Privacy notice

Summary

• Kontxs Limited is the controller of Kontxs account data and its own business records.
• Businesses using Kontxs are the controllers of the records they keep in it. Kontxs processes those records on their behalf.
• Kontxs does not sell personal information, show advertising or track users across other companies’ apps or websites.
• The Kontxs phone apps contain no advertising, analytics or tracking software and request no device permissions.
• Requests about personal information: privacy@kontxs.com.

1. Who we are

Kontxs Limited (“Kontxs”, “we”, “us”), a company registered in England and Wales, company number 17018593. Registered office: 167–169 Great Portland Street, London, England, W1W 5PF. ICO registration number: ZC093471.

Contact: privacy@kontxs.com, or by post to the registered office, marked “Privacy”.

2. Scope

This notice applies to personal information we process when you:

• visit kontxs.com;
• apply for early access;
• use the Kontxs web app at app.kontxs.com;
• use the Kontxs app for iPhone or Android (the “phone apps”);
• use the Kontxs application programming interface (the “API”);
• receive email from us; or
• deal with us as a customer, supplier or adviser.

3. Controller and processor

We are the controller of:

• early-access applications and enquiries;
• Kontxs accounts: name, email address, sign-in and security records, and business memberships;
• technical and security records relating to the service;
• our business records, including contracts, invoices and correspondence.

Each business using Kontxs is the controller of the records it keeps in Kontxs about its customers, suppliers and staff. We process those records as its processor, on its documented instructions, under our Data-processing terms at Data-processing terms. We do not use them for our own purposes, except to produce aggregated statistics (section 7). Section 9 applies to people whose information a business keeps in Kontxs.

4. Information we collect

4.1 Information you provide

4.2 Information collected automatically

4.3 Information from third parties

• The business that invites you: email address and, optionally, name and role.
• Google or Apple, if you sign in with them (section 4.1).
• Apple and Google: crash reports and aggregate statistics about the phone apps, under their own terms (section 5).

4.4 Information we do not collect

We do not collect location, contacts, photos, health information, device advertising identifiers or browsing activity on other websites or apps. The only advertising reference we keep is the click reference described in section 4.1, and only when you apply for early access. The phone apps do not request access to location, camera, photo library, contacts, microphone or Bluetooth, and do not send push notifications.

Businesses may not enter special-category or criminal-offence information into Kontxs. Kontxs has no fields for it.

5. Phone apps

The phone apps are for staff of businesses using Kontxs. Accounts cannot be created in the apps.

• Connections. The apps connect only to Kontxs and our sign-in provider.
• On-device storage. The sign-in token is stored in the iOS Keychain or Android Keystore and excluded from device backups. Business records are held in memory only, are not written to the device, and are cleared on sign-out, on switching business and when the app closes. The screen is hidden when the app moves to the background.
• Tracking. The apps contain no advertising, analytics, crash-reporting or tracking software and do not access the device advertising identifier. We do not track users as defined by Apple.
• Links. Links that open records in the apps contain reference numbers only.
• App stores. Apple (App Store, TestFlight) and Google (Google Play) distribute the apps and collect download, device and crash information as independent controllers under their own privacy policies. We do not send them information from Kontxs.
• Lost devices. A business admin can remove a user’s access and their sessions can be ended remotely. Contact help@kontxs.com for assistance.

6. API

The API is used by the phone apps to read and change records in Kontxs.

• Access. The API accepts only short-lived tokens issued to a signed-in user. Each request is limited to the businesses that user belongs to and the areas their role permits.
• Connected software and AI agents (planned). Businesses will be able to connect other software, including AI agents, through the API. When this is available:
  • only a business admin can connect or disconnect them;
  • each connection has its own credential, limited to the business and areas the admin selects and never exceeding the admin’s own access;
  • each request is recorded against the connection and the admin who created it;
  • the business is responsible for the connected software’s use of the data. Its provider acts for the business and is not our sub-processor.
  This notice will be updated before this is available.
• Metering. All requests, from users or connected software, are metered. Usage records contain the business, user or connection, request type, time and count, and no record contents. They are used for usage limits, billing and misuse detection.
• Records. We record the user and business for each request. Rate-limit counters and change receipts are deleted within 24 hours. Our hosting provider retains request logs, including IP addresses, for up to 30 days. Our application logs do not contain names, email addresses or record contents.

7. Purposes and lawful bases

Details of any legitimate-interests assessment are available on request.

We do not make decisions with legal or similarly significant effects by automated means alone.

We do not sell or rent personal information, share it for targeted advertising, buy marketing lists or build advertising profiles. We do not send the advertising click references we record back to advertising platforms. We do not use records businesses keep in Kontxs to train artificial intelligence models used for other businesses.

