1. Who is responsible
Katari Technologies Ltd, of Trinidad and Tobago is responsible for the personal data described in this notice. Contact us at [email protected].
When an organisation uses Kinetic VOC to manage its own staff, clients and suppliers, that organisation decides how their data is used and is responsible for it. We process that data only on its instructions, under our Data Processing Agreement. If you are a member of staff or a client of one of our customers, please contact that organisation first; we will help it respond.
2. Laws we follow
We follow the general privacy principles of the Data Protection Act, 2011 of Trinidad and Tobago, and we apply the same standard to everyone whose data we handle, wherever they are. Where another law gives you stronger rights, we honour them.
3. Personal data we collect for our own purposes
- Account data: name, work e-mail, organisation, role, sign-in history and security settings of the people who use the Service.
- Billing data: billing contact, invoices, payment references and the outcome of payments. Card details are entered on our payment provider’s page and are never received or stored by us.
- Sales and support data: enquiries, sign-up details, messages and notes of conversations with prospective and existing customers, kept in our customer relationship records.
- Technical data: IP address, browser type and timestamps recorded for security, rate limiting and audit.
4. Why we use it and our legal basis
| Purpose | Basis |
|---|---|
| Providing and securing the Service, signing people in, preventing abuse | Performance of our contract with the customer; our legitimate interest in security |
| Billing, collecting payment, keeping accounting records | Contract; legal obligation to keep financial records |
| Responding to enquiries and supporting customers | Contract; legitimate interest |
| Telling customers about changes to the Service, prices or terms | Contract; legal obligation |
| Marketing to business contacts | Consent where required, which you can withdraw at any time; otherwise our legitimate interest, with an easy opt-out |
5. Who we share it with
We share personal data only with the service providers listed on the Subprocessors page, who act on our instructions under written terms, and with authorities where the law requires. We do not sell personal data and we do not allow advertisers to track people in the Service.
6. International transfers
Our hosting and e-mail providers may process data outside Trinidad and Tobago, as the Subprocessors page shows. We choose providers with strong security and contractual commitments, and we protect data in transit and at rest with encryption.
7. How long we keep it
We keep personal data only as long as needed for the purposes above, as set out in the Data Retention Policy. For example, billing records are kept for 7 years because tax law requires it, and sign-up requests that were never confirmed are deleted after 30 days.
8. Your rights
You may ask to access the personal data we hold about you, to correct it, to delete it where we no longer need it, to object to or restrict certain uses, and to withdraw consent to marketing. Write to [email protected]. We will respond within 30 days and may need to confirm your identity. If you are not satisfied, you may complain to the data protection authority of Trinidad and Tobago once it is in operation, or to the authority where you live.
9. Security
We protect personal data with the measures in the Security Policy, including encryption, two-step sign-in, strict access control and tamper-evident audit trails.
10. Cookies and similar storage
We use only strictly necessary cookies. The Cookie Notice explains them.
11. Children
The Service is not directed at children and we do not knowingly collect their data for our own purposes.
12. Changes
We will post changes here with a new effective date, and tell customers of material changes in advance.