Privacy

KimonComply is run by Kimon Services (UK) Ltd, a company registered in England and Wales, company number 15309792, whose registered office is at 71-75 Shelton Street, London, WC2H 9JQ. We look after two kinds of information in different ways.

• •Your account details, your name, your email address and your payment record, are ours to look after, and we decide what happens to them. For these we are what the law calls the controller.
• •Everything your organisation puts into the product, its documents, records, registers, audits, findings and uploaded evidence, belongs to your organisation. We hold it and work with it on your organisation's behalf, and we do not use it for anything else. For this your organisation is the controller and we are its processor. Our data processing agreement sets out how we handle it.

• •Your name and email address, and which organisation you belong to and in what role.
• •Your password, kept only as a scrambled version that cannot be read back into a password.
• •Everything your organisation puts into KimonComply, such as documents and their versions, records and registers, audits, findings, photographs and the files you upload as evidence.
• •The record trail, which shows which account did what, and when.
• •If your organisation pays, a reference to its subscription, the country it is billed in, and its VAT number if it gave one. We never hold card details.
• •If your organisation uses the property service, the details it gives us about its properties and the people who rent them, such as renters' names and contact details, safety certificates and Right to Rent copies.

We do not buy information about anyone, and we do not sell it.

Your organisation's documents, records and evidence are stored in the United Kingdom or the European Union. Below is every company that handles any information for us, what each one does, the kinds of information it handles, and where. Our sub-processors page lists the same companies.

Two of them keep some information elsewhere. Resend sends our email from the European Union. It keeps its records of sent email in the United States. Stripe keeps what a payment needs on its own systems, under its own arrangements.

Kimon Global Delivery's staff will reach information only through KimonComply, and only once an approved data transfer agreement is signed.

Where any of this information is handled in a third country, it is handled only under the safeguards UK GDPR requires.

We use no advertising company and no analytics company.

Everything travels between your browser and us over an encrypted connection. So does everything between the product and the companies above. Every file you upload is encrypted where it is stored.

The disk our records sit on is not itself encrypted. What protects them there is that very few people can reach the machine. We plan to fix this, and this page will say when it is done.

Apart from our own staff, only your organisation's members can see its records, either by signing in or through a link we email them to answer audit questions. The one exception is a read-only link your organisation chooses to send, for example to its auditor. The database itself keeps each organisation's records apart from every other organisation's.

KimonComply keeps a record trail. This is a list of what was done and when, each entry locked to the one before it. It cannot be edited or deleted by anyone, including you, your account admin and us. This lets an auditor rely on it.

It does not hold your name or your email address. It holds dates, actions and account references, so once your details have been erased the trail names nobody. An automated test checks this.

You can ask us to erase the personal details we hold about you. Write to info@kimonservices.com and we will answer within one month, which is the time the law allows. We usually answer much sooner. We will check who you are before we do anything.

When we erase someone, their name, email address and password are overwritten so they can no longer be read, their sessions are removed so nobody stays signed in, and their name is taken out of any competence record that carried it.

Two things are kept back. Audit reports and audit-ready packs that have already been issued stay exactly as issued, even where they carry the name of the auditor who ran the audit or the person who approved it. The basis for that is Article 17(3) of the UK GDPR, which allows information to be kept where it is needed to meet a legal obligation or to defend a legal claim. A certified organisation is required to keep records of the audits it has run. An audit report with the auditor's name removed no longer shows that a competent, independent person did the audit.

While your account is open we keep your records for as long as you want them. Closing an account does not delete them, as our terms explain.

What is kept back after an erasure request is kept for the current certification cycle and the one after it, roughly six to seven years. That is how far back a certification body may look.

If you rent a home whose landlord or letting agent uses KimonComply, your landlord or letting agent is responsible for your information. They use KimonComply to keep track of the safety checks on your home, and we handle your information on their behalf and only as they instruct.

They have their own notice for renters, which says what they hold about you, why, who sees it, how long it is kept and how to ask about it. It is linked from every message we send for them.

To see, correct or erase your information, ask your landlord or letting agent first, because they decide what happens to it. You can also write to info@kimonservices.com, and we will pass your request on to them and help them answer it.

• •To be told what we hold about you, and to be given a copy of it.
• •To have anything wrong about you corrected.
• •To ask us to erase your details, subject to the records described above that are kept back.
• •To object to what we are doing with your information, or to ask us to limit it.
• •To complain to us. Write to info@kimonservices.com and we will look into it and answer you.
• •To complain to the ICO, the UK's data protection regulator, at ico.org.uk. We would rather you came to us first, but you do not have to.

To use any of these, write to info@kimonservices.com. If you are a renter, the section above says who to ask first.

We set one cookie. It keeps you signed in. There is no advertising and no analytics anywhere in this product. Our cookies page says exactly what is set and why there is no banner asking your permission.

When we change how any of this works, we publish a new version of this notice on this page, with its version number and the date it was published at the top.

When we add a company to the list above, our sub-processors page says so first, with the date the change takes effect.

If you have any question about your information, write to info@kimonservices.com.