Kinetix Design Ltd. — Privacy & Data Protection Notice
At Kinetix Design Ltd. (“Kinetix”, “we”, “us”, or “our”), we build privacy and AI compliance software for small and medium businesses. We practice what we preach: this notice explains in plain English what personal data we collect when you use Kinetix/Compliance (https://kinetixcompliance.uk), why we collect it, how we protect it, and your statutory rights.
1. What Data We Collect & When
You can explore the Kinetix/Compliance platform and run a preliminary gap check in your browser without creating an account. We only collect personal data in our secure database when you explicitly choose to save your workspace, opt in to communications, or purchase a tool/subscription:
- Business Contact Information: Your work email address, company name, website domain, and primary operating region when you save your assessment or proceed to checkout.
- Compliance Workspace Configuration: Your selected software/AI suppliers, risk assessment selections, and readiness score so you can reload your compliance documents across devices.
- Billing & Subscription Records: Purchased plan identifiers, subscription status, and Stripe transaction references. We never see or store your raw credit/debit card numbers—all payment credentials are handled directly by Stripe (PCI-DSS Level 1).
- Marketing Consent Audit Log: Whether you opted in or out of marketing emails, the timestamp, the form source, and the exact consent wording shown to you (to comply with UK GDPR Article 7(1) accountability).
2. Our Lawful Bases Under UK GDPR & EU GDPR (Article 6)
| Processing Purpose | Data Categories | Lawful Basis (UK/EU GDPR) |
|---|---|---|
| Saving & restoring your compliance workspace, delivering purchased Compliance Packs, DPIAs, and subscriptions | Work email, company profile, selected suppliers, entitlement status | Contractual Necessity — Art. 6(1)(b) |
| Sending optional SMB privacy & AI regulatory updates, templates, and product news | Work email, company name, consent log record | Explicit Consent — Art. 6(1)(a) & PECR |
| Invoicing, VAT/tax accounting, and fraud prevention | Billing email, company name, Stripe payment/invoice IDs | Legal Obligation — Art. 6(1)(c) |
| Cookieless aggregate web analytics & platform security | Anonymised page-view metrics via Vercel Web Analytics (no tracking cookies) | Legitimate Interests — Art. 6(1)(f) |
3. Zero AI Training & Client-Side Contract Confidentiality
We never train AI models on your data. Furthermore, when you paste vendor or customer contract text into Module 04 (Contract Redline Checker), that contract text is evaluated locally inside your browser and is not stored in our database.
4. Our Authorized Subprocessors
We use a minimal, high-security infrastructure stack bound by GDPR Article 28 Data Processing Agreements (DPAs) and UK/EU transfer safeguards:
| Subprocessor | Purpose | Security & Transfer Safeguard |
|---|---|---|
| Vercel Inc. | Application hosting, TLS encryption, and cookieless web analytics | SOC 2 Type II, ISO 27001 · EU-US DPF & UK Extension / SCCs |
| Neon, Inc. (Serverless Postgres) | Encrypted PostgreSQL database storing saved workspaces, entitlements & consent logs | SOC 2 Type II, ISO 27001, AES-256 at rest · GDPR DPA & SCCs |
| Stripe Payments UK Ltd. | Checkout, subscription billing, and payment processing | PCI-DSS Level 1, SOC 1/2, ISO 27001 · UK & EU BCRs / SCCs |
5. Marketing Permissions & How to Withdraw Consent
We never pre-tick marketing boxes. We only send regulatory briefings or product updates if you explicitly tick our marketing consent checkbox. You can withdraw your marketing consent at any time by:
- Clicking the Unsubscribe link in any marketing email we send;
- Unchecking the marketing permission box in the Save / Cloud Sync panel on Kinetix/Compliance and clicking Save (which immediately updates your preference and logs the withdrawal in our database); or
- Emailing consult@kinetixdesign.uk.
6. Data Retention & Your Data Subject Rights
Saved compliance workspaces are retained while your account or subscription is active, or until you request deletion. Financial transaction records are retained for 7 years to satisfy UK HMRC statutory accounting requirements.
Under the UK GDPR and EU GDPR (Articles 15–22), you have the right to:
- Access a copy of the personal data we hold about you;
- Rectify inaccurate company or contact details;
- Erase (“Right to be Forgotten”) your saved compliance profile from our database;
- Export your data in a portable, machine-readable format (JSON/Markdown); and
- Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EU Data Protection Authority.