Data-processing terms

Summary

• Roles. Each business is the controller of the records it keeps in Kontxs. Kontxs processes them as its processor, only on its documented instructions.
• Use. Kontxs does not sell business records or use them for its own purposes. The one exception is anonymous statistics combined across at least 10 businesses, from which no business or person can be identified (section 3.9). Business records are not used to train artificial intelligence models used for other businesses.
• Retention. Kontxs has default retention periods for each kind of record. Accepting these terms adopts them as the business’s instruction. Admins can change them; each change is recorded. Records are deleted on schedule. Periods cannot be set below a legal minimum.
• Restricted records. Right-to-work checks are visible only to users given the HR role. Kontxs has no fields for health, criminal-record or other special-category information, and it must not be entered.
• Sub-processors. Listed at Sub-processor list. Admins are told at least 7 days before one is added or replaced and may object.
• Breaches. The business is told without undue delay after Kontxs becomes aware.
• Rights requests. Kontxs provides tools to find, export, correct, restrict and erase a person’s records. Requests sent to Kontxs are passed to the business.
• Leaving. A full export is offered first. Data is deleted once the business confirms receipt, or 30 days after the export was offered, and every copy, including backups, within 30 days of that. Some records may have to be kept by law after leaving; only the export holds them.
• Legal holds. Records can be placed on hold for a dispute. Holds are reviewed every six months. Kontxs does not keep a former customer’s data without a written arrangement.

1. Definitions and roles

1.1 “Kontxs”, “we”, “us”: Kontxs Limited, company number 17018593, registered office 167–169 Great Portland Street, London W1W 5PF. “You”, “the business”: the organisation that has a Kontxs account and has accepted these terms.

1.2 “Your data”: personal data that you, your team or people acting for you put into Kontxs, or that Kontxs creates from it, in your organisation’s account. It does not include the data in 1.4.

1.3 For your data, you are the controller and we are your processor. Terms such as personal data, processing, controller, processor, personal data breach and data subject have their meaning in the UK GDPR and the Data Protection Act 2018 (together, “data protection law”), as amended from time to time, including by the Data (Use and Access) Act 2025.

1.4 We are a controller, not your processor, for: the Kontxs accounts of the people who sign in (their name, email address and sign-in records, held with Clerk); our billing and business records about you; and technical and security records of how the service is used; usage and metering records (which business, user or connection made which kind of request, and when, with no contents of your records); and the credentials and records of connections your admins create. Our Privacy notice covers that data.

1.5 These Data-processing terms, including Annexes 1–4, form part of the agreement between you and us for the use of Kontxs (“the agreement”). The order of precedence in section 1.3 of the Terms of service applies. These Data-processing terms prevail on the processing and protection of your data. If an annex conflicts with the body of these Data-processing terms, the body prevails; the annexes supply the processing details, security measures, authorised sub-processors and retention defaults, subject to the changes and instructions permitted by these Data-processing terms.

2. What we process, and for how long

2.1 The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

2.2 We process your data for as long as the agreement lasts and then until it is deleted under section 13.

3. Your instructions (Art 28(3)(a))

3.1 We process your data only on your documented instructions. Your instructions are: these terms; the agreement; your settings and configuration in Kontxs (including your retention settings, section 4); and the actions you and your authorised users take in Kontxs.

3.2 Further instructions must be in writing (email to privacy@kontxs.com is enough) and must be something Kontxs can reasonably do; an instruction that needs work outside the normal service may be charged for, with your agreement in advance.

3.3 If a law of the United Kingdom requires us to process your data other than on your instructions, we will tell you before doing so, unless that law forbids telling you on important grounds of public interest.

3.3A Requests from public authorities. If the police, a court, a regulator or another public authority asks us for your data, we will refer the request to you where the law allows, disclose only what the law requires, tell you unless the law forbids it, and record each request.

3.4 If, in our opinion, an instruction from you breaks data protection law, we will tell you straight away and may decline to carry it out until you confirm or change it. We are not obliged to review your instructions for legality, and our not objecting to an instruction is not advice that it is lawful.

