Privacy Policy

Controller: KLARED TECHNOLOGIES, S.L.

Registered office: Rúa Papagaio, 0, 15002 A Coruña, SpainTax ID (NIF): B26991331Registered in the Commercial Registry of A Coruña, sheet C-67823Privacy contact: privacy@klared.com

Data Protection Officer (DPO): Kertos GmbH (contact person: Dr. Kilian Schmidt), dsb@kertos.io. The appointment is registered with the Spanish Data Protection Agency (AEPD).

To exercise your rights or opt out, you can also use our rights-request and opt-out page: https://klared.com/en/privacy/requests.

KLARED operates a web-based platform that helps universities and research institutions identify university spin-offs, map applied research and technology transfer, understand alumni career paths and innovation ecosystems, and analyse data that these institutions provide to us.

What we collect: technical data when you visit our website (IP address, browser and device information, pages visited, date and time); and the information you send us through contact or demo-request forms or by e-mail (name, e-mail address, organisation, job title and the content of your message).

Why and on what basis:

• To operate, secure and improve the website – our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
• To answer your enquiry, arrange a demo or prepare a proposal – steps taken at your request before a contract (Art. 6(1)(b) GDPR) or our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR).

Cookies: our website only uses cookies and similar technologies that are strictly necessary for it to work. If we introduce analytics or other non-essential cookies, we will ask for your consent first (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE) and update this Policy.

How long we keep it: enquiry data for 12 months after our last contact, unless it leads to a contract (then Section 7 applies); server and security logs for 30 days, unless needed to investigate an incident.

Access to the Platform is granted to named users designated by our customers ("Authorized Users").

What we collect: identification and contact data (first name, surname, e-mail address, telephone number, job title or department); access credentials and authentication data; and technical and usage logs.

Why and on what basis:

• To create and manage your account, authenticate you and provide the Platform – performance of the contract with our customer, and our legitimate interest in providing the contracted service to the organisation you work for (Art. 6(1)(b) and (f) GDPR).
• To keep the Platform secure, detect misuse and provide technical support – our legitimate interest in the security and proper functioning of our service (Art. 6(1)(f) GDPR).

How long we keep it: for as long as your account is active. After the contract ends, account data is deleted, except where it must be kept blocked for the period in which legal claims may arise. Technical logs are kept for 90 days.

This section provides the information required by Article 14 GDPR to people whose personal data we have not collected directly from them.

5.1 What we do

We compile, validate and connect publicly available professional and educational information to help universities and university-related institutions understand the careers of their alumni, identify alumni-founded companies, measure the institutional and economic impact of their education and research, and support alumni relations.

5.2 Whose data

University alumni and graduates; founders and professionals whose professional history shows a connection with a university; and other adults appearing in relevant professional, company or official public records. We do not process data concerning children.

5.3 Categories of personal data

• Name and provider record identifiers.
• Public professional-profile URL or identifier.
• Education and university affiliations.
• Employment history, job titles and professional roles.
• Employer and company information.
• Professional location (city and country).
• Publicly disclosed company, founder and board relationships.
• Relationships between a person and a company that we have derived or consider probable, marked as inferred and accompanied by a confidence indicator.
• Data-quality, matching, freshness and confidence indicators.
• Professional or business e-mail addresses obtained from approved data providers, together with information on their origin, verification and freshness.
• Authorship and inventorship information from scientific publications and patents (e.g. author or inventor name, affiliation, publication or patent details).

We do not process: personal e-mail addresses, personal telephone numbers, home addresses, special categories of personal data (e.g. health, religion, political opinions, ethnic origin), or data relating to criminal convictions. We exclude fields that could allow such data to be inferred. We do not generate or guess e-mail addresses.

About professional e-mail addresses: these are supplied by our data providers. Unless we have evidence that a specific address was publicly displayed by you, we do not describe it as publicly available.

5.4 Where the data comes from

• Licensed data providers of publicly available professional information. Our main provider is Coresignal, which states that it collects only publicly available, business-related information and does not access login-restricted, private or paywalled areas. Further information: https://coresignal.com/data-transparency/.
• Patent-office records (e.g. EPO, USPTO, WIPO and national patent offices).
• Official company registers.
• Open scholarly databases (e.g. Crossref, PubMed, ORCID, ROR and open repositories).

KLARED itself does not scrape websites or platforms to collect personal data, does not use user accounts or credentials to access personal data and does not obtain information from login-restricted, private or paywalled areas. We review each data provider before use and at least annually. You can ask us which source your data came from (see Section 11).

5.5 Purposes and legal basis

We rely on our legitimate interests (Art. 6(1)(f) GDPR). These interests are:

• KLARED's interest in providing accurate and current alumni-intelligence services to universities and research institutions; and
• our customers' interest in understanding alumni career paths and outcomes, identifying alumni-founded companies, measuring institutional impact and maintaining relationships with their alumni.

