Privacy Policy — ValidAR
Version 1.0 · In force since 24 August 2026 Published at: https://validar.kabunik.com/privacidad
1. Data controller
KABUNIK, S.L.U. — Tax ID B88736350 Calle Cuenca 13, 08980 Sant Feliu de Llobregat, Barcelona (Spain) Privacy contact: privacidad@kabunik.com
This policy explains how we process personal data in relation to ValidAR, our solution for assisted validation of steel structures using augmented reality, comprising the iPad application, the web administration application, the desktop add-in for Tekla Structures and the associated cloud services.
2. Two distinct roles
It is worth distinguishing two situations:
- Kabunik as data processor. When a customer company contracts ValidAR and registers its employees as users, that company is the data controller for its personnel's data and for its project information. Kabunik processes it on that company's behalf, following its instructions, under Article 28 of the GDPR and the End User Licence Agreement. If you are a ValidAR user at your company and wish to exercise your rights, address your company first; you may also write to us and we will pass your request on.
- Kabunik as data controller. In respect of data of our commercial contacts, people who contact us, visitors to our website and those requesting support, Kabunik decides on the processing and responds directly.
3. What data we process
| Category | Data | Source |
|---|---|---|
| Identification and account | Name and surname, work email address, organisation, user profile and permissions | Registration carried out by the customer company's administrator |
| Device technical data | Technical device identifier, model, operating system version, application version | Generated by the application on activation and use |
| Usage and diagnostic data | Session logs, application events, performance and tracking metrics, errors | Generated automatically during use |
| Inspection content | Photographs deliberately captured by the user, validation reports, annotations and data associated with the inspected assemblies | Supplied or generated by the user |
| Commercial contact data | Name, company, role, telephone and email of commercial and support contacts | Provided by the data subject or their company |
Use of the camera and sensors. The application needs access to the camera and, on devices that have it, to the LiDAR sensor, in order to overlay the digital model onto the real structure. The images captured continuously for tracking are processed on the device itself and are neither transmitted to nor stored on our servers. Only the photographs the user deliberately chooses to capture as part of an inspection report are retained and uploaded.
We do not process special categories of data, precise user geolocation data, or children's data. We do not use data for advertising purposes, we do not track across third-party apps or websites, we do not carry out profiling with legal effects, and we do not sell or transfer personal data.
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the contracted service: user registration, authentication, management of licences and seats, operation of the application | Performance of the contract with the customer company (Art. 6(1)(b) GDPR) and the controller's instructions (Art. 28) |
| Enabling the augmented reality functions by registering the technical device identifier | Performance of the contract |
| Diagnosing incidents, ensuring the security, stability and continuity of the service | Legitimate interest in the security and correct operation of the service (Art. 6(1)(f)) |
| Improving the product from aggregated usage data | Legitimate interest, processing the information in aggregated and anonymised form wherever possible |
| Handling support, commercial and information requests | Performance of the contract or pre-contractual measures, and legitimate interest |
| Complying with legal, accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
5. Telemetry and diagnostic data
ValidAR records technical information about how validation sessions run — duration, tracking quality, application events, errors and performance metrics — in order to diagnose problems and improve the product. This information may include technical data relating to the positioning of the device during the session.
We treat these records as confidential customer information: they are not used for purposes other than those described, nor disclosed to third parties, save where legally obliged. Each organisation's administrator can enable or disable telemetry collection from the administration panel, with the exception of the minimum information indispensable for security and billing. Diagnostic logs are retained for a maximum of 90 days.
6. Who can access the data
In addition to authorised Kabunik personnel bound by a duty of confidentiality, we rely on the following providers, acting as processors or sub-processors:
| Provider | Service | Location |
|---|---|---|
| Google Ireland Limited / Google LLC (Google Cloud Platform and Firebase) | Hosting, database, storage, authentication and service analytics | European Union and United States |
| Ingaria | Management and control of licences and user seats | European Union |
| Visometry GmbH | Issuance and validation of per-device technical tracking licences | Germany |
| Apple Inc. | Distribution of the mobile application | United States / European Union |
Where contracting takes place through an authorised reseller, the reseller accesses only the commercial contact data necessary to manage the relationship, not the inspection content.
We may also disclose data to public authorities and courts where legally required.
7. International transfers
Some of the providers listed may process data outside the European Economic Area. In such cases, transfers rely on the safeguards provided for in Chapter V of the GDPR, principally standard contractual clauses approved by the European Commission, supplemented by any additional measures that prove necessary. You may request information about these safeguards at privacidad@kabunik.com.
8. How long we keep the data
- Account and user data: for as long as the organisation maintains an active subscription and the user remains registered.
- Inspection content: for the duration of the contractual relationship. On termination, the customer has 30 calendar days to export its content; after that period it may be deleted.
- Telemetry and diagnostic logs: a maximum of 90 days, unless retention is necessary to investigate a specific incident.
- Commercial contact data: for as long as a relationship or legitimate interest in maintaining it exists, and until deletion is requested.
- Contractual and tax documentation: for the limitation periods required by law.
9. Security
We apply technical and organisational measures appropriate to the risk, among them: encryption in transit, access control by organisation and by role, isolation of each customer's information, access logging, user authentication and periodic review of permissions. No system is infallible; in the event of a security breach affecting personal data we will act in accordance with Articles 33 and 34 of the GDPR and will notify the data controller without undue delay and, where appropriate, the supervisory authority.
10. Your rights
You may exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw consent where processing is based on it, by writing to privacidad@kabunik.com and identifying yourself appropriately.
If you are a ValidAR user through your company, address your company first as data controller; we will pass your request on to it and assist it in handling the request.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid), in particular if you consider that you have not obtained satisfaction in exercising your rights.
11. Children
ValidAR is a professional tool aimed at businesses. It is not intended for minors and we do not knowingly collect their data.
12. Changes to this policy
We may update this policy to reflect regulatory, technical or functional changes. We will publish the current version at this same address, stating its date of entry into force and, where changes are substantial, we will inform customers with reasonable notice.
KABUNIK, S.L.U. — Version 1.0, 24 August 2026 — privacidad@kabunik.com