8. Recipients

• Service providers for hosting, database, sign-in, email and our office systems. They act on our instructions under written data-processing agreements and may not use the information for their own purposes. The current list, with locations and transfer safeguards, is at Sub-processor list and is updated before any provider is added or replaced.
• The business you belong to. Its admins can see your name, email address, role and actions recorded in its account.
• Professional advisers, under a duty of confidentiality.
• A buyer or investor in a sale or reorganisation of our business, under confidentiality terms.
• Public authorities, where required by law or to protect the rights, property or safety of Kontxs, our customers or others.

Partner programmes (planned)

Kontxs will be offered through partner organisations that support groups of small businesses. Partners pay a licence fee to provide Kontxs to businesses in their programme and to view information about how those businesses use Kontxs.

• Before joining, a business is told which partner it is joining and what that partner can see. Participation is a condition of the partner’s plan. The terms for leaving are set out before joining.
• Partners see usage information only. They do not see the contents of a business’s records or any information about its customers, suppliers or staff.
• Partners are bound by an agreement with us that restricts use, prohibits re-identification of those individuals and requires security measures. Partners are responsible for their own use of the information.

This notice will be updated, and affected businesses notified, before partner programmes are available.

Connected services (planned)

Businesses will be able to connect Kontxs to other services, such as accounting software.

• Only a business admin can connect or disconnect a service.
• Only the information required for each connection is exchanged.
• A service connected under the business’s own account acts for the business and is not our sub-processor. A service provided under our account is listed as our sub-processor, with notice before it starts.
• Businesses decide whom they contact through a connected channel. Kontxs records customers’ contact preferences.

This notice will be updated before each type of connection is available.

9. Information a business keeps about you

If you are a customer, supplier or member of staff of a business that uses Kontxs, that business is the controller of the records it keeps about you, such as contact details, transaction records or employment details. Every business using Kontxs accepts our Data-processing terms (Data-processing terms), which set out the following division of responsibility. We impose equivalent data-protection obligations on each of our sub-processors.

Records are stored in London. Please contact the business directly; requests sent to us are passed to the business.

If the business has closed or cannot be contacted, contact privacy@kontxs.com. We deal with the request under our terms with that business, and keep its records only until they are due for deletion (section 11).

Kontxs does not send marketing or operational messages to a business’s customers on its own account. Where a business uses Kontxs to respond to a data protection request, Kontxs helps the business prepare its reply; the business sends it.

10. International transfers

The database, application and stored files are hosted in London. Sign-in and account data is held in the United States by our sign-in provider, and email is sent through a provider in the United States.

Transfers outside the UK are made under:

• the UK Extension to the EU–US Data Privacy Framework, for certified providers; and/or
• the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.

The safeguard for each provider is shown on the Sub-processor list. Copies are available on request.

11. Retention

Information is kept longer only where required by law or for a legal claim.

12. Security

• Each business’s data is logically separated. Every request is checked against the business and the user. Requests for another business’s records return “not found”.
• Access within a business is role-based. Restricted records are visible only to users the business grants access to.
• Sensitive changes re-verify membership with our sign-in provider.
• Data is encrypted in transit and at rest.
• We do not store passwords.
• Software changes are reviewed and tested before release. Production changes go through an automated release process. Emergency changes are logged and reviewed.
• Access to production systems is restricted and subject to confidentiality obligations.

Personal data breaches are reported to the ICO and to affected individuals as required by law. Breaches affecting a business’s records are reported to that business.

13. Your rights

Subject to legal exceptions, you have the right to:

• access your personal information;
• rectification;
• erasure;
• restrict processing;
• object to processing based on legitimate interests, and to direct marketing at any time;
• receive your information in a portable format; and
• withdraw consent at any time, without affecting earlier processing.

Send requests to privacy@kontxs.com. We may need to verify your identity. We respond within one month, extendable by two months for complex requests.

Account deletion. In the web app or phone apps: Account, then Delete my account. Or email privacy@kontxs.com from the address on the account. Deletion removes your account, sign-in data and business memberships. Records a business holds about your actions, such as its audit trail, belong to that business and are kept under its retention settings. A business’s sole admin must transfer the role or close the business first. If a sole admin has died or cannot act, contact help@kontxs.com.

Unsubscribing. Use the link in any update email, or email us.

Complaints. help@kontxs.com. You may also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.

14. Cookies and similar technologies

• kontxs.com: no cookies. Visit counting, performance measurement and abuse detection (section 4.2) store nothing on your device. Campaign tags and click references (section 4.1) are read from the page’s address, not from your device.
• app.kontxs.com: strictly necessary sign-in cookies set by our sign-in provider.
• Phone apps: sign-in token in secure device storage (section 5).

We do not use advertising, cross-site tracking or social media cookies. Non-essential cookies or similar technologies will not be used without this notice being updated and consent obtained where required.

15. Children

Kontxs accounts are for people aged 16 or over who use Kontxs for work. Records a business keeps about younger people are covered by section 9. If you believe a child under 16 has a Kontxs account, contact help@kontxs.com and we will close it.

16. Changes

We update this notice before processing personal information in a new or materially different way. Material changes are notified by email or in Kontxs before they take effect.

17. Related documents

• Sub-processor list
• Terms of service