mail providers, under appropriate arrangements. We do not sell personal data or disclose it for advertising.

6. Retention

Inquiries are kept only for as long as necessary to respond, manage any resulting business relationship, resolve related issues and meet applicable legal obligations.

Rate-limit attempt timestamps expire after 15 minutes. Duplicate-submission fingerprints expire after 5 minutes. Expired anti-spam state is purged automatically when the form handles subsequent requests. Hosting providers may retain ordinary server logs according to their operational and legal retention practices.

7. Your rights

Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction of processing, object to processing, and data portability where applicable. To exercise a right, contact info@kostelle.pro.

You also have the right to lodge a complaint with the competent supervisory authority. In Spain, this is the Spanish Data Protection Agency (AEPD).

8. Security

We use reasonable technical and organisational measures intended to protect personal data, including server-side validation, authenticated encrypted e-mail transport, access controls and abuse prevention. No online transmission or storage method can be guaranteed to be completely secure.

9. Changes to this policy

We may update this policy when the website, its data processing or applicable requirements change. The current version and its update date will be published on this page.