Legal
Infrastructure

1. Introduction and Scope

ValeKernelLabs ("we," "us," or "our") is committed to protecting the privacy and personal data of all visitors and users of our digital infrastructure. This Privacy Policy describes how we collect, process, store, and protect personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and all applicable European Union data protection legislation.

This policy applies to all personal data processing activities conducted through our website, communication channels, and service delivery systems. By engaging with our services, you acknowledge that you have read and understood this policy.

2. Categories of Personal Data Collected

We collect and process the following categories of personal data:

• — Identity Data: Full name, professional designation, and organizational affiliation provided during contact form submission or service inquiries.
• — Contact Data: Email address, telephone number, and physical address provided for communication and service delivery purposes.
• — Technical Data: IP address, browser type and version, operating system, device identifiers, and access timestamps collected automatically through server logs and analytics tools.
• — Usage Data: Page interaction patterns, navigation paths, session duration, and feature engagement metrics collected through privacy-respecting analytics.
• — Communication Data: Content of inquiries, project specifications, and correspondence submitted through our contact channels.

3. Legal Basis for Processing

We process personal data under the following legal bases as defined in Article 6(1) GDPR:

• — Consent (Art. 6(1)(a)): Where you have given explicit consent for specific processing purposes, such as marketing communications or cookie deployment.
• — Contract Performance (Art. 6(1)(b)): Processing necessary for the performance of a contract to which you are a party, or for pre-contractual measures taken at your request.
• — Legitimate Interest (Art. 6(1)(f)): Processing necessary for our legitimate interests in maintaining service quality, security, and operational efficiency, provided such interests are not overridden by your fundamental rights.
• — Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable legal obligations under EU or Spanish law.

4. Data Retention Periods

Personal data is retained only for the duration necessary to fulfill the purposes for which it was collected:

• — Contact form submissions: Retained for 24 months from last interaction, then securely deleted.
• — Service delivery data: Retained for the duration of the service agreement plus 6 years (Spanish commercial law requirements).
• — Technical logs: Automatically purged after 90 days unless required for security investigation.
• — Marketing consent records: Retained until consent is withdrawn, plus 30 days for administrative processing.

5. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). When we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• — EU Standard Contractual Clauses (SCCs) approved by the European Commission.
• — Adequacy decisions under Article 45 GDPR where applicable.
• — Binding Corporate Rules where established.

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

• — Right of Access (Art. 15): Obtain confirmation of processing and receive a copy of your personal data.
• — Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• — Right to Erasure (Art. 17): Request deletion of your data where no compelling legal grounds for continued processing exist.
• — Right to Restriction (Art. 18): Request limitation of processing in specific circumstances.
• — Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• — Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• — Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

7. Data Security Measures

We implement technical and organizational measures appropriate to the risk, including but not limited to:

• — Encryption of data in transit (TLS 1.3) and at rest (AES-256).
• — Regular security assessments and penetration testing.
• — Access controls with role-based authorization and multi-factor authentication.
• — Incident response procedures and breach notification protocols within 72 hours as required by Art. 33 GDPR.

1. What Are Cookies

Cookies are small text files placed on your device when you visit our website. They enable us to recognize your device, store preferences, and improve your browsing experience. Under the EU ePrivacy Directive (2002/58/EC) and GDPR, we are required to inform you about our cookie usage and obtain consent for non-essential cookies.

2. Categories of Cookies Deployed

3. Managing Cookie Preferences

You can manage your cookie preferences at any time through:

• — The cookie consent banner displayed on your first visit.
• — Your browser settings, which allow you to block or delete cookies.
• — Contacting us directly at [email protected].

Note: Disabling certain cookies may impair website functionality. Essential cookies cannot be disabled as they are required for basic site operation.

1. General Refund Principles

ValeKernelLabs provides digital engineering services structured around defined project milestones and deliverables. This Refund Matrix establishes the conditions under which refunds may be issued, in accordance with EU consumer protection directives and Spanish commercial regulations.

2. Pre-Engagement Refunds

Payments made before project initiation may be refunded in full within 14 calendar days of payment, provided no discovery work or resource allocation has commenced. Processing fees incurred during payment (typically 2.9% + €0.25) are non-refundable as they are retained by the payment processor.

