Konduce

Privacy policy

Last updated: 29 April 2026

This is a courtesy translation. The Spanish version prevails in case of discrepancy.

1. Data controller

The controller of your personal data is Konduce SL, registered in Barcelona (Spain), contact email privacy@konduce.cat. To exercise your rights you can also reach the data protection officer at the same address.

2. Data we process

We process the following categories of personal data:

  • Account data: first name, last name, email, phone, hashed password, role within the driving school.
  • Student data: name, national ID, address, date of birth, contact details, enrolment date, licence category, academic progress, digital handwritten signature, payment history.
  • Usage data: session identifiers, browser, IP, audit events (booking creation, edits, payments).

3. Purposes and legal basis

We process data to deliver the management service to the contracting driving school (students, schedule, payments, automated communications), to comply with legal obligations (invoicing, retention of practice records) and to protect the integrity of the platform (audit log, fraud prevention). The legal basis is performance of the contract with the driving school and, where applicable, a legal obligation or our legitimate interest in protecting the platform.

4. Retention periods

We retain data while the customer has an active contract and, afterwards, for the periods required by tax and commercial law (up to 6 years). Audit log entries are kept for 2 years. Once those periods elapse, data is irreversibly deleted or anonymised.

5. Recipients

We do not share data with third parties unless necessary to provide the service. The main processors we use are:

  • Supabase Inc. (database and authentication) — Frankfurt, EU
  • Vercel Inc. (hosting and CDN) — EU
  • Stripe Payments Europe Ltd. (payment processing) — Ireland, EU
  • Resend Inc. (transactional email) — EU/US (Standard Contractual Clauses)

6. Your rights

You have the right to access, rectify, erase, object to, port or restrict the processing of your data. You can exercise these rights by emailing privacy@konduce.cat. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

7. Security

We apply reasonable technical and organisational measures: encryption in transit (TLS 1.2+) and at rest, role-based access control, hash-chained audit logging, daily backups and periodic reviews. Only authorised staff access the production infrastructure.

8. Changes

Any material change will be communicated by email to the administrators of each customer driving school at least 15 days in advance.