Privacy policy

Last updated: June 2026

Confidentiality and security are fundamental values of KANGURO. We are committed to safeguarding the privacy of our users' personal data at all times, collecting only the information that is necessary to provide our services.

Below you will find all the information you need about the personal data we collect, how we process it and what your rights are.

1. Who processes your personal data?

The data controller is KANGURO DELIVERY S.L. (hereinafter, "KANGURO"), NIF B-06995302, with registered office at Pl. Ausiàs March 1, pl. 1 of. 10, 08195 Sant Cugat del Vallès (Barcelona).

Depending on the nature of the relationship, KANGURO may act as data controller where it processes data in its own name, or as data processor where it does so on behalf of a third-party controller, on the terms set out in the corresponding processing agreement.

For any query, communication or request relating to data protection, you may contact us through:

• Email: privacidad@kanguro.com
• Website: https://kanguro.com

KANGURO processes your data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and with Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

2. Who are the groups of data subjects?

The personal data processed by KANGURO may come from the following groups:

• Customers and prospective customers: individuals who have contacted us through the website, requested information or a quote for our services, or asked to receive commercial communications.
• End users of the services: users who contract and use the services offered by KANGURO in any of their forms, in accordance with the applicable terms and conditions.
• Software users: this includes two distinct profiles:
  • Providers (local businesses): establishments that use KANGURO's services to manage and receive parcels through logistics operators.
  • Shipment recipients: individuals who have sent or received a shipment through an e-commerce platform, either via a logistics operator (carrier) partnering with KANGURO or directly.
• Couriers: natural persons who provide delivery services as part of KANGURO's activity.
• Partner companies and suppliers: entities that share with KANGURO the personal data of their representatives or contact persons in connection with the conclusion and performance of service contracts.
• Applicants in recruitment processes: individuals who have submitted a job application or are taking part in a recruitment process.
• Customers referred by third parties: users who access KANGURO's services on the recommendation of a third party or through referral programmes.
• Website visitors: individuals who browse KANGURO's website and have accepted the use of analytics cookies, as well as users of the chatbot available on the website.

3. What personal data do we process?

Depending on the group and the purpose of the processing, KANGURO may process the following categories of personal data:

• Identification data: first name and surname, identity document (DNI/NIE/passport).
• Contact data: postal address, email address and telephone number.
• User account data: username and access credentials.
• Economic and financial data: payment information, including details of the physical or virtual KANGURO card, and bank details for the management of collections and payments.
• Professional profile data: employer company, employee identifier and benefits scheme, where applicable.
• Professional and application data: curriculum vitae and career history, in the context of recruitment processes.
• Online identifiers: cookies, IP address, device identifiers and browsing data, in the context of access to the website.
• Voice data: recordings of telephone calls held with shipment recipients through the customer service line (call centre).

4. For what purpose and on what legal basis do we use personal data?

KANGURO processes personal data for the purposes set out below, together with the legal basis on which each processing operation relies and the applicable retention period.

4.1. Conclusion, development and performance of the contract

We process the data of our customers and suppliers to the extent necessary to manage the contractual relationship: customer onboarding, provision of the contracted services, incident handling, and commercial and business communications relating to the performance of the contract.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Retention: the data will be retained for the duration of the contractual relationship and, once it has ended, will remain blocked for 6 years in compliance with commercial obligations (Art. 30 of the Spanish Commercial Code), unless the rights of erasure or objection are exercised earlier.

4.2. Processing of payments, collections and invoicing

We process the data required to issue and send invoices to customers, as well as to manage payment to suppliers for the agreed services.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

Retention: invoicing data will be retained for 6 years after issue, in accordance with Article 30 of the Spanish Commercial Code.

4.3. Handling and responding to requests for information

We use the contact details provided in order to respond to enquiries received through the website form, the published contact email addresses or our WhatsApp channel.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).

Retention: the data will be retained, duly blocked, for one year from the resolution of the enquiry.

4.4. Sending commercial communications

We process the contact details of those who have expressly consented to receive commercial information from KANGURO, including communications about products, services, news, promotions and, where applicable, cross-selling of complementary products or services.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR) or KANGURO's legitimate interest (Art. 6(1)(f) GDPR) in respect of existing customers, on the terms set out in Art. 21.2 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

Retention: the data will be processed for this purpose until the data subject withdraws consent. Withdrawal does not affect the lawfulness of processing carried out beforehand.

4.5. Analysis of website visits

KANGURO uses web analytics techniques to gather statistical data on visits and browsing patterns on its website, in order to improve the user experience and the performance of the platform. To that end it relies on third-party services which have their own privacy policies.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR), obtained through the cookie management panel.

Retention: in accordance with the periods set out in our Cookies Policy and in the policies of the analytics service providers engaged.

For further information, please see our Cookies Policy.

4.6. Handling applications in recruitment processes

We process the personal data of those who apply for the recruitment processes open at KANGURO, in order to assess their suitability for the role and, where applicable, to formalise the employment relationship.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR) and, in the event of hiring, performance of the employment contract (Art. 6(1)(b) GDPR).

