Privacy policy
Version KK-PP-2026-01 · Effective from September 14, 2026 · Replaces the previous version ·
This Policy explains what personal data we process, for what purposes, on what legal basis, for how long, and what rights you have. It forms part of the contract together with the Legal Terms, the Informed Consent and the Cookie Policy.
The Informed Consent sets out in detail how the animal sample, the results and the voluntary options are processed, and prevails over this Policy in those matters.
1. Who is the data controller
Data controller: GENELINK, S.L., owner of the Koko Genetics™ brand. Tax ID (NIF) B98649494. Registered address: Calle Arquitecto Mora 5, floor 2, door 4, 46010 Valencia, Spain.
• General contact: info@kokogenetics.com · Telephone: +34 960 090 596
• Privacy and exercise of rights: lopd@tellmegen.com
• Data Protection Officer: dpo@tellmegen.com
• Supervisory authority: Spanish Data Protection Agency (www.aepd.es) or the supervisory authority in your country of residence.
Koko Genetics, tellmeGen and Vivabioma are brands of GENELINK, S.L. and may share corporate infrastructure and support channels. This does not authorise the data from their services to be combined: any combination requires prior information and a valid legal basis or, where applicable, a specific voluntary option.
The service is organised from Spain and we apply Regulation (EU) 2016/679, Organic Law 3/2018 and Law 34/2002 on information society services.
2. Who this Policy applies to
It applies to those who visit the Website, create an account, purchase our services, take part in promotions or prize draws, use genetic matching features or communicate with our support team.
3. Nature of the data
3.1 Your animal's DNA, considered in isolation, is not genetic data relating to a natural person within the meaning of the Regulation and does not provide information about your own genetics or your health.
3.2 However, the kit identifier, ownership or care of the animal, your account, your contact details, questionnaires, messages and results linked to you do constitute your personal data and are processed in accordance with the Regulation.
3.3 The method is designed for the DNA of the species being analysed. We do not seek or interpret human DNA; any incidental human signal is neither interpreted nor included in a report.
4. What data we process and where it comes from
4.1 Categories of data:
• Account and contact details: first and last name, email address, encrypted password, address, telephone number, language and country.
• Animal information provided by you: name, species, stated breed, sex, age and any other information you provide.
• Animal biological sample and unique kit identifier.
• Technical analysis data, results, reports and their versions.
• Genetic data files that you upload from another provider.
• Responses to questionnaires and surveys.
• Contracting, billing and transaction metadata. We do not store complete card numbers.
• Platform use: logins, reports viewed, downloads and data collected through cookies.
• Profile, content and messaging within the genetic matching features, if you activate them.
• Communications with customer support and incident records.
• Data relating to participation in promotions and prize draws.
4.2 Source. The data comes from you or is generated during the provision of the service. We do not obtain personal data from external sources in order to profile you.
5. Why we process your data and on what legal basis
• To provide the contracted service, manage and analyse the sample, and issue, host and update the reports: performance of the contract (Art. 6(1)(b) GDPR).
• To create and manage your account, logistics and access to reports: performance of the contract.
• To verify that the kit comes from an authorised channel and that you are entitled to act in relation to the animal, and to prevent fraud: legitimate interest in the security of the service (Art. 6(1)(f) GDPR) and, where applicable, the relevant legal obligation (Art. 6(1)(c)).
• To handle your rights and requests for access and portability: legal obligation (Art. 6(1)(c) GDPR).
• To manage promotions and prize draws, select and contact winners, and deliver prizes: performance of the accepted rules and, where applicable, your consent (Arts. 6(1)(b) and 6(1)(a) GDPR).
• Genetic matching and messaging between users, when you activate them: your specific consent (Art. 6(1)(a) GDPR).
• To moderate content, handle reports and ensure platform security: legitimate interest and compliance with the rules applicable to digital services.
• Research and development, including the training of artificial intelligence models, within each of its separate categories: your specific and separable consent (Art. 6(1)(a) GDPR).
• To comply with legal, tax and quality obligations, and to retain the restricted archive referred to in section 8: legal obligation (Art. 6(1)(c) GDPR).
• Transactional and support communications: performance of the contract.
• Electronic marketing communications: your consent or, for products and services similar to those already purchased, the legitimate interest provided for under information society services legislation, with a simple and free opt-out in every communication.
• Platform security and defence against claims: legitimate interest (Art. 6(1)(f) GDPR).
Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal. Where it is based on our legitimate interest, you may object and we will assess your particular situation; the balancing test is available to you by writing to dpo@tellmegen.com.
6. Research, development and artificial intelligence
6.1 Participation is voluntary, separable and revocable, and does not affect the service or its price. Separate authorisation is given for internal research and improvement, external scientific projects, and research and development with commercial partners.
6.2 Where you authorise it, we may use analysis data and, where applicable, your questionnaire responses, in minimised, pseudonymised or anonymised form, to develop, train, validate and improve analytical models and artificial intelligence systems.
6.3 Participating third parties receive pseudonymised or aggregated data, under contract and with an express prohibition on re-identification.
6.4 These authorisations relate to data, not to the physical sample: any research use of the sample requires separate consent.
6.5 You may withdraw any of the authorisations as easily as you gave it. Withdrawal prevents new inclusions and ends future processing based on it, but does not affect processing already lawfully carried out, publications already made, data irreversibly anonymised or models already trained.
7. Minors
7.1 Koko Genetics services are intended for persons over 18 years of age, who are the persons permitted to purchase and register a kit.
7.2 In Website forms aimed at the general public, and in accordance with Spanish law, children under fourteen must not provide their personal data without the consent of the person exercising parental responsibility or guardianship. If we detect that data has been provided in those circumstances, we will delete it as soon as possible.
7.3 Participation in promotions and prize draws is restricted to persons over 18 years of age.
8. Retention periods and restricted archive
• Account and contract: for the duration of the relationship and, afterwards, for the applicable limitation periods.
• Billing and accounting: for the periods required by commercial and tax legislation.
• Biological sample: normally for up to two months after completion of the analysis, subject to the exceptions set out in the Informed Consent.
• Technical data, results and reports: for as long as your account remains active, so that you can consult them and so that they can be updated.
• Genetic matching profile, content and messaging: while the feature is enabled, and afterwards in accordance with the applicable periods for moderation and defence against claims.
• Promotion and prize draw data: for the duration of the promotion and for the periods necessary to demonstrate its proper management and the delivery of the prize.
• Technical and security logs: between 12 and 24 months, proportionate to their purpose.
• Record of consent acceptance: for as long as liability may arise.
8.1 If you request deletion of the technical analysis data, updates and reinterpretations will no longer be possible without a new sample. We will warn you before carrying out the deletion.
8.2 When you request deletion or close your account, information that we must retain for legal, tax or quality obligations or for the defence against claims is placed in restricted storage, with access limited, is not used for any other purpose, and is deleted when the applicable period expires.
8.3 Backups are deleted or overwritten in accordance with their ordinary cycles, with a maximum target of 30 days from operational deletion.
9. Recipients, processors and sub-processors
9.1 We do not sell or rent your personal data. We may disclose it to the following categories of recipients:
• Genotyping laboratories, which receive the sample coded with the unique identifier.
• Infrastructure, hosting, storage and security providers.
• Payment gateways and payment providers.
• Logistics operators.
• Support, communication, messaging and analytics tools.
• Prize draw management platforms, when you participate in one.
• Research partners, where you have authorised this and with pseudonymised or anonymised data.
• Authorities and public bodies, where there is a legal obligation.
9.2 All processors are bound by contract in accordance with Article 28 of the Regulation, with appropriate technical and organisational measures. Replacing a provider does not broaden the purposes or reduce your rights.
9.3 You may request the current specific list of processors and sub-processors at any time, including their location and role, by writing to lopd@tellmegen.com.
10. International transfers
10.1 Analysis and data storage take place within the European Economic Area, using the providers identified in the list referred to in section 9.3.
10.2 If any ancillary feature involved processing outside the European Economic Area, we would apply appropriate safeguards: a European Commission adequacy decision, standard contractual clauses together with a transfer impact assessment and supplementary measures, or binding corporate rules. The transfer would be identified in that same list.
10.3 You may request information about the safeguards applied and, where applicable, a copy of them by writing to dpo@tellmegen.com.
11. Genetic matching and user content
11.1 Animal matching features are disabled by default and require separate activation. Before you activate them, you are informed which elements of your profile other users will see and how messaging works.
11.2 Your contact details are not disclosed to other users without an additional and unambiguous action on your part.
11.3 You may disable the feature at any time. Disabling it stops new visible matches and removes your profile from the active index, but it does not delete messages or notifications that another user has already lawfully received.