3. Milestone-Based Refund Schedule

4. Non-Refundable Elements

• — Third-party license fees, domain registrations, and hosting payments already procured.
• — Completed discovery and analysis work product delivered to the client.
• — Custom development work that has been reviewed and approved at each milestone.
• — Payment processing fees retained by third-party payment providers.

5. Refund Process

Refund requests must be submitted in writing to [email protected] within 30 days of the relevant milestone completion. We will acknowledge receipt within 2 business days and provide a refund decision within 14 calendar days. Approved refunds are processed to the original payment method within 5-10 business days.

1. Agreement and Acceptance

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Client") and ValeKernelLabs, registered at 29005, Calle Larios 8, Malaga, Spain ("Provider"). By engaging our services, requesting a proposal, or making payment, you agree to be bound by these Terms in their entirety. Any variation must be agreed in writing by authorized representatives of both parties.

2. Scope of Services

Services are defined in individual Statement of Work ("SOW") documents issued for each engagement. Each SOW specifies: deliverables, milestones, timelines, pricing, and acceptance criteria. The Provider shall perform services with the degree of skill and care expected of a competent digital engineering professional operating in accordance with industry best practices and applicable technical standards.

3. Client Obligations

• — Provide timely access to necessary systems, data, and personnel required for service delivery.
• — Review and provide feedback on deliverables within 5 business days of submission.
• — Ensure all provided content, materials, and instructions do not infringe third-party intellectual property rights.
• — Maintain confidentiality of all proprietary methodologies, frameworks, and technical documentation shared during the engagement.

4. Payment Terms

Invoices are issued according to the milestone schedule defined in the applicable SOW. Payment is due within 14 calendar days of invoice date via the payment methods available through our secure payment infrastructure. Late payments incur a statutory interest charge of 8 percentage points above the ECB base rate as permitted under EU Directive 2011/7/EU on late payments. The Provider reserves the right to suspend services if payment is overdue by more than 21 days, with 7 days written notice.

5. Intellectual Property

Upon full payment of all applicable fees, the Client receives a perpetual, non-exclusive, worldwide license to use all custom deliverables created specifically for the engagement. The Provider retains all rights to proprietary tools, frameworks, methodologies, and general-purpose code components developed prior to or independently of the engagement. Pre-existing intellectual property used in service delivery remains the property of the Provider, with the Client receiving a perpetual license for its use within the delivered deliverables.

6. Confidentiality

Both parties agree to maintain strict confidentiality of all proprietary information disclosed during the engagement. This obligation survives termination for a period of 3 years. Confidential information includes but is not limited to: business strategies, technical specifications, pricing structures, client lists, and proprietary methodologies. Standard exceptions apply for information that becomes publicly available through no fault of the receiving party, or is required to be disclosed by law or court order.

7. Limitation of Liability

To the maximum extent permitted by applicable law, the Provider's total aggregate liability under any engagement shall not exceed the total fees paid by the Client for the specific services giving rise to the claim. The Provider shall not be liable for indirect, consequential, incidental, or punitive damages, including loss of profits, data, business opportunities, or goodwill. Nothing in these Terms excludes liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be excluded by law.

8. Termination

Either party may terminate an engagement with 30 days written notice. In the event of termination, the Client shall pay for all services performed up to the termination date, calculated on a pro-rata basis according to the milestone schedule. The Provider shall deliver all completed work product within 10 business days of termination. Termination for cause (material breach) may be effected with 14 days written notice if the breach remains uncured after the notice period.

9. Governing Law and Dispute Resolution

These Terms are governed by the laws of the Kingdom of Spain and applicable European Union regulations. Any disputes arising from or in connection with these Terms shall first be submitted to mediation under the rules of the Madrid Bar Association. If mediation fails within 60 days, disputes shall be submitted to the exclusive jurisdiction of the courts of Malaga, Spain. Nothing in this clause prevents either party from seeking injunctive relief in any competent jurisdiction.

10. Amendments

The Provider reserves the right to amend these Terms with 30 days written notice. Continued use of services after the amendment period constitutes acceptance. Material changes to pricing or scope require explicit written consent from both parties.