[{"data":1,"prerenderedAt":688},["ShallowReactive",2],{"legal:\u002Flegal\u002Fprivacy":3},{"id":4,"title":5,"body":6,"description":675,"extension":676,"lastUpdated":677,"meta":678,"navigation":679,"order":680,"path":681,"seo":682,"sitemap":683,"stem":685,"summary":686,"__hash__":687},"legal\u002Flegal\u002Fprivacy.md","Privacy Notice",{"type":7,"value":8,"toc":648},"minimark",[9,18,23,26,33,37,40,67,71,76,79,82,96,99,102,114,118,121,124,128,131,135,138,158,161,164,167,171,174,177,197,203,206,209,220,223,237,240,244,247,330,333,337,340,344,347,397,405,409,429,433,436,439,443,528,531,535,538,582,588,593,597,600,604,611,614,618,621,625,628,632,638],[10,11,12,13,17],"p",{},"This notice explains how Axion London Limited, trading as Kontala, handles personal data through the kontala.com website and Kontala Marketing OS.\nKontala Accounting is covered by its own ",[14,15,5],"a",{"href":16},"\u002Faccounting\u002Fprivacy",".",[19,20,22],"h2",{"id":21},"who-we-are","Who we are",[10,24,25],{},"Kontala is a trading name of Axion London Limited, a company registered in England and Wales (company no. 17153114), with its registered office at 124 City Road, London, EC1V 2NX.\nWe are an independent company and not part of any group.\nWe are registered with the Information Commissioner's Office (ICO) under number ZC194068.",[10,27,28,29,17],{},"If you have a question about this notice or your data, email ",[14,30,32],{"href":31},"mailto:privacy@kontala.com","privacy@kontala.com",[19,34,36],{"id":35},"our-two-roles","Our two roles",[10,38,39],{},"We handle personal data in two different roles, and the role decides who you should talk to.",[41,42,43,51],"ul",{},[44,45,46,50],"li",{},[47,48,49],"strong",{},"As a controller",", we decide how and why personal data is used for our own website, our conversations with people who contact us, and the accounts of people who use Marketing OS.\nThis notice describes that.",[44,52,53,56,57,61,62,66],{},[47,54,55],{},"As a processor",", we capture and analyse visitor data for businesses that use Marketing OS on their own websites and online stores.\nFor that data the business is the controller, and we act only on its instructions, under our ",[14,58,60],{"href":59},"\u002Flegal\u002Fdpa","Data Processing Agreement",".\nThe business's own privacy notice explains how it uses your data, and ",[14,63,65],{"href":64},"#visitors-to-our-customers-websites","visitors to our customers' websites"," below explains our part.",[19,68,70],{"id":69},"visitors-to-kontalacom","Visitors to kontala.com",[72,73,75],"h3",{"id":74},"analytics-if-you-accept-it","Analytics, if you accept it",[10,77,78],{},"We measure kontala.com with our own product, Kontala Data Capture.\nWhen you first visit, we ask whether you accept analytics cookies.",[10,80,81],{},"If you accept, the tag sets two cookies and, depending on the features we have turned on, records:",[41,83,84,87,90,93],{},[44,85,86],{},"the pages you view, the page that sent you here and the campaign that brought you;",[44,88,89],{},"the links and buttons you click, how far you scroll, how fast pages load, and signs of trouble such as errors and repeated clicks;",[44,91,92],{},"your browser, type of device, screen size, language and time zone; and",[44,94,95],{},"your approximate location (country, region and city) and network, worked out from your IP address.",[10,97,98],{},"We never record what you type into our forms.\nThe tag counts that a form was sent, but not what it said.",[10,100,101],{},"If you reject analytics cookies, or do not answer, the tag sets no cookies and records only that a page was viewed: when, which page, and the country the visit came from.\nOur analytics then keep nothing that identifies you or your device.",[10,103,104,105,108,109,113],{},"You can change your answer at any time with ",[47,106,107],{},"Cookie settings"," at the foot of every page.