3.5 Your responsibilities. You are responsible for: having a lawful basis for putting each kind of data into Kontxs (which must not include special-category or criminal-record data — Terms of service §5); giving people the privacy information the law requires; deciding who in your team has which role; and the accuracy of what you enter.

3.6 Connected software and services. Requests made through software, an AI agent or a service your admins connect to Kontxs are your instructions. Its provider acts for you and is not our sub-processor, unless we provide the service under our own account, in which case section 8 applies. We are not responsible for your data once it has left Kontxs at your instruction.

3.7 Partner programmes. If you join a partner programme, the programme terms you accept say what information about your use of Kontxs we give the partner. Accepting them is your documented instruction to do so. We never give a partner the contents of your records or any information about your customers, suppliers or staff.

3.8 No other use. Except as section 3.9 allows, we do not sell your data, use it for our own purposes or combine it with another business’s data. We do not use it to train or improve any artificial intelligence model used for other businesses. Where Kontxs offers features that use artificial intelligence, we may process your data to provide them to you, through sub-processors under section 8.

3.9 Aggregated data. You instruct us to produce, from your data, statistics combined with those of at least 10 businesses, from which no person and no business can be identified. We follow the Information Commissioner’s guidance on anonymisation and check each statistic before release. Once produced, those statistics are not personal data and not your data (Terms of service §10.4).

4. Retention periods are your instructions

4.1 Kontxs comes with default retention periods for each category of record (Annex 4, and shown in your governance settings). Each default says what starts the clock, the shortest and longest time it is kept, what happens at the end (deletion, pseudonymisation or a review by you), and whether it rests on a legal requirement, a conditional legal requirement, recommended practice or our judgement.

4.2 By accepting these terms you adopt the defaults in force on the date you accept as your documented instruction under section 3.

4.3 You may change a period in your settings. Each change is recorded with who made it, when and why, and is a new documented instruction from that moment. Kontxs refuses a change that would shorten a period below a minimum that the law sets (or that a condition you have recorded as applying to you sets). Kontxs allows a period to be extended beyond its suggested maximum only if you record a reason, and shows it as a warning in your governance settings.

4.4 The defaults are proposals, not legal advice. We have based them on published law and guidance, and label each with its source. Whether they suit your business — in particular the ones marked “conditional”, such as keeping right-to-work records for two years after employment ends to secure your statutory excuse — is your decision as controller.

4.5 When we change a default, the change applies to your account only if you have not overridden that category; we will tell you at least 30 days before a change that shortens a period you rely on, so you can override it. A change we must make because the law changed may take effect sooner, and we will tell you as soon as we can.

4.6 Kontxs carries out your retention instructions automatically at least once a day, whichever product features you use: switching a feature off never switches off retention, disposal, legal holds or erasure. We monitor that disposal is running and will put right any failure without undue delay.

4.7 Disposal never removes a record that is under a legal hold (section 12), an open rights request, or a restriction of processing, except as section 12.4 says.

5. Confidentiality (Art 28(3)(b))

5.1 Everyone we authorise to process your data is bound by a written duty of confidentiality or a statutory one.

5.2 Only people who need access to run, secure or repair the service have access to the systems that hold your data, and they use it only for that or on your instructions. No Kontxs screen gives us a view of your customers’, suppliers’ or staff records. We will not look at your data except to provide or repair the service, on your instruction, or where the law requires it. If we have to look at records in the restricted HR area (right-to-work checks, emergency contacts) for any of those reasons, we will tell you, unless the law forbids it.

6. Security (Art 28(3)(c), Art 32)

6.1 We take the technical and organisational measures in Annex 2, which we consider appropriate to the risk, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing.

6.2 We may change those measures, but not so as to reduce the overall level of protection.

7. Restricted records, and data we may not hold

7.1 Right-to-work checks. You can record the outcome of a right-to-work check you carried out: the method, the date checked, the type of permission (unlimited or time-limited) and, for time-limited permission, its expiry or follow-up date. Kontxs does not store copies of documents. Inside your business, only users you have given the HR role can see these records. Admins do not see them unless they give themselves that role, which is recorded. Every view of a restricted record is recorded in your audit log.