We have documented a Legitimate Interests Assessment balancing these interests against your rights and expectations. We limit processing to professional information, restrict access to named users, and give you an unconditional opt-out. KLARED does not use your data for its own advertising or direct-marketing campaigns.

5.6 Who receives the data

• Institutional customers (universities and university-related institutions) whose alumni you are, or with whom your professional history shows a connection. They receive the data as independent controllers for their own use, only through named users, and are contractually prohibited from selling it, using it for employment screening, creditworthiness or other decisions with legal or similarly significant effects, combining it with sensitive data, or using it for unrelated marketing. If a customer contacts you, it must tell you where the data came from and how to opt out.
• Our service providers acting on our behalf (see Section 8).
• Public authorities where required by law.

5.7 Identity resolution, record linkage and automated processing

We use automated tools to validate, clean, deduplicate and link records from different sources, and to identify probable relationships between people and companies. These are data-quality functions; uncertain or unusual matches are reviewed by a person. We clearly distinguish verified facts from inferred relationships. We do not make any decision about you based solely on automated processing that produces legal or similarly significant effects (Art. 22 GDPR).

5.8 How long we keep it and accuracy

Records carry freshness timestamps and are refreshed at least every six months. Each record is kept for a maximum of 24 months from the last time it was verified or refreshed; records that cannot be re-verified within that period are deleted. When a customer contract ends, the dataset prepared for that customer is deleted within 30 days.

If you object or opt out, we keep a minimal suppression record (the identifiers needed to recognise you) for as long as necessary to ensure your data is not collected or processed again.

5.9 Why you may not have heard from us directly

We generally make this information available publicly rather than contacting each person individually. We do this only where we have assessed and documented that individual notification would involve disproportionate effort (Art. 14(5)(b) GDPR) – for example, where we hold no reliable contact details and obtaining them would require collecting more data about you. In those cases we apply the safeguards described in this section. Where individual notification is reasonably practicable, we notify people directly.

5.10 Your right to object and opt out

You can object at any time to our processing of your data (Art. 21 GDPR). In addition, you can opt out of KLARED's alumni-intelligence records without giving any reason, at https://klared.com/en/privacy/requests or by writing to privacy@klared.com. We will stop processing your data, add you to our suppression list and inform customers who have already received your data so that they can stop using it.

KLARED and our customers are separate controllers. An objection sent to KLARED covers KLARED's collection, enrichment, retention and future disclosure of your data. An objection sent only to a university or institution covers that institution's own processing. If you want both to stop, tell whichever of us you contact and we will forward the request to the other.

Customers may upload their own information to the Platform (for example, alumni or research-project lists) so that we can integrate and analyse it for them. For this data, the customer is the controller and KLARED is the processor: we process it only on the customer's instructions and under a data processing agreement (Art. 28 GDPR). If your data is included, please contact the relevant institution to exercise your rights. If you contact us, we will forward your request to that institution.

We process the name, position, contact details and, where required, identification data of people who sign or manage contracts with us, in order to manage the contractual relationship with the organisation they represent and to meet our legal obligations (Art. 6(1)(b), (c) and (f) GDPR). We keep this data for the duration of the relationship and afterwards, blocked, for as long as legal claims may arise, after which it is deleted.

We use the following providers, acting on our behalf under data processing agreements:

The Platform and the data described in Section 5 are stored and processed in European Union data centres. Several of our providers belong to groups headquartered in the United States, and e-mail sent to us (including rights and opt-out requests) is handled through Google Workspace, which may store data outside the European Economic Area. Where personal data is transferred, or may be accessed, outside the EEA, it is protected by appropriate safeguards under Articles 45 and 46 GDPR: the providers' participation in the EU–U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses included in their data processing agreements. You can request more information about these safeguards by contacting us.

We protect personal data with technical and organisational measures, including encryption in transit and at rest, multi-factor authentication, role-based and least-privilege access control, central logging and monitoring, managed backups, separation of development and production environments (development uses synthetic or obfuscated data) and a documented security incident management process.

Subject to the conditions set out in the GDPR, you have the right to:

• know whether we process your data, access it and obtain information about its source;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• object to processing based on legitimate interests, including the unconditional opt-out described in Section 5.10;
• receive data you provided to us in a portable format, where processing is based on consent or contract;
• withdraw consent at any time, where processing is based on consent, without affecting earlier processing.

To exercise your rights, contact privacy@klared.com, use https://klared.com/en/privacy/requests or contact our DPO at dsb@kertos.io. We respond within one month; this may be extended by two further months for complex requests, in which case we will tell you. We may ask for information to confirm your identity, and we will only use it for that purpose.

Complaints: you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your place of residence or work.

We will update this Privacy Policy when our processing changes. The version number and date at the top show when it was last updated. Where changes are significant, we will highlight them on this page.