\nOur ",[14,110,112],{"href":111},"\u002Flegal\u002Fcookies","Cookie Policy"," lists every cookie we use.",[72,115,117],{"id":116},"contacting-us-or-booking-a-demo","Contacting us or booking a demo",[10,119,120],{},"When you send us a message or ask for a demo, we receive what you enter in the form: your name, work email address, company, country, the topic and your message, and whether you would like to hear our news.\nThe form sends these details to our team by email, and we use them to reply, arrange your demo and follow up on your enquiry.",[10,122,123],{},"If you ask to hear our news, we may email you about Kontala.\nEvery such email has a link to unsubscribe.",[72,125,127],{"id":126},"server-logs","Server logs",[10,129,130],{},"Like any website, our servers record each request they receive, including the IP address it came from, the page requested and the browser that asked.\nWe use these logs to keep the site secure and to fix faults.",[19,132,134],{"id":133},"people-who-use-marketing-os","People who use Marketing OS",[10,136,137],{},"When your organisation gives you a Marketing OS account, we hold:",[41,139,140,143,146,149,152,155],{},[44,141,142],{},"your name, work email address, organisation and role;",[44,144,145],{},"your password, stored only as a one-way hash;",[44,147,148],{},"if you turn on two-step verification, its secret, stored encrypted, and your recovery codes, stored as hashes;",[44,150,151],{},"when you sign in, and the IP address and browser of each sign-in and of any device you choose to trust;",[44,153,154],{},"a record of the changes made in your organisation, such as who invited whom, changed a setting or created a key; and",[44,156,157],{},"the emails we send you, such as invitations and password resets.",[10,159,160],{},"When you open Kontala Analytics, it receives your name, email address and role from your Marketing OS account, and keeps the charts and dashboards you save and the history of the queries you run.",[10,162,163],{},"We use this information to provide your account, keep it secure, support you, and keep a record of who did what in your organisation.\nWe run no analytics or advertising tags inside the app.",[10,165,166],{},"Kontala Analytics loads its typeface from Google Fonts, so when you use it your browser connects to Google, which receives your IP address.",[19,168,170],{"id":169},"visitors-to-our-customers-websites","Visitors to our customers' websites",[10,172,173],{},"If you visit a website or online store that uses Kontala, the business that runs it decides what Kontala captures there, and it is the controller of that data.",[10,175,176],{},"Depending on what the business turns on, Kontala may capture:",[41,178,179,182,185,188,191,194],{},[44,180,181],{},"the pages you view and how you arrived, including each page's full address and the page that referred you;",[44,183,184],{},"the links, buttons and fields you click, how far you scroll, how fast pages load, and errors;",[44,186,187],{},"what you submit in the site's forms and searches, except passwords, card security codes, one-time codes and PINs;",[44,189,190],{},"an id the site gives you when you sign in, which can be your email address, and the username or email address you type into its sign-in form;",[44,192,193],{},"information the site already passes to other analytics tools through its data layer; and",[44,195,196],{},"in a Shopify store's checkout, your cart and order, and the name, email address, phone number and billing and delivery addresses you enter.",[10,198,199,200,202],{},"Kontala sets two first-party cookies on that website, described in our ",[14,201,112],{"href":111},".\nIt never fingerprints your browser.",[10,204,205],{},"Your IP address is used to work out an approximate location and to check for bots.\nThe analytics keep only a shortened version of the address and a code derived from it that changes every day.\nOur servers' request logs, which we keep for 30 days for security and troubleshooting, record the full address.",[10,207,208],{},"Each business decides whether to ask for your consent before measuring you, and its site tells Kontala your answer.