Privacy Notice

This notice explains how Axion London Limited, trading as Kontala, handles personal data through the kontala.com website and Kontala Marketing OS. Kontala Accounting is covered by its own Privacy Notice.

Who we are

Kontala is a trading name of Axion London Limited, a company registered in England and Wales (company no. 17153114), with its registered office at 124 City Road, London, EC1V 2NX. We are an independent company and not part of any group. We are registered with the Information Commissioner's Office (ICO) under number ZC194068.

If you have a question about this notice or your data, email privacy@kontala.com.

Our two roles

We handle personal data in two different roles, and the role decides who you should talk to.

• As a controller, we decide how and why personal data is used for our own website, our conversations with people who contact us, and the accounts of people who use Marketing OS. This notice describes that.
• As a processor, we capture and analyse visitor data for businesses that use Marketing OS on their own websites and online stores. For that data the business is the controller, and we act only on its instructions, under our Data Processing Agreement. The business's own privacy notice explains how it uses your data, and visitors to our customers' websites below explains our part.

Visitors to kontala.com

Analytics, if you accept it

We measure kontala.com with our own product, Kontala Data Capture. When you first visit, we ask whether you accept analytics cookies.

If you accept, the tag sets two cookies and, depending on the features we have turned on, records:

• the pages you view, the page that sent you here and the campaign that brought you;
• the links and buttons you click, how far you scroll, how fast pages load, and signs of trouble such as errors and repeated clicks;
• your browser, type of device, screen size, language and time zone; and
• your approximate location (country, region and city) and network, worked out from your IP address.

We never record what you type into our forms. The tag counts that a form was sent, but not what it said.

If you reject analytics cookies, or do not answer, the tag sets no cookies and records only that a page was viewed: when, which page, and the country the visit came from. Our analytics then keep nothing that identifies you or your device.

You can change your answer at any time with Cookie settings at the foot of every page. Our Cookie Policy lists every cookie we use.

Contacting us or booking a demo

When you send us a message or ask for a demo, we receive what you enter in the form: your name, work email address, company, country, the topic and your message, and whether you would like to hear our news. The form sends these details to our team by email, and we use them to reply, arrange your demo and follow up on your enquiry.

If you ask to hear our news, we may email you about Kontala. Every such email has a link to unsubscribe.

Server logs

Like any website, our servers record each request they receive, including the IP address it came from, the page requested and the browser that asked. We use these logs to keep the site secure and to fix faults.

People who use Marketing OS

When your organisation gives you a Marketing OS account, we hold:

• your name, work email address, organisation and role;
• your password, stored only as a one-way hash;
• if you turn on two-step verification, its secret, stored encrypted, and your recovery codes, stored as hashes;
• when you sign in, and the IP address and browser of each sign-in and of any device you choose to trust;
• a record of the changes made in your organisation, such as who invited whom, changed a setting or created a key; and
• the emails we send you, such as invitations and password resets.

When you open Kontala Analytics, it receives your name, email address and role from your Marketing OS account, and keeps the charts and dashboards you save and the history of the queries you run.

We use this information to provide your account, keep it secure, support you, and keep a record of who did what in your organisation. We run no analytics or advertising tags inside the app.

Kontala Analytics loads its typeface from Google Fonts, so when you use it your browser connects to Google, which receives your IP address.

Visitors to our customers' websites

If you visit a website or online store that uses Kontala, the business that runs it decides what Kontala captures there, and it is the controller of that data.

Depending on what the business turns on, Kontala may capture:

• the pages you view and how you arrived, including each page's full address and the page that referred you;
• the links, buttons and fields you click, how far you scroll, how fast pages load, and errors;
• what you submit in the site's forms and searches, except passwords, card security codes, one-time codes and PINs;
• an id the site gives you when you sign in, which can be your email address, and the username or email address you type into its sign-in form;
• information the site already passes to other analytics tools through its data layer; and
• in a Shopify store's checkout, your cart and order, and the name, email address, phone number and billing and delivery addresses you enter.

Kontala sets two first-party cookies on that website, described in our Cookie Policy. It never fingerprints your browser.

