Privacy Policy

2) The personal data we collect

2.1 Website and technical data

When you visit our website, we may process technical data such as:

• IP address
• Device and browser information
• Pages viewed and request metadata
• Approximate location inferred from IP (country/region level)

2.2 Contact and enquiry data

When you contact us (for example via a contact form or email), we may collect:

• Name
• Email address
• Company name
• Role/job title
• Message content and any attachments you send

2.3 Client and service delivery data (services)

When delivering automation services, we may process data that a client provides or makes available to us. This can include:

• CRM records (lead/customer fields, statuses)
• Operational messages (email/Slack/Teams content routed through workflows)
• Files intentionally passed through workflows (documents, exports)
• Identifiers and metadata required to run workflows (record IDs, timestamps, event types)
• Limited logs and diagnostic information for reliability and support

The exact categories depend on the client's tool stack and the workflows requested.

4) Lawful bases for processing

Where UK GDPR / EU GDPR applies, we rely on the following lawful bases:

• Consent (Article 6(1)(a)): where you provide information via a form or opt in to communications (where applicable).
• Contract (Article 6(1)(b)): where processing is necessary to provide services or take steps at your request before entering a contract.
• Legitimate interests (Article 6(1)(f)): where processing is necessary for our legitimate interests (for example, operating our website securely, responding to enquiries, and improving service reliability), balanced against your rights.
• Legal obligation (Article 6(1)(c)): where we must comply with legal or regulatory requirements.

6) How we share personal data

We may share personal data with:

• Service providers that help us operate the website and deliver services (subprocessors)
• Professional advisers (legal, accounting) where necessary
• Authorities or third parties where required by law

We only share data necessary for the relevant purpose.

6.1 Subprocessors

We use third-party providers ("subprocessors") for functions such as hosting, email delivery, and form handling.

Current subprocessors list: /subprocessors.html

8) Data retention

We keep personal data only as long as necessary for the purposes described in this policy.

Typical retention categories include:

• Enquiry and correspondence records
• Client communications and support records
• Service documentation and project records
• Website and security logs
• Billing and compliance records (as required by law)

Retention details: Available on request

10) Your rights

Where UK GDPR / EU GDPR applies, you may have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of personal data
• Restrict or object to processing
• Request portability of personal data
• Withdraw consent (where processing is based on consent)

To exercise your rights, email: hello@kasperautomation.com.

10.1 Complaints

If you are in the UK, you can lodge a complaint with the Information Commissioner's Office (ICO).

If you are in the EEA, you can lodge a complaint with your local supervisory authority.

12) Processor vs controller roles (services)

12.1 When we are the controller

We are the controller for:

• Website visitor data
• Enquiries and communications
• Business operations data (accounting, invoicing, administration)

12.2 When we are the processor

For many client engagements, we act as a processor for personal data the client controls (for example, CRM records processed through workflows). In those cases:

• The client is the controller
• We process data only on the client's documented instructions
• Our processing is governed by our DPA and the client's agreement with us

DPA: /dpa.html

14) Contact

For privacy questions or requests: hello@kasperautomation.com

For security concerns: security@kasperautomation.com