Kynecto Ltd builds and runs software for other organisations. This notice covers the personal information we hold in our own right: about people who visit this website, who get in touch, and who hold an account we issue. Most of the personal data that passes through our systems is not ours, and the second section explains where that line falls.
Who we are
Kynecto Ltd is registered in England and Wales, company number 15393531, with its registered office at 3rd Floor, 86-90 Paul Street, London EC2A 4NE. We are registered with the Information Commissioner’s Office.
For everything in this notice, we are the data controller. Reach us at support@kynecto.com or on 020 3576 5349.
When we are the controller, and when we are not
We are the controller for information about people who visit this site, contact us, do business with us, or hold an account we issue directly. That means we decide what is collected and why.
We are a processor for the personal data inside applications we build and run for client organisations. The client decides what goes in and why. We act on their written instructions, under a contract with them.
So if you are a patient, customer, student or member of staff of one of our clients, their privacy notice governs your data, not this one. Ask us and we will tell you who the controller is.
What we collect
When you visit this website. Our host keeps ordinary server logs: IP address, browser and device type, which pages were requested and when. This site sets no cookies, runs no analytics, and carries no advertising or tracking pixels. Typefaces are served by Google Fonts, so your browser’s request for them reaches Google along with your IP address.
When you contact us. Email to sales@kynecto.com or support@kynecto.com arrives in a mailbox we control. We keep what you send: your name, address, employer and the content of the exchange.
When you use an application we run. Where we issue your account directly, we hold your name, work email, the organisation you belong to, your role and permissions, and a record of significant actions such as sign-ins. Anything beyond that belongs to the client organisation, and we hold it as their processor.
What we do not do. We do not buy personal data from brokers or list vendors, and we do not sell or rent yours. We make no decisions about you by automated means that have legal or similarly significant effects. For our own purposes we do not seek out special category data such as health, ethnicity or beliefs, though applications we run for clients may hold it under their instructions.
Why we use it, and our lawful basis
- Answering an enquiry and running the sales conversation. Our legitimate interest in responding to people who approach us.
- Providing, administering and supporting our platform and the applications on it. Performance of a contract with you or your organisation, or our legitimate interest in running the service.
- Keeping the service secure, including logging, access control and abuse prevention. Our legitimate interest in protecting our systems and our clients’ data.
- Improving what we build. Our legitimate interest, working from aggregated or de-identified information wherever that will do.
- Sending occasional updates about our work. Your consent, which you can withdraw at any time.
- Invoicing, accounts, tax and record keeping. Our legal obligations.
- Establishing, exercising or defending legal claims. Our legitimate interest, or a legal obligation where a court or regulator requires it.
Where we rely on legitimate interests, we have weighed them against your rights. Ask and we will share that assessment.
Cookies
This website sets no cookies, so there is no banner to dismiss and nothing to consent to.
Applications on our platform set cookies that are strictly necessary to sign you in and keep you signed in. They do not follow you between sites. If we ever add anything non-essential, we will ask first and say so here.
Who we share it with
- Microsoft Azure, which hosts our platform and our clients’ applications in UK data centres.
- Our email, productivity and business systems, held by contract to acting on our instructions.
- Professional advisers such as accountants, lawyers, auditors and insurers, where they need it.
- Regulators, law enforcement and courts, where the law requires it or we need to defend a claim.
- A buyer or investor, if the business or part of it is sold or restructured. Any buyer inherits the commitments in this notice.
Every supplier that handles personal data on our behalf works under a written contract that limits them to our instructions and holds them to appropriate security. We do not share your information for advertising, and we do not sell it.
Where it is held
In the UK. Our platform, our clients’ applications and their backups run in Microsoft Azure’s UK regions.
A small number of our own business tools are run by suppliers outside the UK. Where personal data reaches them, the transfer is covered either by UK adequacy regulations or by the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment behind it.
How long we keep it
Only as long as there is a reason to.
- Enquiries that do not become business: 24 months from the last contact.
- Customer and supplier records: for the life of the relationship and six years after it ends, which is the limitation period and what tax law expects.
- Accounts on our platform: while the account is active, then deleted on the schedule the client’s contract sets.
- Server and security logs: 90 days, longer only where something is under investigation.
- Marketing consent: until you withdraw it. We then keep a record that you opted out, so that we do not contact you again.
Where personal data sits in a backup, it goes when that backup rotates out rather than the moment it leaves the live system.
How we keep it safe
We are Cyber Essentials certified and our platform is penetration tested by a CREST accredited firm. Access is role based and granted on least privilege, administrative accounts require multi-factor authentication, and data is encrypted in transit and at rest. We log access and review it, and we have a process for handling a breach, including notifying the ICO within 72 hours and telling you where the law requires it.
No system is perfectly secure, and we do not claim otherwise.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal information we hold about you
- correct it if it is wrong, or complete it if it is partial
- delete it, where we have no continuing reason to hold it
- pause what we are doing with it while a question about it is settled
- send it to you, or to someone else, in a portable format
- stop processing it where we rely on legitimate interests, and stop using it for marketing outright
- withdraw your consent, where consent is what we relied on, which does not undo what we did beforehand
Email support@kynecto.com. It is free, and we reply within one month. We may ask you to confirm who you are first. If your request concerns data we hold as a processor for a client, we will tell you who the controller is and pass the request on.
If you are unhappy with how we have handled it, tell us and we will look again. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
This website and our own sales activity are not aimed at children, and we do not knowingly collect information about them for our own purposes.
Applications we build for clients may hold information about children where the client’s service requires it, in healthcare or education for example. There we act on the client’s instructions, and the client is responsible as controller.
NHS login and NHS Care Identity
Where an application signs you in with NHS login or with your NHS Care Identity credentials, NHS England runs that identity check. NHS England is the controller for the information you gave them to set up and verify the account, and uses it only for that. For that identity data our role is processor only, and we act on NHS England’s instructions.
NHS login’s own terms and privacy notice are at access.login.nhs.uk/terms-and-conditions, and NHS Care Identity Service 2 is documented at digital.nhs.uk/services/care-identity-service.
None of this affects information you give us separately, which this notice covers.
Changes to this notice
We update this notice when what we do changes, or when the law does. The date at the top of the page is the date of the version you are reading. Where a change materially affects you, we will say so rather than quietly reposting.