7.2 If we are told we may not hold a kind of data. If one of our providers, or our data-protection adviser, tells us that we may not hold a kind of data for you — for example the type or expiry of a person’s permission to work, National Insurance numbers, or information entered in breach of section 5 of our Terms of service — then:

• (a) we stop showing that data in Kontxs straight away;
• (b) we tell your admins without undue delay, saying what is affected and who can take the export: restricted HR records (such as right-to-work) can only be exported by an admin who holds the HR role and has a second sign-in factor switched on;
• (c) for 30 days from that notice, your admins can take a full export of your data, which includes it, without closing your account;
• (d) when the 30 days end, we delete it from our live systems, and any remaining copy, including in backups, is gone or unreadable within a further 30 days, as for any other deletion (section 13.5). By accepting these terms you instruct us to delete it in that event.

Data under an active legal hold is also exported and then deleted, and the hold is recorded as the reason: we cannot keep processing data our provider forbids, so the export is how you keep that evidence. Until the data is deleted, we still include it in a full export if you leave (section 13) and in a copy you prepare to answer a person’s access request, because returning your data and answering people’s rights come first. If we are given no notice, the 30 days run from our notice to you. Where only one person’s record is affected — for example sensitive information typed into a note — we tell the admins and remove that record in the same way, with the same 30 days unless the data must be removed sooner.

8. Sub-processors (Art 28(2), 28(3)(d), 28(4))

8.1 You give us general written authorisation to use sub-processors. The sub-processors we use on the date you accept are listed on our Sub-processor list (Annex 3), with what they do and where.

8.2 Notice. At least 7 days before we add or replace a sub-processor that will process your data, we will email the admins of your account and update the Sub-processor list, saying who it is, what it will do, where, and under which transfer safeguard.

8.3 Objection. You may object on reasonable data-protection grounds by emailing privacy@kontxs.com within that notice period. We will discuss it with you in good faith. If we cannot resolve it, you may end the agreement before the change takes effect, and we will offer you an export (section 13) and refund any fees you have paid for the period after the end. The change does not apply to your data before the end of the notice period.

8.4 Our providers’ own sub-processors. Our providers use their own sub-processors, published on their websites (linked from our Sub-processor list). They do not always give us advance notice of changes. When a provider tells us of a change, we will pass it on to you within 5 working days, and 8.3 applies with the remaining time.

8.5 Emergency replacement. If a sub-processor must be replaced urgently to keep the service secure or running, we may make the change first and give you notice as soon as we can; 8.3 still applies.

8.6 We bind each sub-processor by a written contract to data-protection obligations giving at least the protection required by Article 28(3). We remain fully liable to you for each sub-processor’s performance of its obligations as if they were our own (subject to section 16).

8.7 Each notice under 8.2 and 8.4, and each objection and its outcome, is recorded against your account.

9. Transfers outside the UK

9.1 We keep your data in the UK wherever we reasonably can: the database is in London (Neon, eu-west-2), the application runs in London (Vercel, lhr1) and logo files are stored in London (Vercel, lhr1).

9.2 Our providers are companies based in the United States and reserve the right to process data in the United States and elsewhere to operate their services. Sign-in data is held by Clerk in the United States. Where your data is transferred outside the UK we rely on: the UK–US data bridge (the Data Protection (Adequacy) (United States of America) Regulations 2023) for providers certified to the UK Extension to the EU–US Data Privacy Framework; and otherwise, or in addition, the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in the provider’s Data-processing terms. The Sub-processor list shows which applies to each provider.

9.3 We will not move the storage location of your database or stored files out of the UK without notice under 8.2.

10. Helping you with people’s rights (Art 28(3)(e))

10.1 Kontxs provides tools for you to handle requests from people exercising their rights: to find what you hold about a person, produce a copy for review, correct, restrict, export and erase (with your decision recorded for each category of record), and to track the deadline. Where a feature is not yet available in your account, we will help you by other means.

10.2 If a person contacts us directly about your data, we will not answer the request ourselves; we will tell them to contact you and pass the request to you within 5 working days.

