This Privacy Policy governs the collection, processing, and protection of personal data provided by Users and Clients in connection with the website www.klonup.com (the "Website") and the Smartsheet backup service marketed under the Klonup brand (the "Service").
UNIENDO NODOS is firmly committed to protecting personal data and complies with applicable legislation, in particular Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 of December 5 (LOPDGDD).
1. Data controller
- Owner: Uniendo Nodos, S.L. ("UNIENDO NODOS")
- Tax ID (CIF): B87999652
- Registered office: C/ Gardenias, 2, 28039 Madrid (Spain)
- Registry details: Commercial Registry of Madrid, Volume 36943, Sheet 50, Section 8, Page 660672, Entry 1.
- Contact email: hola@uniendonodos.com
- Data protection email: dpd@uniendonodos.com
2. Uniendo Nodos's dual role in data processing
It is important to distinguish between two different situations, as UNIENDO NODOS's role and applicable obligations vary in each:
A) UNIENDO NODOS as Data Controller. With respect to the personal data that the User or Client provides directly through the Website, the forms, user registration, contracting of the Service, or commercial communications. This situation is detailed in Sections 3 to 9 of this Policy.
B) UNIENDO NODOS as Data Processor. With respect to the personal data that may be contained within the Client's Smartsheet environment (sheets, reports, forms, etc.) and that Klonup processes automatically on the Client's behalf for the sole purpose of generating backups ("Klons"). In this case, the Client is the Data Controller and UNIENDO NODOS acts as Processor, in accordance with Article 28 GDPR. This relationship is governed by the Data Processing Agreement (DPA) made available to Clients, which prevails over this Policy regarding such data. Details are set out in Section 10.
3. Data we process and purposes (Controller role)
3.1. Contact and information / demo requests
When the User uses the contact forms or requests a demo of the Service, they must provide identification and contact details (name, company, email, and, where applicable, phone) and the reason for the inquiry. This data is used to handle and manage the request.
- Legal basis: User's consent.
- Retention period: one (1) year from the last interaction, unless a contractual relationship begins or other periods apply.
3.2. Registration and user account management
The Klonup platform allows users to register, create an account, and log in to access the application. To do so, the User must provide identification details (first name, last name, email, and access credentials). This processing is necessary to enable account functionality and use of the Service.
- Legal basis: performance of a contract or pre-contractual measures.
- Retention period: while the account remains active and, after closure, for the legally applicable limitation periods.
3.3. Service contracting and billing
To contract any Klonup plan (Basic, Pro, Premium, or Enterprise), UNIENDO NODOS processes the Client's identification and tax details and those of designated contacts, as well as the data needed for billing and collection.
- Legal basis: performance of the contract and compliance with legal (tax and commercial) obligations.
- Retention period: for the duration of the contractual relationship and thereafter for the periods required by tax, commercial, and accounting regulations (generally up to six years).
3.4. Payment data
Card payments are processed through Stripe, an external payment service provider. UNIENDO NODOS does not store or process full card details (PAN or CVV); these are processed directly by the payment provider under its own terms and security standards (PCI-DSS). UNIENDO NODOS only retains transaction data necessary for billing and accounting reconciliation.
- Legal basis: performance of the contract and compliance with legal obligations.
3.5. Usage data, telemetry, and audit logs
While using Klonup, the platform generates technical records (logs) about backup task execution: date and time, task identifier, selected elements, status (success/error), the user performing the action, and technical connection data. These records are used to provide the Service, ensure its security, enable traceability and auditing, and diagnose incidents.
- Legal basis: performance of the contract and legitimate interest in ensuring the security and proper functioning of the Service.
- Retention period: for the duration of the contract and a reasonable period thereafter for security and evidentiary purposes, after which they are deleted or anonymized.
3.6. Commercial communications (newsletter and updates)
If the User expressly consents, or under legitimate interest with respect to existing clients for similar products or services, UNIENDO NODOS may send commercial communications about Klonup and other services. The User may object or unsubscribe at any time, free of charge.
