Version 1.0 | Effective date: 20 June 2026
This policy explains how the KIND Deliverables Tracker (Service) handles personal data. It should be read with the Terms of Use.
The Service is operated under the KIND name (we, us or our). For account and Service-administration data, we are normally the controller. Where an organisation uses the Service for project information containing personal data, that organisation will normally be the controller and we may act as its processor. The precise roles and arrangements must be confirmed in a written data-processing agreement where required.
Privacy questions or requests: support@kindtracker.co.uk.
Do not enter special-category personal data, criminal-offence data, classified or protectively marked information, or other restricted information into the Service. The Service is not designed or approved for that use.
We use personal data to provide and administer accounts and the Service; authenticate users; provide support; maintain security; prevent misuse; investigate incidents; meet legal obligations; and improve the reliability and functionality of the Service. Where we act as controller, our lawful bases will normally be performance of a contract, legitimate interests in running and securing the Service, legal obligation, or consent where we specifically request it.
We use Supabase-hosted infrastructure for authentication and database services. We may also use suppliers needed to host, secure, maintain or support the Service. Those providers may process data only as necessary to provide their services to us and subject to their applicable terms and safeguards.
We do not sell personal data. Project content is intended to be accessible only to authorised members of the relevant organisation, subject to the Service's configured access controls. We may disclose information where required by law, to protect rights and safety, or in connection with a business reorganisation, subject to applicable law.
Our providers may process data outside the United Kingdom or European Economic Area. Where a restricted transfer occurs, we will seek to use an appropriate lawful transfer mechanism and safeguards. Your organisation remains responsible for confirming that its own contractual, security and transfer requirements permit use of the Service.
We retain personal data for as long as necessary to provide the Service, comply with legal obligations, resolve disputes and enforce agreements. Account and project data may remain available until deleted by an authorised organisation administrator or us. Backups and security logs may persist for a limited period after deletion. The Service is not an archival or records-retention system; you must keep copies of records you need to retain.
We use reasonable measures intended to protect the Service, but no internet service is completely secure. You must protect credentials, maintain appropriate access control in your organisation, and report suspected unauthorised access promptly. We do not represent that the Service meets any particular security classification, government assurance level, certification, accreditation or security standard.
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, data portability, or withdrawal of consent. Where we process data for your organisation, please make the request to that organisation first. We may need to verify identity and may have legal reasons not to fulfil every request. UK residents may also complain to the Information Commissioner's Office.
We may update this policy from time to time. The current version and effective date will be published at this address.