Privacy Notice
This notice explains how KAIROS-K LTD uses personal data in Kairos-K Sign.
- Company number 14481271, registered in England and Wales.
- Registered office: 48 Railway Street, Llanhilleth, Abertillery, Wales, NP13 2JB.
- ICO registration: ZB564813.
Contact for data protection: office@kairos-k-practice.com, +44 29 2255 0485, or by post to the registered office.
1. Two roles
- Processor for envelope data: documents, recipients' names, email addresses (and phone numbers if the SMS check is used), job titles, signatures, IP addresses and browser details, and the audit trail. Here the organisation that sent the envelope is the controller, and our Data Processing Terms apply. If you received a document to sign, the sender is responsible for its use of your data; we pass any request you send us to them.
- Controller in our own right for:
- account data (the details of people who have an account: name, email address, organisation, role, sign-in history);
- security and abuse prevention (abuse reports, rate limits, sign-in records);
- usage and billing;
- platform administration;
- usage figures shown to the parent organisation of a franchise unit;
- the platform audit trail and its daily anchors.
2. What we collect and why
| Data | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Name, email, organisation, role | Provide the account and the Service | Contract |
| One-time codes (stored only as keyed hashes), sign-in times, IP address | Security of accounts and envelopes | Legitimate interests (keeping the Service and its users secure) |
| Sending volumes, failed codes, abuse reports, names checked against the protected-name list | Preventing phishing, spam, fraud and other misuse | Legitimate interests (protecting recipients, users and the Service from abuse) |
| Saved signatures and initials | Applied when you sign, at your request | Contract |
| Standing authority for automatic signing (its text, hash and dates) | Apply your saved signature to envelopes from the template version you authorised | Contract; your instruction |
| Records of sending and signing, audit trail and its anchors | Evidence of transactions; legal claims | Legitimate interests; legal obligation where it applies |
3. Who we share data with
- [Hosting provider, to be confirmed] for the servers in the United Kingdom.
- Amazon Web Services (Amazon S3, London region eu-west-2) for encrypted evidence copies and backups.
- Google (Google Workspace) for sending emails.
- Professional advisers, and authorities where the law requires.
A time-stamping authority, if used, receives only a fingerprint of the sealed file and no personal data. We do not sell personal data and we do not use it for advertising. The Service makes no calls to third-party trackers or content networks.
4. International transfers
Emails may be processed by Google outside the UK, including in the United States, under the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Agreement / UK Addendum, as applicable. Other data stays in the United Kingdom.
5. How long we keep data, backups and evidence copies
- Envelope data: as set by the sending organisation (default 6 years after completion; longer for engagement letters, AML records and deeds), then deleted.
- Evidence copies: an encrypted copy is kept in separate UK storage that cannot be changed until the same date. If earlier deletion is required, its encryption key is destroyed so that it can no longer be read.
- Database backups: encrypted, kept for 35 days.
- Account data: while the account is active and [6] years after it is closed.
- Sign-in codes: deleted within a day of expiry.
- Abuse reports: [6] years.
6. Your rights
You can ask for access to, correction or deletion of your data. You can ask us to restrict or stop using it, and ask for a copy in a portable form.
For documents you received to sign, the organisation that sent them is the controller. We pass your request to them and help them answer it. Completed signing records may be kept, even after a deletion request, where they are needed to comply with a legal obligation or to establish, exercise or defend legal claims (UK GDPR Article 17(3)(b) and (e)).
7. Complaints
If you are unhappy with how we use your data, contact us first. We acknowledge complaints within 30 days, tell you what we are doing about them, and keep you informed. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
8. Cookies
Only strictly necessary cookies are used:
- sign-in session;
- protection against cross-site requests;
- the signer's verified session;
- the chosen language.
No analytics or advertising cookies. See "Cookies".
Version: draft-2026-10-24