11.4 We may apply automated filters and proportionate human review to detect fraud, abuse or unlawful content, and may limit visibility, remove content or suspend accounts, informing you of the reason and of the available avenues for challenge where required by law.
12. Promotions and prize draws
12.1 In promotions and prize draws, we may collect your name, email address, profile on the relevant social network and the data necessary to manage the promotion and deliver the prize.
12.2 Winners are selected using online prize draw tools and are announced or contacted through the channels specified in the rules. If they do not respond or do not provide delivery details within the period specified in the rules, the prize may be reassigned.
12.3 For physical prizes, we may request a delivery address, which is used solely for that delivery.
12.4 Subscription to marketing communications is always optional and separate from participation: it is not a condition for access to the prize draw.
12.5 We may exclude a participant in the event of fraud or breach of the rules, giving reasons for the decision.
13. Marketing communications
We may send you information about Koko Genetics products or services where you have consented or where they concern products or services similar to those you have already purchased. You may object at any time, easily and free of charge, using the link included in each communication or by writing to lopd@tellmegen.com.
14. Cookies and advertising
14.1 We use technical and analytics cookies and, only with your consent, advertising cookies. At the first level of the panel, you can accept, reject or configure your preferences, and change them whenever you wish. Details are set out in the Cookie Policy.
14.2 For analytics and advertising functions, we share information with our partners, including Google, in accordance with its European Union user consent policy.
14.3 These tools do not under any circumstances access your animal's sample, its analysis data or the content of its reports.
15. Security and data breaches
15.1 We apply technical and organisational measures appropriate to the risk and suited to the state of the art, the nature of the data and the existing risks: encryption in transit and at rest, logical separation of identifiers, role-based access controls, logging and monitoring, incident management, and data protection by design and by default.
15.2 No information system is completely immune to risk. If a security breach occurs that is likely to result in a high risk to your rights, we will notify you without undue delay, indicating the nature of the incident, its possible consequences and the measures taken.
16. Your rights
16.1 You may exercise the rights of access, rectification, erasure, restriction of processing, portability and objection, withdraw any consent you have given, and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
16.2 To exercise these rights, write to lopd@tellmegen.com or by post to GENELINK, S.L. (reference: Data Protection), Calle Arquitecto Mora 5, floor 2, door 4, 46010 Valencia, Spain. We may ask you to verify your identity in a proportionate manner where there is reasonable doubt, without requiring unnecessary documentation.
16.3 We will respond within one month, which may be extended by a further two months if the request is complex; we will inform you of the extension within the first month.
16.4 Exercising your rights is free of charge, except in the case of manifestly unfounded or excessive requests, particularly because they are repetitive, in which case a reasonable fee may be charged or action may be refused, with reasons given.
16.5 You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority in your country of residence.
17. Change of control and business succession
17.1 GENELINK may be involved in corporate transactions such as a merger, demerger, financing or the transfer of all or part of the business, including the separate transfer of the Koko Genetics brand.
17.2 During preliminary negotiation and due diligence stages, only strictly necessary aggregated, statistical or pseudonymised data may be shared, under a confidentiality agreement and access controls. Individually identifiable records will not be provided under any circumstances.
17.3 If the transaction is completed, the acquiring entity will succeed as data controller and will be bound by the Informed Consent and this Policy, without expanding the purposes. We will notify you without undue delay and, wherever possible, before it begins processing your data.
17.4 For materially different purposes, the new controller must inform you and obtain a valid legal basis or, where applicable, new consent.
17.5 In the event of insolvency or liquidation, your data may only be transferred as part of the continuity of the service and with equivalent safeguards; otherwise, it will be deleted or anonymised, except for records that must be retained by law. These rules do not in themselves authorise a standalone sale of personal data or samples.
18. Changes to this Policy and proof of consent
18.1 We may update this Policy due to legal, technical or service changes. Each version has a code and date, and you may request the version history at lopd@tellmegen.com.
18.2 If a change expands the purposes, categories of data or recipients, or affects any of your consents, we will inform you before it takes effect and, where appropriate, request a new affirmative action from you. We will not apply new purposes to data already collected without that basis.
18.3 We retain evidence of each consent given, including the version of the text shown to you and the date and time. You can view and download it from your account.
19. Contact
For any question relating to this Policy, you may write to lopd@tellmegen.com or, for matters requiring the involvement of the Data Protection Officer, to dpo@tellmegen.com.