Privacy Policy
1. Data controller
Twister Factory, S.L. (Tax ID B85915221), operator of Kinasi, is the controller of the personal data collected through kinasi.com. Privacy contact: [email protected].
2. What data we collect
- Demo form: name, company, country, email, phone (optional) and the message you write.
- Customer account (once available): registration and billing data, and the assets you choose to monitor (domains, emails, names, social profiles).
- Basic technical data: the functional cookie
kinasi_langthat remembers your language — see the Cookie Policy.
3. What we use it for
- Respond to your demo request and manage the commercial relationship.
- Provide the contracted service (monitoring, alerts, reports).
- Service-related communications (never marketing without your separate, explicit consent).
- Comply with legal and billing obligations.
4. Legal basis
Processing of demo-form data is based on your explicit consent (the form checkbox). Processing of data from customers with an active service is based on contract performance.
5. Your rights, by country
You can exercise your rights by writing to [email protected], stating your country and attaching proof of identity. Depending on where you are:
| Country | Legal framework | Rights | Authority |
|---|---|---|---|
| Mexico | Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), in force since March 2025 | Access, Rectification, Cancellation, Opposition (ARCO) | Secretaría Anticorrupción y Buen Gobierno |
| Peru | Law No. 29733 and its regulation (S.D. 016-2024-JUS) | Access, Rectification, Cancellation, Opposition (ARCO) | National Data Protection Authority (ANPD) |
| Ecuador | Organic Law on Personal Data Protection (LOPDP) | Access, rectification/update, deletion, opposition, portability, restriction of processing, not to be subject to automated decisions | Superintendency of Personal Data Protection (SPDP) |
| Colombia | Law 1581 of 2012 (habeas data) and its implementing decree | Know, update and rectify your data; request proof of authorization granted; be informed of its use; revoke authorization and/or request deletion; file complaints with the authority | Superintendency of Industry and Commerce (SIC) |
Note: Colombia has a bill in progress (2025-2026) that would update Law 1581 — this table will be revised if it passes.
6. Recipients and subprocessors
To provide the service, Kinasi relies on specialized external providers who process data on our behalf, under contract and solely to operate the platform. By service category:
- Hosting and infrastructure: a hosting provider located in Spain, where the database and the site itself reside.
- Domain and certificate analysis (Cybersecurity module): providers specialized in certificate transparency and infrastructure reputation.
- Leaked credential verification (Cybersecurity module): a provider specialized in known security-breach databases.
- Public social media mention collection (Social Listening and My Sentinel modules): providers specialized in collecting public content from social platforms.
- Payment gateway (once checkout is available): an international payment processor with coverage in Mexico, Peru, Ecuador and Colombia.
- Transactional email: a provider used to send service notifications.
We don't publicly disclose the specific identity of each provider for competitive confidentiality reasons, but it's available under contract (Data Processing Agreement) to customers who need it as part of their own vendor assessment.
7. International transfers
Kinasi provides its services from Spain and stores information on infrastructure located primarily in Spain. When you access the platform from Mexico, Peru, Ecuador or Colombia, your personal data is processed in Spain in order to provide the contracted service — this constitutes an international transfer of data from your country to Spain.
In addition, some of the technology providers described in the previous section (domain analysis, credential verification, social mention collection, payment gateway) may involve additional transfers to third countries, including the United States.
In all cases, Kinasi only carries out these transfers when adequate safeguards exist under the standards of the EU General Data Protection Regulation (GDPR), including, as applicable: adequacy decisions, Standard Contractual Clauses, or the provider's adherence to internationally recognized transfer mechanisms (such as the EU-U.S. Data Privacy Framework for participating providers).
8. Retention
Demo-form data is kept for as long as the potential commercial relationship lasts and up to 12 months of inactivity, unless you exercise your rights sooner. Data from customers with an active service is kept for the duration of the contract and as required by legal and tax obligations.
9. Security
We apply reasonable technical and organizational measures (encryption in transit, access control, backups) to protect the data we process. No system is 100% breach-proof; if we detect a breach affecting you, we will notify you as required by the law of your country.
10. Changes to this policy
We may update this policy as Kinasi adds new modules or markets. We will publish the last update date at the top of this page.