Privacy Policy

Last updated: 26 October 2026

This is a translation, provided for convenience. In the event of any discrepancy between versions, the Portuguese version prevails.

This Privacy Policy describes how Kraken Steel ("we", "the company") collects, uses and protects the personal data of the users of the application available at app.krakensteel.eu ("the application").

Data controller
Data collected
Purposes and legal bases
Retention period
Recipients and processors
International transfers
Data subject rights
Cookies
Security
Changes
Contact

1. Data controller

Kraken Steel
NIPC (Portuguese tax number): 518101185
Rua dos Carvalhinhos n.º 77, Cabanelas — 4730-099 Vila Verde, Portugal
Email: geral@krakensteel.eu

2. Data collected

The following data are processed when the application is used:

Authentication data: for users who sign in with Google, the Google identifier, name, email address and profile photo, obtained through Google’s OAuth 2.0 flow. For users who sign in with a code by email, the email address and the time of each code request, used only for signing in; the code is valid for 10 minutes, can be used only once and is not stored. An account can be created without Google.
Profile and billing data: filled in on first sign-in and editable on the Profile page: whether the user is an individual or a company, the name (or company name), country and telephone number and, for a company, also the tax number (NIF/NIPC), address, postcode and town; the IBAN, if the user provides it. An individual may give their tax number or leave it blank: without a tax number, the invoice is issued to "final consumer", and the tax number can also be given when ordering. The VAT number of a company in another European Union country is checked in VIES (see section 5), and the response is kept: whether it is valid, the registered name and the date of the check. The invoice details of each order are kept with it, as they were on the day of purchase.
Saved delivery addresses: the delivery addresses the user chooses to save when ordering (name, address, postcode, town, country and telephone number), up to 20, to choose them again for a later order. They are deleted on the Profile page.
Link to a sales agent: if the user enters a sales agent’s code, that link and its date are recorded.
Quoting data: DXF/SVG files uploaded by the user, the selected parameters (material, thickness, finish, quantity) and the calculated quotes (including the corresponding PDF).
Order, payment and delivery data: the payment method and its status (for example, paid or awaiting the transfer), the payment date and the transaction reference; the delivery method and, for shipping by carrier or special transport, the recipient’s name, the delivery address, the telephone number, the account email, whether the recipient is an individual, the weight and dimensions of the packed order (boxes or pallets) and the estimated delivery date; if the customer asks for another way of shipping, also the message they write. Card, MB WAY or PayPal account details are entered directly on Stripe’s payment page and never reach Kraken Steel.
Language preference: the chosen language (Portuguese, Spanish, English or French), stored in the account and in a cookie, so that the application, the PDFs and the emails are shown in that language.
Technical data: an essential session cookie (needed to keep the user signed in), IP address and request timestamps, recorded temporarily for security and abuse prevention purposes.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Authentication and keeping the session open	Consent (Art. 6(1)(a))
Calculating quotes, generating PDFs, sending them by email at the user’s request	Performance of a contract and pre-contractual steps (Art. 6(1)(b))
Management of orders, payments, deliveries and the business relationship	Performance of a contract (Art. 6(1)(b))
Compliance with tax and accounting obligations	Legal obligation (Art. 6(1)(c))
Checking the VAT number in VIES, for the VAT exemption on sales to businesses in other EU countries	Legal obligation (Art. 6(1)(c))
Application security and abuse prevention	Legitimate interest (Art. 6(1)(f))

4. Retention period

Account data (authentication and profile): for as long as the user’s account is active. The user can delete their account at any time with the "Delete my account" button on the Profile page; the name, email, photo, Google identifier, the profile and billing data and the saved delivery addresses are then irreversibly deleted. The account becomes inactive and can no longer be accessed.
Quotes, orders and DXF/SVG files: while the account is active, the user can delete their quotes that have not yet been confirmed. When the account is deleted, quotes and orders are kept for Kraken Steel’s business records without the account data, linked only to an internal designation (for example, "inactive customer no. 12"); the same applies to the customer’s name in the agents' commission records. The delivery and invoice details of each order stay with it for the period required by law (see "Payment, delivery and invoice data"). Files are kept as they were sent: if they contain personal data (for example, names in the drawing), the user can request their deletion at geral@krakensteel.eu.
Documents relevant for accounting and tax purposes (e.g. invoicing): kept for the period required by law, as a rule ten years (see the Portuguese VAT Code and other applicable legislation).
Saved delivery addresses: until the user deletes them on the Profile page or deletes the account.
Payment, delivery and invoice data: kept with the order they relate to, also after the account is deleted, and, insofar as they are relevant for accounting and tax purposes, for the period required by law.
Emails with quotes: the messages sent from the application are kept in Kraken Steel’s mailbox (Google Workspace) and are not deleted automatically when the account is deleted. They can be deleted on request at geral@krakensteel.eu, unless the law requires them to be kept.
Technical security records (access logs): kept only for as long as strictly necessary for their purpose, as a rule no longer than 90 days.