- Legal basis: User's consent or legitimate interest (clients).
- Retention period: until the User withdraws consent or objects.
3.7. Cookies
The Website uses first- and third-party cookies. Please see the Cookie Policy for details.
- Legal basis: User's consent, except for strictly necessary technical cookies.
4. Third-party data
If the User provides data about third parties (for example, contact details of their organization's employees or collaborators), they declare that they have the necessary legitimacy to do so and undertake to have previously informed those third parties of the contents of this Privacy Policy.
5. Disclosure of data to third parties (recipients)
UNIENDO NODOS does not transfer personal data to third parties except where legally required. However, to provide the Service, certain providers ("Processors" or "Sub-processors") may access the data, always acting on behalf of and under the instructions of UNIENDO NODOS and with appropriate contractual safeguards. These include:
- Cloud infrastructure provider: Google Cloud (servers located in the European Union).
- Payment service provider: Stripe.
- Web analytics tools: Google Analytics, for analyzing Website navigation.
- Transactional email provider: service used to send operational Service emails (confirmations, activations, billing notices, and account notifications).
UNIENDO NODOS maintains a contractual relationship with each provider ensuring GDPR compliance.
6. International data transfers
As a general rule, data is processed within the European Economic Area (EEA). However, some providers, such as Stripe (payment processing) or Google Analytics (web analytics), may process certain data outside the EEA. In such cases, UNIENDO NODOS ensures that the transfer is carried out with the appropriate safeguards provided for in the GDPR (e.g., European Commission adequacy decisions, the EU-US Data Privacy Framework, or Standard Contractual Clauses).
7. Security measures
UNIENDO NODOS applies appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: connection to Smartsheet via its official API with encrypted tokens (no storage of the Client's passwords), encryption of communications (HTTPS/TLS), access controls, activity logging, and hosting on secure infrastructure in the European Union.
An essential data protection feature of the Service is that backups (Klons) are stored directly in the Client's own Smartsheet account; the backed-up data is neither extracted nor retained on UNIENDO NODOS's servers, which significantly reduces exposure and keeps the data under the Client's control.
8. Data subject rights
The User may exercise at any time their rights of access, rectification, erasure, objection, restriction of processing, portability, and the right not to be subject to automated individual decisions, as well as withdraw any consent given.
To exercise these rights, the User may contact dpd@uniendonodos.com or write to the registered office indicated above, with the subject line "Data Protection" and attaching a document proving their identity.
The User also has the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they believe their rights have not been properly addressed.
9. Accuracy of data
The User warrants the truthfulness, accuracy, authenticity, and currency of the data provided and undertakes to keep it up to date, being responsible for any false or inaccurate data they provide.
10. Processing of data contained in Smartsheet (Processor role)
When the Client uses Klonup to generate backups of their Smartsheet environment, that environment may contain personal data for which the Client is the Data Controller. With respect to such data:
- UNIENDO NODOS acts solely as Data Processor, processing the data only in accordance with the Client's documented instructions (i.e., the backup task configuration the Client sets up).
- UNIENDO NODOS does not access the content of the data except to the extent strictly necessary for the technical execution of the backup, and does not use it for any purpose of its own.
- The resulting backups are stored in the Client's own Smartsheet environment.
- This relationship is governed in detail by the Data Processing Agreement (DPA), available to Clients, which covers, among other matters: the subject matter and duration of the processing, the categories of data, the list of Sub-processors, the security measures, the breach notification regime, and data deletion upon termination of the Service.
11. Changes to the Privacy Policy
UNIENDO NODOS reserves the right to amend this Privacy Policy to adapt it to legislative developments or changes to the Service, respecting applicable law and notifying data subjects where appropriate.
12. Governing language
The governing language of this Privacy Policy is Spanish. Any version in another language is provided solely for the User's convenience. In the event of any discrepancy, the Spanish version shall prevail.