10.3 We will give you any further help you reasonably need to respond to a request within the time the law allows.

10.4 This help is free of charge, unless requests are manifestly unfounded or excessive, in which case we will agree a reasonable charge with you first.

11. Helping you with security, breaches and assessments (Art 28(3)(f))

11.1 We will help you meet your duties on security (Art 32), breach notification (Art 33 and 34), data protection impact assessments (Art 35) and consulting the ICO (Art 36), taking into account the nature of the processing and the information available to us — including by giving you the information in Annexes 1 to 3.

11.2 Breach notice. If we become aware of a personal data breach affecting your data, we will tell you without undue delay, by email to your account’s admins.

11.3 The notice will describe, as far as we then know: what happened; the categories and approximate number of people and records affected; the likely consequences; what we have done and propose to do; and who to contact. If we do not know everything at once, we will send what we know and follow up.

11.4 We will not notify the ICO or the people affected on your behalf unless you ask us to, and we will not describe the breach publicly in a way that identifies you without your agreement unless the law requires it.

11.5 We keep a record of every breach affecting your data, including those that turn out not to need reporting.

12. Legal holds during the agreement

12.1 You can place a legal hold on a person, an engagement, an account, a category of record or your whole business, when you expect or face a claim or investigation. While a hold is active, the held records are not deleted by disposal or erasure.

12.2 A hold must have a review date no more than 6 months ahead. A hold over your whole business needs a second person in your business to confirm it.

12.3 Kontxs will remind you before a hold’s review date.

12.4 If you do not re-confirm a hold within 30 days after its review date, it stops protecting records whose maximum retention period is set by law, or by law where a condition applies to you (no category does today), and they are disposed of on schedule, until you re-confirm it. Records held beyond a period that rests on guidance or our judgement are not deleted: they are put to you for review, and Kontxs keeps alerting you until you re-confirm or release the hold. This is because the law limits how long the first kind may be kept, and an unreviewed hold is not a reason we can rely on.

13. When the agreement ends: export and deletion (Art 28(3)(g))

13.1 Export first. Before your account can be closed, Kontxs offers your admins a full export: every record of your data in a structured, machine-readable format (JSON). Staff records in the restricted HR and payroll areas are included only for an admin who holds that role; an admin without it can give it to themselves first, which is recorded. We record who took the export and when.

13.2 Your choice. You may take the export, or tell us in Kontxs that you want deletion without an export. Either choice is recorded.

13.3 Deletion date. Your data is deleted on the earlier of: the date you confirm in Kontxs that you have received the export (or chose not to take one); and 30 days after the export was first offered to you.

13.4 For 7 days after the deletion date your account can still be restored if you ask us. After that, we delete your data and stored files from our live systems.

13.5 All remaining copies, including in database restore history and backups, are deleted or made unreadable within 30 days of the deletion date. The one exception is our sign-in provider: we delete your organisation and its membership from Clerk at the same time, and any copy Clerk keeps after that is deleted under Clerk’s own terms.

13.6 After deletion we keep only what is ours as a controller (section 1.4): the fact and date that your account existed and was deleted, your account’s former web address (so it is never reissued to someone else), and our own billing records. We keep none of your data.

13.7 You may still need your data. Some records must be kept by law after you leave us — for example right-to-work records (for two years after the employment ends, to keep your statutory excuse) and the records needed to defend claims. Once we have deleted your account, only your export has them.

13.8 We will not keep your data after the deletion date unless a law of the United Kingdom requires us to, in which case we will tell you what, why and for how long, and protect it under these terms until it is deleted.

13.9 If your organisation is deleted outside Kontxs — for example directly with our sign-in provider — we treat the day we detect it as the deletion date and do not delete your data from our live systems until 30 days after that date. We email each person our records last confirmed as an admin of your account before that date, once, at the email address our sign-in provider holds for them (if it still holds one), to say a full export is available during those 30 days. An admin gets the export by signing in to Kontxs with their own account and downloading it there; it is stored encrypted, every download is recorded, and no one at Kontxs handles it. Staff records in the restricted HR and payroll areas are included only for an admin who held that role in your account; any other admin can still take them by confirming, in Kontxs, that they are taking responsibility for them, and that confirmation is recorded. If we cannot reach any admin, we record that and delete on schedule. All remaining copies are deleted or made unreadable within 60 days of the deletion date.

