Privacy Policy

Kadesgo as data controller

Kadesgo is the data controller for personal data processed in connection with, among other things:

• visits to our website;
• creating and managing KadesGo accounts;
• trials and subscriptions;
• billing and payments;
• questions, demonstrations, support and other communications;
• the security, availability and improvement of our services;
• our own legal and administrative obligations.

Kadesgo as data processor

Business customers use KadesGo to manage their own operations. They may enter personal data about their customers, employees and other individuals. The relevant repair or service business determines why and how that data is used. That business is the data controller and Kadesgo acts as its data processor.

Kadesgo processes this data only on the business customer's instructions and in accordance with the data processing agreement. Anyone with a question about data entered in KadesGo by a business should therefore contact that business first. Kadesgo assists its business customers with handling privacy requests.

Depending on how a person uses KadesGo, we may process the following categories of personal data.

Website and technical data

• IP address and the date and time of a request;
• browser, device and operating-system information;
• pages visited and technical request information;
• error messages, security alerts and log data;
• language preference;
• technical signals used to prevent spam and abuse when a reCAPTCHA-protected contact or registration form is used.

Account and profile data

• name and email address;
• optional profile picture;
• user ID, organisation, job function or user role;
• language, display and other user preferences;
• authentication, session and security data;
• information about the use of features within KadesGo.

Passwords are processed securely through our authentication service. Kadesgo does not store passwords in readable form.

Subscription, invoice and payment data

• business name and business address;
• name and contact details of the contact person;
• Chamber of Commerce and VAT information where applicable;
• selected subscription, subscription status and invoice information;
• payment status, transaction IDs and limited payment-method information.

Payments are processed by Stripe. As a rule, Kadesgo does not receive the complete payment-card or bank-account number. Stripe may process that data directly to execute and secure payments and to comply with its own legal obligations.

Contact and support data

• name, email address and any other contact details;
• the content of questions, requests and correspondence;
• information voluntarily provided so that we can offer support.

Email and delivery data

For transactional emails, we may process the sender's and recipient's email addresses, the time sent, delivery status, error messages, bounces and spam complaints. Kadesgo does not use open or click tracking and currently does not operate a newsletter.

Data entered by business customers

• customer names, addresses, email addresses, telephone numbers and business details;
• repair, service, product and ticket information;
• appointments, calendar information, statuses and reminders;
• descriptions, notes, warranty and invoice information;
• digital signatures and statements of approval;
• documents, images and other attachments;
• assigned employees and activity history.

• directly from the data subject;
• from an administrator or another authorised user of a business customer;
• automatically when the website or application is visited or used;
• from Stripe in connection with payments and subscriptions;
• from SendGrid in connection with sending and delivering emails;
• from Google reCAPTCHA when the contact or registration form is protected;
• when a business customer enters information about its own customers or employees in KadesGo.

When Kadesgo acts as data controller, we process personal data for the purposes and on the GDPR legal bases set out below.

When Kadesgo acts as a processor, the business customer determines the applicable legal basis. Kadesgo does not use personal data entered by customers for its own marketing. Some information is required to provide an account or subscription; without it, we may be unable to provide the requested service.

Language preference

We use a functional cookie to remember your language preference. It does not track visitors across websites and is not used for advertising. The preference is retained for up to twelve months unless you delete the cookie sooner.

Protecting the contact and registration forms

We use Google reCAPTCHA on the contact and registration forms to prevent spam, automated submissions and abuse. It may process an IP address, browser and device information, interaction data and risk signals. When reCAPTCHA is executed, the necessary _GRECAPTCHA cookie may be set for risk analysis.

We use reCAPTCHA on the basis of our legitimate interest in securing our website, account-registration process and communications. The privacy-policy page itself does not use or load reCAPTCHA.

No analytics or marketing cookies

KadesGo currently does not use analytics or marketing cookies. If we introduce other cookies or similar technologies in the future, we will update our information in advance and request consent where legally required.

KadesGo uses Twilio SendGrid for necessary account, security, ticket and status messages. Depending on the business customer's settings, messages may be sent from the customer's address or from a professional KadesGo address.