\nIf the site says you have not consented, Kontala sets no cookies and keeps only a count of the page view, with no identifiers, page address, IP address or location below country level.\nKontala records the Global Privacy Control and Do Not Track signals your browser sends, but does not act on them itself: each business decides whether to honour them.",[10,210,211,214,215,219],{},[47,212,213],{},"To exercise your rights over this data, contact the business that runs the website.","\nIf you contact us instead, we will pass your request on to that business and help it to respond.\nWe can only find data through the identifiers stored with it, such as the value of your ",[216,217,218],"code",{},"pt_did"," cookie, or the id or email address the site gave Kontala.",[10,221,222],{},"We also use this data for two purposes of our own:",[41,224,225,231],{},[44,226,227,230],{},[47,228,229],{},"Keeping the service secure and working",", including detecting bots and misuse.",[44,232,233,236],{},[47,234,235],{},"Training shared classification models."," Kontala recognises types of pages, clicks and data layer fields with models trained on how our customers' pages, clicks and data layers are structured and labelled.\nThe models keep aggregated statistics, not records of individual visits, and copies of data made for training are deleted within 180 days.\nEach business can stop its data from being used for training.",[10,238,239],{},"We never sell this data, use it for advertising, or share one business's visitor data with another.",[19,241,243],{"id":242},"why-we-use-your-data","Why we use your data",[10,245,246],{},"The law requires us to have a legal basis for each use of your personal data.",[248,249,250,263],"table",{},[251,252,253],"thead",{},[254,255,256,260],"tr",{},[257,258,259],"th",{},"What we do",[257,261,262],{},"Our legal basis",[264,265,266,275,283,291,298,306,314,322],"tbody",{},[254,267,268,272],{},[269,270,271],"td",{},"Analytics cookies, and analytics that can identify your device, on kontala.com",[269,273,274],{},"Consent",[254,276,277,280],{},[269,278,279],{},"Counting page views on kontala.com without cookies or identifiers, when you have not consented",[269,281,282],{},"Legitimate interests: knowing how many people visit our website",[254,284,285,288],{},[269,286,287],{},"Replying to messages and arranging demos",[269,289,290],{},"Legitimate interests, or taking steps at your request before entering into a contract",[254,292,293,296],{},[269,294,295],{},"Emailing you news you asked for",[269,297,274],{},[254,299,300,303],{},[269,301,302],{},"Providing Marketing OS accounts, sign-in, support and service emails",[269,304,305],{},"Our contract with your organisation, and our legitimate interest in providing the service it has bought for you",[254,307,308,311],{},[269,309,310],{},"Security: sign-in records, the organisation audit log, server logs and bot detection",[269,312,313],{},"Legitimate interests: keeping Kontala, our customers and their visitors secure",[254,315,316,319],{},[269,317,318],{},"Training shared classification models",[269,320,321],{},"Legitimate interests: classifying pages, clicks and data layers accurately for every customer",[254,323,324,327],{},[269,325,326],{},"Keeping records and responding to lawful requests from authorities",[269,328,329],{},"Legal obligation",[10,331,332],{},"Where we rely on legitimate interests, we have weighed them against your rights and concluded that they are not overridden.\nYou can ask us for that assessment.",[19,334,336],{"id":335},"who-we-share-your-data-with","Who we share your data with",[10,338,339],{},"We do not sell personal data.