5. Recipients and processors

Data are shared with the technical processors listed below, exclusively for operating the application and the website:

Google LLC / Google Ireland Ltd.: authentication (OAuth) and sending of emails through the Gmail API (Google Workspace), including the sign-in codes.
Railway Corporation: hosting of the application, EU West region (Amsterdam).
Cloudflare, Inc.: hosting of the institutional website (krakensteel.eu), DNS management for the krakensteel.eu domain and aggregated, cookie-free visit statistics for the website (Cloudflare Web Analytics).
Stripe Payments Europe, Ltd. (Ireland): processing of online payments (card, MB WAY and PayPal). When the customer pays with PayPal, the payment data also pass through PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).
CTT – Correios de Portugal, S.A.: transport of orders to Portugal (mainland and islands) and Spain. It receives the recipient’s name, the delivery address, the telephone number and the weight and dimensions of each box.
Packlink Shipping, S.L. (Spain): calculation of the cost and transport of orders to the rest of the European Union and of those exceeding CTT’s limits. It receives the recipient’s name, the delivery address, the telephone number, the email and the weight and dimensions of each box. Packlink delivers the order through the carrier of the chosen service.
Cargoboard GmbH & Co. KG (Germany): calculation of the cost and transport by groupage (boxes or pallets) and by a vehicle for the order alone. It receives the recipient’s name, the delivery address, the telephone number, the email, whether the recipient is an individual, and the weight and dimensions of the boxes or pallets. Cargoboard delivers the order through the partner carriers in its network.
Special transport carrier, hired case by case by Kraken Steel: the same delivery data, for that order only.
European Commission: VIES, the European Union’s VAT number validation system. The application sends the VAT number of businesses in other European Union countries and receives whether it is valid and the registered name.

Stripe and PayPal also process some of these data as independent controllers (for example, for fraud prevention), under their own privacy policies.

Sales agents: if the user links to a sales agent through an agent code, that agent has access to the user’s name, email and link date and, for the calculation of commissions, to the company name and to the number and value of the confirmed orders. The agent has no access to the files, the billing profile or the quotes not yet confirmed.

Kraken Steel does not transfer personal data to third parties for commercial purposes. We do not carry out direct marketing, automated profiling or automated decisions with legal effects on the data subject.

6. International transfers

Data are stored on servers located in the European Union (Amsterdam, the Netherlands). For Google authentication, the sending of emails, the processing of online payments and the delivery of the website through Cloudflare’s global network, transfers to Google, Stripe and Cloudflare servers located outside the EEA may take place; these transfers are covered by the EU-US Data Privacy Framework and by the Standard Contractual Clauses approved by the European Commission.

7. Data subject rights

Under the GDPR and Portuguese Law no. 58/2019, the user has the right to:

Access, rectification, erasure, restriction, objection and portability of their personal data.
Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Lodge a complaint with the competent supervisory authority: the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority.

These rights can be exercised directly in the application (updating the profile and deleting the account on the Profile page) or by request to geral@krakensteel.eu. Requests will be answered within one month at the latest.

8. Cookies

The application uses essential cookies only:

ks_sess and ks_sess.sig: session cookies needed to keep the user signed in between requests. Validity: 7 days.
kraken_lang: the application language (pt, es, en or fr), chosen in the selector at the top of the page or set in the link used to open the application (the website’s buttons open it in the language of the page). It is only created in those cases. Validity: 1 year.

No marketing, advertising, social media or analytics cookies are used. As we only use strictly necessary cookies, prior consent is not required under Art. 5(3) of Directive 2002/58/EC; even so, the user is informed of their existence through a banner on the first visit.

9. Security

The following technical and organisational measures are in place:

All communication is encrypted over HTTPS/TLS.
Session cookies flagged as secure and httpOnly.
Authentication through Google (OAuth 2.0) or with a single-use code sent by email, valid for 10 minutes: the application neither uses nor stores passwords.
Online payments are made on Stripe’s payment page (PCI DSS certified): the application never receives or stores card details.
Request rate limiting to prevent abuse.
Access to data restricted to Kraken Steel’s essential staff and, regarding the customers linked to them, to the sales agents (see section 5).

10. Changes to this policy

This Privacy Policy may be updated to reflect legal, technical or operational changes. The date of the last update is shown at the top of this page. In the case of substantial changes, users will be informed in the application.

11. Contact

For any question about the processing of your personal data or the exercise of your rights, please contact us:

Kraken Steel
Email: geral@krakensteel.eu
Address: Rua dos Carvalhinhos n.º 77, Cabanelas — 4730-099 Vila Verde, Portugal

See also the application’s Terms and Conditions of use.

Contents