14. Legal holds when you leave

14.1 If you close your account while a legal hold is active, the agreement ends, but your data is not deleted until section 14.2 allows. Take your export (section 13.1) first.

14.2 If a hold is still active when your data falls due for deletion, we postpone deletion for up to 90 days and write to each person our records last confirmed as an admin of your account before the deletion date, at the email address our sign-in provider holds for them (if it still holds one), as in 13.9. At the end of that time we release the hold and delete your data under section 13.

14.3 We do not keep a former customer’s data beyond that without a written arrangement agreed with you, which may carry a charge.

15. Information and audits (Art 28(3)(h))

15.1 We will make available to you all information reasonably necessary to show that we meet our obligations under Article 28 — including these terms, Annexes 1 to 3, our processor records, and answers to a reasonable written security questionnaire once a year.

15.2 Inspection. You (or an independent auditor you appoint who is bound by confidentiality and is not our competitor) may inspect our compliance with these terms: once in any 12 months; or at any time if the ICO requires it or after a personal data breach affecting your data. You will give us at least 30 days’ notice (unless the ICO requires sooner), the inspection will be during UK business hours and will not give access to other customers’ data, and you will bear its cost unless it finds we have materially failed to meet these terms.

15.3 Our providers do not allow their customers’ customers to inspect them. We will share their independent audit reports (such as SOC 2) with you where their terms allow; otherwise we will tell you what they cover.

16. Liability

16.1 Nothing in the agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.

16.2 Subject to 16.1, each party’s total liability to the other arising out of or in connection with the agreement (including these terms), whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total fees paid to us for your account, by you or by anyone for you, in the 12 months before the event giving rise to the claim or, if greater, the price of 12 months of our lowest-priced paid plan at the time of that event (or £100 while we have no paid plan).

16.2A The limit in 16.2 does not apply to:

• (a) amounts you owe us for Kontxs;
• (b) your breach of sections 5, 6 or 7 of the Terms of service; or
• (c) your obligations under 16.6.

16.3 Subject to 16.1, neither party is liable to the other for loss of profit, revenue, business or goodwill, or for any indirect or consequential loss.

16.4 Section 8.6 (our liability for sub-processors) is subject to this section.

16.6 Claims caused by you. You will compensate us for losses, damages and reasonable costs (including legal costs) arising from a claim or investigation by a third party, including a regulator, that results from: data you or your users put into Kontxs in breach of the agreement; your instructions; or software or services you connect to Kontxs. This does not cover fines imposed on us, or anything caused by our own breach of the agreement. Section 16.3 does not apply to this section. We will tell you promptly of any such claim and let you take part in its defence.

16.5 This section limits what the parties can claim from each other. It does not limit any right a person has under data protection law to claim compensation from either of us, or any fine the ICO imposes. Where both of us are liable to a person for the same damage, each of us bears the share that corresponds to its responsibility, as Article 82 provides: we are responsible only where we have not complied with the obligations data protection law places on processors or have acted outside or contrary to your lawful instructions. Each party bears its own regulatory fines.

17. Records

We keep the records data protection law requires of a processor (Article 30(2)), including the categories of processing we carry out for you, our sub-processors and transfers, and a description of our security measures.

18. Changes to these terms

18.1 We may change these terms by giving you at least 30 days’ notice by email to your account’s admins. A change required by law may take effect sooner.

18.2 If a change reduces the protection your data receives, you may object within the notice period and, if we cannot resolve it, end the agreement, take your export and receive a refund of fees paid for the period after the end.

18.3 Each version of these terms, and the date your business accepted it, is recorded.

18.4 If you keep using Kontxs after a change takes effect, you accept it. For a change that reduces the protection your data receives, we will also ask an admin to accept it in Kontxs.