\nWe share it only with the people below.",[72,341,343],{"id":342},"service-providers","Service providers",[10,345,346],{},"These providers run parts of Kontala for us, and may use the data only on our instructions.",[248,348,349,362],{},[251,350,351],{},[254,352,353,356,359],{},[257,354,355],{},"Provider",[257,357,358],{},"What it does for us",[257,360,361],{},"Where the data is held",[264,363,364,375,386],{},[254,365,366,369,372],{},[269,367,368],{},"Google Cloud",[269,370,371],{},"Hosts kontala.com and Marketing OS, and stores and analyses their data",[269,373,374],{},"European Union (Belgium, and Google's EU multi-region)",[254,376,377,380,383],{},[269,378,379],{},"Proton AG",[269,381,382],{},"Sends Marketing OS account emails, such as invitations and password resets",[269,384,385],{},"Switzerland",[254,387,388,391,394],{},[269,389,390],{},"Mailgun Technologies, Inc.",[269,392,393],{},"Delivers the messages sent through our website forms to our team",[269,395,396],{},"European Union",[10,398,399,400,404],{},"The providers that process our customers' data for them are listed on our ",[14,401,403],{"href":402},"\u002Flegal\u002Fsub-processors","Sub-processors"," page.",[72,406,408],{"id":407},"others","Others",[41,410,411,417,423],{},[44,412,413,416],{},[47,414,415],{},"Professional advisers",", such as lawyers and accountants, where they need it to advise us.",[44,418,419,422],{},[47,420,421],{},"Authorities",", such as regulators, courts and the police, where the law requires us to.",[44,424,425,428],{},[47,426,427],{},"A buyer or successor",", if we sell or reorganise all or part of our business, under a duty of confidentiality.",[19,430,432],{"id":431},"sending-data-outside-the-uk","Sending data outside the UK",[10,434,435],{},"We store and process kontala.com and Marketing OS data in the European Union, which UK law recognises as giving personal data adequate protection.\nProton AG is in Switzerland, which UK law also recognises as adequate.\nMailgun is a US company that holds our data in its EU region; where its staff in other countries can reach that data, we rely on safeguards that UK law recognises, such as the International Data Transfer Addendum to the EU standard contractual clauses.",[10,437,438],{},"You can ask us for details of these safeguards.",[19,440,442],{"id":441},"how-long-we-keep-it","How long we keep it",[248,444,445,454],{},[251,446,447],{},[254,448,449,452],{},[257,450,451],{},"Data",[257,453,442],{},[264,455,456,464,472,480,488,496,504,512,520],{},[254,457,458,461],{},[269,459,460],{},"Analytics events from kontala.com",[269,462,463],{},"400 days",[254,465,466,469],{},[269,467,468],{},"Your cookie choice",[269,470,471],{},"12 months, after which we ask again",[254,473,474,477],{},[269,475,476],{},"Messages and demo requests",[269,478,479],{},"Up to 2 years after our last contact with you, unless you become a customer",[254,481,482,485],{},[269,483,484],{},"Server logs, including IP addresses",[269,486,487],{},"30 days",[254,489,490,493],{},[269,491,492],{},"Marketing OS account details",[269,494,495],{},"While your account exists, and up to 12 months after your organisation's account closes",[254,497,498,501],{},[269,499,500],{},"Sign-in sessions",[269,502,503],{},"Deleted one day after they expire",[254,505,506,509],{},[269,507,508],{},"Your organisation's audit log",[269,510,511],{},"Up to 6 years after your organisation's account closes, in case of security investigations or legal claims",[254,513,514,517],{},[269,515,516],{},"Kontala Analytics query results and downloads",[269,518,519],{},"7 days",[254,521,522,525],{},[269,523,524],{},"Visitor data we process for our customers",[269,526,527],{},"As each customer instructs us, by default 400 days, with training copies deleted within 180 days",[10,529,530],{},"At the end of these periods we delete the data, or anonymise it so that it can no longer identify you.",[19,532,534],{"id":533},"your-rights","Your rights",[10,536,537],{},"Under UK data protection law you have the right to:",[41,539,540,546,552,558,564,570,576],{},[44,541,542,545],{},[47,543,544],{},"access"," the personal data we hold about you, and receive a copy;",[44,547,548,551],{},[47,549,550],{},"rectification",", to have inaccurate data corrected and incomplete data completed;",[44,553,554,557],{},[47,555,556],{},"erasure",", to have your data deleted in some circumstances;",[44,559,560,563],{},[47,561,562],{},"restrict"," how we use your data in some circumstances;",[44,565,566,569],{},[47,567,568],{},"data portability",", to receive data you gave us in a structured, machine-readable format;",[44,571,572,575],{},[47,573,574],{},"object"," to our use of your data where we rely on legitimate interests, and to direct marketing at any time; and",[44,577,578,581],{},[47,579,580],{},"withdraw consent"," at any time where we rely on it, without affecting what we did before you withdrew it.",[10,583,584,585,587],{},"To use any of these rights, email ",[14,586,32],{"href":31},".