Privacy Policy

1. Introduction

KBA IT Ltd ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website kba-it.com or use our services.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide, including:

• Name and contact details (email address, phone number)
• Company information and job title
• Messages and communications sent through our contact forms
• Any other information you choose to provide

2.2 Automatically Collected Information

We may automatically collect certain information about your device and usage, including:

• IP address and location data
• Browser type and version
• Pages visited and time spent on our website
• Referring website or source
• Device information (operating system, screen resolution)

3. How We Use Your Information and Our Lawful Basis

UK GDPR requires us to have a valid lawful basis for each way we use your personal information. Here is how that applies to the purposes above:

• To respond to your enquiries and provide customer support - lawful basis: legitimate interests (responding to enquiries you have initiated), or steps taken at your request prior to entering a contract
• To deliver our consulting services and communicate about projects - lawful basis: performance of a contract with you or your organisation
• To improve our website and services - lawful basis: legitimate interests, balanced against your right to privacy
• To analyse website usage and performance (analytics cookies) - lawful basis: your consent, given (or withdrawn) via our cookie banner - see our Cookie Policy
• To comply with legal obligations - lawful basis: compliance with a legal obligation (e.g. accounting and tax record-keeping)
• To protect our rights and prevent fraud - lawful basis: legitimate interests

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We use the following service providers (data processors) to operate our website and respond to enquiries. Each only receives the data it needs to perform its function:

• Web3Forms - processes and delivers messages submitted through our contact form
• hCaptcha (Intuition Machines, Inc.) - provides spam and bot protection on our contact form
• Google (Google Analytics, Google Fonts) - provides website analytics (only if you consent to analytics cookies) and serves the web fonts used on this site
• Amazon Web Services (AWS) - hosts this website and processes standard web server logs (IP address, requested page, timestamp)
• Cloudflare, Inc. (via cdnjs) - serves the FontAwesome icon library used on this site, and as a result sees the IP address of the browser requesting it

We may also share your information:

• With your explicit consent
• To comply with legal requirements or court orders
• To protect our rights, property, or safety
• In connection with a business transfer or merger

5. Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

6. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy. In practice, that means:

• Contact form enquiries that do not lead to a client engagement are deleted or anonymised after 12 months of inactivity.
• Information relating to an active client engagement is retained for the duration of that engagement and for 6 years afterwards, in line with the Limitation Act 1980 and standard UK accounting record-keeping requirements.
• Analytics data collected via Google Analytics (only where you have consented) is retained by Google for up to 14 months before automatic deletion, per our Google Analytics configuration.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Right to access your personal data
• Right to rectify inaccurate or incomplete data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise these rights, please contact us at info@kba-it.com.

If you are unhappy with how we have handled your personal information, you also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concerns directly first.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience. For detailed information about our use of cookies, please see our Cookie Policy.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies.

10. Children's Privacy

Our website and services are business-to-business and are not directed to children. Under UK GDPR, the age at which a young person can consent to information society services in their own right is 13; we do not knowingly collect personal information from anyone under that age, and in practice we do not expect anyone under 18 to be using our consultancy services.

11. International Data Transfers

Some of the service providers listed in Section 4 (including Google and Amazon Web Services) process data outside the UK, including in the United States. Where this happens, we rely on one or more of the following safeguards, as applicable to that provider: the UK's own adequacy regulations, the UK extension to the EU-US Data Privacy Framework ("UK-US Data Bridge") where the recipient is certified under it, or the International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.

12. Updates to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

13. Contact Information

KBA IT Ltd is the data controller for the personal information described in this policy. If you have any questions about this Privacy Policy or our data practices, please contact us: