Privacy Policy

1. Controller and contact

Kefi Bosque Group S.L., tax identification number B66763350, is the controller of personal data processed through this website.

Address: Av. Jaume Recoder, 88, 8-3, 08302 Mataró, Barcelona, Spain.

For privacy enquiries and rights requests: info@kefigroup.es. For EMS sales enquiries: info@emscleaning.eu.

2. Data we receive

• Contact and Quote: name, email and/or telephone or WhatsApp, customer type, company where relevant, country or delivery destination, message and optional photographs. Quotations also include products, package sizes and quantities.
• Finder: answers about contamination, surface, equipment and conditions. Finder itself does not require your name or contact details; its answers may accompany a later enquiry.
• EMS Assistant: messages, recent context, cleaning tasks, language, country, product selection and photographs you send. Contact or company details you write may also become part of that context.
• Correspondence and CRM: enquiries, summaries, recommendations, sales notes, request status, communications and follow-ups. Emails include sender, recipient, subject, content and headers needed to connect the thread.
• Technical data: IP address, browser, date and time, referring page, language, session identifiers and, where applicable, UTM parameters and navigation events linked to a request.

Required fields are identified on each form. We need valid contact details to reply. Do not provide sensitive data, passwords or unnecessary information about other people.

3. Purposes and legal bases

• Answering enquiries, product guidance and preparing quotations: steps requested before a contract or performance of a contract where you are a party, GDPR Article 6(1)(b). For company representatives and professional enquiries, a legitimate interest in answering the request and maintaining that professional relationship, Article 6(1)(f).
• Managing requests, correspondence and follow-up in CRM: the same bases according to the relationship; a legitimate interest in organising and continuing pending enquiries. You can ask us to stop following up your request.
• Providing EMS Assistant, including requested visual analysis: a legitimate interest in providing the optional assistance you request and, where applicable, the precontractual steps above. You can use Contact or email without using the assistant.
• Managing an established commercial relationship: performance of the contract and compliance with applicable legal obligations, Articles 6(1)(b) and 6(1)(c), including tax or accounting obligations where relevant.
• Operation, security and continuity of the website; session context and request attribution: a legitimate interest in protecting the service, retaining the selection you request and understanding enquiry sources, Article 6(1)(f). Storage functions subject to consent require that consent where applicable.

The privacy checkbox provides information about processing; it does not make consent the universal legal basis for these purposes. Sending an enquiry does not subscribe you to general campaigns. Where a particular activity relies on your consent, you can withdraw it without affecting earlier lawful processing.

4. EMS Assistant and OpenAI

EMS Assistant uses the OpenAI API to understand enquiries and offer guidance based on EMS information. It sends your message, a limited part of the recent conversation, relevant task and product context, language, country and page, and contact information you voluntarily include. When you ask for photo analysis, it sends a processed version of the image.

The integration uses store=false with the Responses API. This avoids requesting normal response storage for later retrieval through that feature; it does not mean OpenAI retains no data. The provider may process or retain information for security and abuse prevention under the applicable terms and controls. We do not claim this account has Zero Data Retention or exclusively European processing.

Messages and context may be retained temporarily in your browser and on the server. When you submit a commercial request, relevant summaries, tasks and selections may enter the CRM; this does not mean every complete conversation is stored there. Automated recommendations are guidance and do not independently accept an order or make decisions with equivalent legal effects.

Provider information: OpenAI API data controls.

5. Photographs

In Assistant, a photograph is resized or processed for the enquiry and transmitted to OpenAI. In this flow EMS does not save the original photo file on its server, but a thumbnail may remain in the browser session and visual observations may become part of the context or request.

Photographs sent through Contact are saved in private hosting storage, separate from public files, and can only be viewed by authorised CRM users. Avoid including faces, registration plates, documents or unnecessary identifying information.

6. Hosting and data organisation

The website uses WordPress hosted by Webempresa. Enquiries are saved in form records and EMS CRM in the website database; emails also remain in the hosting email service. Copies of an enquiry may exist in forms, CRM, email and backups. Temporary assistant and selection data uses browser and server storage.

Access to CRM, correspondence and private photos is restricted through authentication and permissions. Deleting a browser conversation does not automatically delete a commercial request already submitted or every copy of it.

7. Authorised people and technical services

Authorised people handling enquiries and commercial relationships can access the data. As a normal business practice, we do not disclose customer data to the EMS manufacturer or commercial partners. This does not exclude necessary technical services:

• Webempresa: hosting, database, email, private files and associated services.
• WordPress and Formidable: software installed on the hosting service for pages, forms and records. Using them does not by itself mean all this data is sent to their developers.
• OpenAI API: assistant processing described above.
• Telegram: internal notifications containing name, company, country, products, request details and sales status or task. They do not include email, telephone, full conversations or photos. Opening a lead requires WordPress authentication.
• Weglot: public content translation and language selection. Native Assistant/Finder components and emails are not used as a private-conversation translation service.
• Google Fonts and WordPress.org resources: the browser requests fonts and resources such as emoji, transmitting network metadata. Gravatar may be used for authenticated users' avatars.

WhatsApp and social links open external services if you choose to use them; their own privacy notices apply there. Data may also be disclosed to authorities where legally required.

8. International processing

Some technical services, particularly OpenAI and external resources or platforms, may involve processing or access outside the European Economic Area. We do not claim all processing takes place in Spain or the EU.

Locations and safeguards depend on the provider, its subprocessors and the account configuration or terms. This policy does not claim EMS has a particular standard contractual clauses agreement, adequacy arrangement or regional setting that has not been verified. You can request information about recipients and applicable safeguards at info@kefigroup.es.

9. Retention and deletion

Data is retained for the time necessary to handle the enquiry and commercial relationship and afterwards, where relevant, for the periods needed to comply with legal obligations or establish, exercise or defend claims. We do not set one universal numerical retention period for all enquiries, photos and emails.

Navigation, assistant and selection context has a limited technical lifetime; some data is invalidated when an expired session is restored. This does not guarantee simultaneous deletion from all devices, provider systems or backups.

Deletion must consider form records, CRM, email, photos, internal notifications and backups. There is no promise of complete automatic deletion based on age: rights requests are handled by the controller and may require review of those copies and retention obligations.

10. Cookies and browser storage

The website uses session storage to remember Finder answers, conversation, tasks, thumbnails and product selection, and to maintain context when moving to Quote. Cookies or local storage are also used for language, WhatsApp link state and technical WordPress or form functions where relevant.

Visit origin, UTM parameters and a limited set of journey events may accompany a request submitted to CRM. No active Google Analytics, Meta Pixel or equivalent advertising-tool integration has been configured in the verified commercial interfaces.

You can manage cookies and storage through your browser; blocking necessary functions may prevent language, conversation or selection from being remembered. This policy does not replace consent for non-essential storage where required by law.

11. Your rights

You can request access, rectification, erasure, restriction, objection and, where applicable, portability of your data. You can withdraw consent for processing based on it and object to legitimate-interest processing under the GDPR conditions.

Send your request to Kefi Bosque Group S.L. at info@kefigroup.es or the postal address above. Specify the right requested and the minimum information needed to locate your enquiry; additional identity information will only be requested where necessary. Requests will be handled within the applicable statutory time limits.

You may complain to the Spanish Data Protection Agency (AEPD), without prejudice to your other rights.

12. Security and changes

The website applies HTTPS, authentication and permissions for administrative access, request controls and specific measures for private photos. Do not provide information unnecessary for the cleaning task or enquiry.

This policy will be updated when purposes, data or services change. The update date appears at the beginning. You can request clarification from the privacy contact.