\nWe will reply within one month, or tell you within that month if we need up to two more months for a complex request.\nIt is normally free.",[10,589,590,591,17],{},"For data we process for one of our customers, see ",[14,592,65],{"href":64},[19,594,596],{"id":595},"automated-decisions","Automated decisions",[10,598,599],{},"We make no decisions about you based solely on automated processing that have legal or similarly significant effects on you.\nKontala's models classify pages, clicks and data layer fields; they do not make decisions about people.",[19,601,603],{"id":602},"how-we-protect-your-data","How we protect your data",[10,605,606,607,610],{},"We protect personal data with technical and organisational measures that include encryption over public networks, encryption at rest, one-way hashing of passwords, optional two-step verification, role-based access, keeping each organisation's data separate, and an audit log of changes.\nOur ",[14,608,60],{"href":609},"\u002Flegal\u002Fdpa#annex-2-security-measures"," describes them in detail.",[10,612,613],{},"No system is perfectly secure, but if a breach puts your rights at high risk, we will tell you without undue delay.",[19,615,617],{"id":616},"children","Children",[10,619,620],{},"kontala.com and Marketing OS are for businesses and are not aimed at children.\nWe do not knowingly collect personal data from children.",[19,622,624],{"id":623},"changes-to-this-notice","Changes to this notice",[10,626,627],{},"We will update this notice when how we handle personal data changes, and change the date at the top.\nIf a change affects you significantly, we will tell you directly where we can, for example by email if you have a Marketing OS account.",[19,629,631],{"id":630},"contact-us-or-complain","Contact us or complain",[10,633,634,635,637],{},"Email ",[14,636,32],{"href":31},", or write to the Privacy Team, Axion London Limited, 124 City Road, London, EC1V 2NX.",[10,639,640,641,647],{},"If you are unhappy with how we have handled your data, please tell us first so that we can try to put it right.\nYou also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ",[14,642,646],{"href":643,"rel":644},"https:\u002F\u002Fico.org.uk",[645],"nofollow","ico.org.uk"," or on 0303 123 1113.",{"title":649,"searchDepth":650,"depth":650,"links":651},"",2,[652,653,654,660,661,662,663,667,668,669,670,671,672,673,674],{"id":21,"depth":650,"text":22},{"id":35,"depth":650,"text":36},{"id":69,"depth":650,"text":70,"children":655},[656,658,659],{"id":74,"depth":657,"text":75},3,{"id":116,"depth":657,"text":117},{"id":126,"depth":657,"text":127},{"id":133,"depth":650,"text":134},{"id":169,"depth":650,"text":170},{"id":242,"depth":650,"text":243},{"id":335,"depth":650,"text":336,"children":664},[665,666],{"id":342,"depth":657,"text":343},{"id":407,"depth":657,"text":408},{"id":431,"depth":650,"text":432},{"id":441,"depth":650,"text":442},{"id":533,"depth":650,"text":534},{"id":595,"depth":650,"text":596},{"id":602,"depth":650,"text":603},{"id":616,"depth":650,"text":617},{"id":623,"depth":650,"text":624},{"id":630,"depth":650,"text":631},"How Kontala collects and uses personal data through kontala.com and Kontala Marketing OS, who we share it with, and the rights you have over it.","md","12 October 2026",{},true,1,"\u002Flegal\u002Fprivacy",{"title":5,"description":675},{"loc":681,"lastmod":684},"2026-10-12","legal\u002Fprivacy","What we collect on kontala.com and in Marketing OS, why we collect it, who we share it with, and your rights.","WEFlAxbT1ZGRdSfqaDRhwn5pdgNonxpqoTVCYwMi62Q",1791834422609]