Legal
Privacy notice
What we hold, why we hold it, how long we keep it, and what you can ask us to do about it.
Who is responsible
Kalotect Ltd, trading as Kalotect, registered in England and Wales, company number pending, registered office Riverhead, Sevenoaks, Kent, is the data controller for everything described here. Write to hello@mail.kalotect.com with any question about this notice, and we will answer within a month.
We have not appointed a data protection officer, because we are not required to. The person responsible is the head of delivery, Joe Kaul.
What we hold and why
| What | Why | Lawful basis | How long |
|---|---|---|---|
| The brief you start on this site | To answer you with a fixed price and a plan, and to let you come back and finish it. | Legitimate interests: you asked us for a price. Your consent for us to contact you about it. | 30 days from your last activity on it, then deleted by a job that records the deletion. |
| Your account in the admin | So you can sign in, approve work, read your Ledger, pay and raise tickets. | Performance of our contract with you. | For as long as you are a client, then six years, because company and tax law requires the record of what we did and charged. |
| Sign-in tokens and passkeys | To let you in and to keep other people out. | Legitimate interests: keeping your account secure. | A session lasts 12 hours, or up to 30 days with a passkey. A sign-in link works once and expires after 15 minutes. |
| Analytics on this site | To see which pages answer the question people arrived with, and to measure the performance we publish. | The exemption for measurement the law allows without consent, kept within its limits: first party, aggregated, no cross-site identifiers, no profiles. | Set to the shortest period that still answers the question. The exact figure is pending while the account is configured, and it will be published here. |
| The journal digest | To send you the journal, no more than monthly. | Your consent, which you give by asking for it. | Until you unsubscribe, which is one click in every email, then we keep only the fact that you unsubscribed so we do not email you again. |
| Backups | So that a failure does not lose your work. | Legitimate interests: keeping the service running. | Ninety days, then overwritten. A restore is tested monthly and the test is recorded. |
The brief you start on this site
The overlay saves after every answer, so nothing is lost if you close the tab. The draft is kept against a resume token held in a cookie on your device, and it is deleted 30 days after you last touched it whether or not you finished it. If you gave us an email address, we send the resume link about 2 hours later, and if the draft is still unfinished after 7 days we send you a one-page note of what you told us and what we would suggest. There is no obligation in either, and both carry a way to tell us to stop.
Who else sees it
Our hosting, database, email, payment and analytics providers process information on our instructions under written terms. We do not sell information and we do not share it for anyone else’s marketing. Where a provider is outside the UK we rely on the safeguards the law requires, and we will name the providers and the countries on request.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to us holding it, ask us to restrict what we do with it, or ask for it in a portable form. Clients can export their own Ledger from the admin at any time without asking. Where we rely on consent you can withdraw it at any time, and that does not affect what we did before you withdrew it. After you stop being a client your data stays available to export for 90 days.
Write to hello@mail.kalotect.com. If you are not satisfied with our answer you can complain to the Information Commissioner’s Office at ico.org.uk, and we would rather you told us first so we can put it right.
Changes
This notice is version 1.0, dated 16 September 2026. When it changes we publish the new version here with its date, and tell clients in the admin.
See also our cookies page, our terms of business and our AI disclosure.