SendGrid processes technical delivery information, such as whether a message was processed, delivered, rejected or reported as spam. This data is used for sending, troubleshooting, security and preventing repeated delivery attempts to invalid or blocked addresses.

Kadesgo does not sell or rent personal data. We disclose data only where necessary to provide our services, where required by law or where another valid legal basis applies.

The selected region determines where primary project and application data is stored. In limited cases, providers may access data from other countries for support, security, global delivery or through subprocessors. Website requests may also be routed through globally distributed network or security locations.

We may also disclose data to professional advisers, accountants, insurers, regulators, law-enforcement bodies or other competent public authorities where necessary or legally required. We enter into appropriate confidentiality, security, processing and deletion arrangements with providers that process personal data for Kadesgo.

KadesGo's primary Supabase and AWS regions are within the European Economic Area (EEA). Some providers, affiliates or subprocessors may nevertheless process personal data outside the EEA, including in the United States.

Where data is transferred to a country without an applicable adequacy decision, we use appropriate safeguards such as the European Commission's standard contractual clauses. Where necessary, we assess supplementary technical and organisational measures. Information about applicable safeguards can be requested at info@kadesgo.com.

Kadesgo does not retain personal data longer than necessary for the purpose for which it was collected, unless a legal obligation or justified need requires longer retention.

When an organisation administrator ends the subscription and requests deletion of the organisation, the active user profiles are also deleted. The exceptions for backups and legally required financial records continue to apply.

An organisation administrator can remove users from the organisation. The relevant user's active authentication and profile data is then deleted. An administrator may also end the subscription and request deletion of the entire organisation's active data, including all user profiles.

Users without administrator rights may contact their organisation administrator or Kadesgo to request deletion. Data disappears from secured backups as the backup cycle of up to seven days expires. Invoice and payment data that must be retained by law is not deleted before the tax retention period ends.

Kadesgo implements appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure, and unlawful alteration or deletion. Depending on the processing, these measures include:

• encrypted connections and, where applicable, encryption of stored data and backups;
• logical separation between organisations;
• role- and user-based access controls and least-privilege permissions;
• secure authentication and session management;
• network and application security through AWS WAF;
• monitoring, backups and security-incident procedures;
• contractual security arrangements with service providers.

No digital service can guarantee absolute security. Kadesgo therefore reviews its measures periodically and updates them where necessary.

Where the legal requirements are met, you have the right to:

• obtain access to your personal data;
• have inaccurate or incomplete data corrected;
• have personal data erased;
• restrict processing;
• object to processing based on a legitimate interest;
• receive data you provided in a structured, commonly used and machine-readable format and, where applicable, transmit it elsewhere;
• withdraw previously given consent;
• lodge a complaint with a supervisory authority.

Send your request to info@kadesgo.com. To prevent misuse, we may request reasonable additional information to verify your identity. We normally respond within one month. For complex or numerous requests, the GDPR allows this period to be extended by up to two months; if so, we will inform you during the first month.

Does your request concern data entered in KadesGo by a repair or service business? Please contact that business first. It is generally the controller for that processing, and Kadesgo will assist it where necessary.

Kadesgo does not make decisions based solely on automated processing that produce legal effects or otherwise significantly affect a person. Kadesgo does not use personal data for profiling.

KadesGo is offered exclusively for business and professional use by repair and service businesses. The service is not directed at children. A person entering into a subscription on behalf of a business must be authorised to represent that business. Other users receive access under the business customer's responsibility.

Kadesgo does not knowingly collect children's personal data directly for its own purposes. A business customer may enter data about a minor customer as part of its services. That customer is responsible for having a valid legal basis, providing appropriate information to the minor or legal representative and complying with applicable rules. Kadesgo processes that data only on the business customer's instructions.

Kadesgo may update this privacy policy when our services, practices or applicable rules change. The most recent version is published on our website, with the last-updated date shown at the top. For material changes, we may also inform users through the application or by email.

Do you have a question about this privacy policy or our processing of personal data? Please contact us.