Retention: once the recruitment process has closed, the data of unsuccessful applicants will be retained for one year so that they can be contacted should a new vacancy matching their profile arise, unless the data subject requests its erasure.

4.7. Recording of customer service calls (call centre)

KANGURO records the telephone calls held with shipment recipients through its customer service line (call centre) for the following purposes: (i) to collect the data subject's contact details in order to approach them at a later date and offer them KANGURO's services again; and (ii) to monitor and improve the quality of the customer service provided. At the start of the call, the data subject is informed that the conversation may be recorded and of the purpose of that processing.

Legal basis: consent of the data subject (Art. 6(1)(a) GDPR) as regards the processing of their contact details in order to offer them KANGURO's services again; and KANGURO's legitimate interest (Art. 6(1)(f) GDPR) as regards monitoring and improving the quality of the customer service provided.

The recordings will be retained for a period of 6 months from the date of the call, after which they will be securely deleted or anonymised, unless a longer period is necessary in order to handle an ongoing complaint or official request.

5. How do we protect your personal data?

KANGURO applies appropriate technical and organisational security measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration, in compliance with Article 32 GDPR.

The measures in place include, among others: encryption of data in transit and at rest, role-based access control and the principle of least privilege, regular staff training in data protection and information security, and procedures for managing and notifying security breaches.

6. Where do we store your personal data?

Users' personal data is stored on secure servers located within the European Economic Area (EEA), ensuring the availability, integrity and confidentiality of the information at all times through appropriate technical and organisational measures.

7. Who has access to your personal data?

KANGURO will only share your personal data with third parties where this is necessary to provide our services, where you have asked us to do so or where we are legally required to do so.

In addition, the following types of recipients may access your data as data processors acting on behalf of KANGURO:

• Payment and payment-processing service providers.
• Technology service providers, including cloud hosting, data analytics platforms and communication tools.
• Legal, tax and financial advisers.
• Regulatory authorities and public bodies, where this is necessary to comply with legal obligations or in response to legitimate requests from those authorities.
• Partner companies, where there is a legitimate interest connected with the provision of the service and the disclosure entails a benefit or added value for the data subject.

7.1. International data transfers

At present, users' personal data is located primarily on servers within the EEA. However, some of our cloud service providers are established in third countries, in particular in the United States of America. In such cases, KANGURO carries out international data transfers only where they are necessary to provide the services, and applies the appropriate safeguards required by the GDPR.

Specifically, transfers to providers established in the United States rely on the EU-US Data Privacy Framework, approved by the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795).

8. How can I exercise my rights?

In accordance with Articles 15 to 22 GDPR and Articles 12 to 18 LOPDGDD, data subjects may exercise the following rights:

• Right of access: to obtain confirmation as to whether KANGURO processes personal data concerning them and, if so, to access that data.
• Right to rectification: to request the correction of inaccurate or incomplete data.
• Right to erasure: to request the deletion of their data where, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing: to request that the processing of their data be limited to its storage for the exercise or defence of claims.
• Right to object: to object to the processing of their data on grounds relating to their particular situation. KANGURO will cease processing the data unless it can demonstrate compelling legitimate grounds or the processing is necessary for the exercise or defence of claims.
• Right to data portability: to receive their data in a structured, commonly used, machine-readable format, where the processing is based on consent or on the performance of a contract and is carried out by automated means.

To exercise any of these rights, you may write to KANGURO at privacidad@kanguro.com, stating the following details:

• First name and surname of the applicant.
• Contact email address.
• The right you wish to exercise.
• A description of the data to which your request relates.

KANGURO will deal with your request within a maximum of one month from receipt, extendable by a further two months in particularly complex cases, and will communicate its decision to the email address provided.

Should the exercise of your rights not have been satisfactorily addressed, we inform you of your right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD), the competent supervisory authority, through its electronic portal: www.aepd.es.

9. How long do we keep your personal data?

Personal data will be retained for as long as is necessary to fulfil the purpose for which it was collected, as well as to comply with the applicable legal obligations.

Once the active retention periods have elapsed, the data will be blocked and kept available to the competent authorities for the limitation periods of the applicable legal actions. Once those periods have elapsed, the data will be securely deleted or anonymised.

For the specific retention period applicable to each processing purpose, please refer to section 4 of this Privacy Policy.

10. Changes to the Privacy Policy

KANGURO reserves the right to update this Privacy Policy where necessary in order to adapt it to legislative or case-law developments or to changes in its processing practices.

Where significant changes are introduced, KANGURO will give notice by publishing a prominent notice on its website or application, or by any other means ensuring that the data subject receives the information effectively.

11. Contact details

For any query relating to this Privacy Policy or to the processing of your personal data, you may contact KANGURO through the following channels:

• Postal address: Pl. Ausiàs March 1, pl. 1 of. 10, 08195 Sant Cugat del Vallès (Barcelona).
• Email: privacidad@kanguro.com