19. Law

These terms, and any dispute about them, are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1 — Details of the processing

Subject matter

Providing Kontxs, a service for UK businesses to keep records of the people and organisations they deal with, their staff, their work and stock, and the governance of that data, through the web app, the phone apps and the API.

Duration

The term of the agreement, then until deletion under section 13.

Nature

Storage, organisation, retrieval, display, export, pseudonymisation, deletion and automated disposal on your retention instructions; calculation of charges and totals from what you enter; sending emails you or your instructions trigger, including replies to rights requests; exchange of data with software and services you connect; audit logging.

Purpose

To provide the service to you on your instructions.

Data subjects

Your customers (individuals, and people at customer organisations); your suppliers’ people; your staff — employees, workers, contractors, agency workers, apprentices, and unsuccessful candidates; emergency contacts your staff name; people who contact you about their rights or with complaints; your team members who use Kontxs, as recorded in your audit log and in your work records.

Personal data

Names and preferred names; contact details (email, phone, web) and addresses; organisation names that may be personal (for example partnerships); identifiers you choose to record (such as employee numbers, and in the payroll area National Insurance numbers and tax references); relationships between people and organisations; customer and supplier account details; employment details (dates, type, hours, job title, department, location, manager, reason for leaving); checks (right-to-work — method, date checked, type of permission (unlimited or time-limited) and, for time-limited permission, its expiry or follow-up date; qualifications; driving-licence categories and date checked); marketing and contact preferences and the evidence behind them; Privacy notices provided; rights requests, restrictions, complaints and their handling; legal holds; assets you record against a customer, such as vehicles, with their identifiers (such as registration numbers) and keepers; work records — bookings and visits, work proposed, agreed or declined and the customer’s decision, charges, completion records and short notes; audit records of who viewed or changed what.

Special category and criminal-offence data

None, by design. Kontxs has no fields for health, criminal-record or other special-category information, and the Terms of service (§5) forbid entering or uploading it. Right-to-work records hold the method, date and type of permission only, never a copy of a document, and are visible only to users you give the HR role.

Not collected by design

Date of birth, sex, gender, nationality and ethnicity are not fields in Kontxs; a driving licence’s number, expiry date and endorsements are never recorded.

Annex 2 — Security measures

• Separation between businesses enforced in the database (every link between records carries the business’s identifier) and in the application (every data access is scoped to one business); a request for another business’s record is answered “not found”.
• Access inside your business by preset roles over seven areas; restricted HR data only for users given the HR role, never implicitly; sensitive changes re-check the user’s membership with our sign-in provider at the time.
• Sign-in by Clerk; Kontxs never holds passwords.
• The API accepts only short-lived tokens issued to a signed-in user, limited to that user’s businesses and areas, and is rate-limited. Connected-software credentials, when offered, are per connection, scoped by an admin, revocable, and recorded against every request.
• Encryption in transit (TLS) everywhere, including to the database (certificate verification required); encryption at rest by our providers.
• Audit log of governance actions, restricted views and downloads.
• Hardened downloads: no public or signed links, no caching in the browser, rate-limited per user.
• Uploads checked by file signature, size-capped, image metadata stripped.
• Secrets held only in our hosting provider’s encrypted environment settings; production keys separate from test keys.
• Changes to the software are reviewed and tested before release, and released on a schedule through a gated pipeline; production is not changed by hand.
• Retention and disposal run automatically; a stopped or overdue disposal job raises an alarm.
• Backups and erasure: database restore history is limited; erasures are replayed onto any restored copy.
• People: access to production systems limited to those who need it, bound by confidentiality.

Annex 3 — Sub-processors

The sub-processors we use, what each does, where it stores data, its transfer safeguard and a link to its own sub-processors are published at Sub-processor list. The list in force on the date you accept these terms is the list you authorise under section 8.1; changes follow section 8.2.

Annex 4 — Default retention periods

The defaults in force on 5 October 2026, by category. “Trigger” is the event that starts the clock. Class: legal (the law sets it), conditional (the law sets it if a condition applies to you), recommended (published guidance or limitation periods), our judgement (a proportionate default you may change).

Read the Terms of service.