Your IP address is used to work out an approximate location and to check for bots. The analytics keep only a shortened version of the address and a code derived from it that changes every day. Our servers' request logs, which we keep for 30 days for security and troubleshooting, record the full address.

Each business decides whether to ask for your consent before measuring you, and its site tells Kontala your answer. If the site says you have not consented, Kontala sets no cookies and keeps only a count of the page view, with no identifiers, page address, IP address or location below country level. Kontala records the Global Privacy Control and Do Not Track signals your browser sends, but does not act on them itself: each business decides whether to honour them.

To exercise your rights over this data, contact the business that runs the website. If you contact us instead, we will pass your request on to that business and help it to respond. We can only find data through the identifiers stored with it, such as the value of your pt_did cookie, or the id or email address the site gave Kontala.

We also use this data for two purposes of our own:

• Keeping the service secure and working, including detecting bots and misuse.
• Training shared classification models. Kontala recognises types of pages, clicks and data layer fields with models trained on how our customers' pages, clicks and data layers are structured and labelled. The models keep aggregated statistics, not records of individual visits, and copies of data made for training are deleted within 180 days. Each business can stop its data from being used for training.

We never sell this data, use it for advertising, or share one business's visitor data with another.

Why we use your data

The law requires us to have a legal basis for each use of your personal data.

Where we rely on legitimate interests, we have weighed them against your rights and concluded that they are not overridden. You can ask us for that assessment.

Who we share your data with

We do not sell personal data. We share it only with the people below.

Service providers

These providers run parts of Kontala for us, and may use the data only on our instructions.

The providers that process our customers' data for them are listed on our Sub-processors page.

Others

• Professional advisers, such as lawyers and accountants, where they need it to advise us.
• Authorities, such as regulators, courts and the police, where the law requires us to.
• A buyer or successor, if we sell or reorganise all or part of our business, under a duty of confidentiality.

Sending data outside the UK

We store and process kontala.com and Marketing OS data in the European Union, which UK law recognises as giving personal data adequate protection. Proton AG is in Switzerland, which UK law also recognises as adequate. Mailgun is a US company that holds our data in its EU region; where its staff in other countries can reach that data, we rely on safeguards that UK law recognises, such as the International Data Transfer Addendum to the EU standard contractual clauses.

You can ask us for details of these safeguards.

How long we keep it

At the end of these periods we delete the data, or anonymise it so that it can no longer identify you.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you, and receive a copy;
• rectification, to have inaccurate data corrected and incomplete data completed;
• erasure, to have your data deleted in some circumstances;
• restrict how we use your data in some circumstances;
• data portability, to receive data you gave us in a structured, machine-readable format;
• object to our use of your data where we rely on legitimate interests, and to direct marketing at any time; and
• withdraw consent at any time where we rely on it, without affecting what we did before you withdrew it.

To use any of these rights, email privacy@kontala.com. We will reply within one month, or tell you within that month if we need up to two more months for a complex request. It is normally free.

For data we process for one of our customers, see visitors to our customers' websites.

Automated decisions

We make no decisions about you based solely on automated processing that have legal or similarly significant effects on you. Kontala's models classify pages, clicks and data layer fields; they do not make decisions about people.

How we protect your data

We protect personal data with technical and organisational measures that include encryption over public networks, encryption at rest, one-way hashing of passwords, optional two-step verification, role-based access, keeping each organisation's data separate, and an audit log of changes. Our Data Processing Agreement describes them in detail.

No system is perfectly secure, but if a breach puts your rights at high risk, we will tell you without undue delay.

Children

kontala.com and Marketing OS are for businesses and are not aimed at children. We do not knowingly collect personal data from children.

Changes to this notice

We will update this notice when how we handle personal data changes, and change the date at the top. If a change affects you significantly, we will tell you directly where we can, for example by email if you have a Marketing OS account.

Contact us or complain

Email privacy@kontala.com, or write to the Privacy Team, Axion London Limited, 124 City Road, London, EC1V 2NX.

If you are unhappy with how we have handled your data, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.