KONTRACKS
EU & UK GDPR Notice
This Notice supplements our general Privacy Policy with the additional disclosures required of data controllers and processors under (i) Regulation (EU) 2016/679 (the "EU GDPR"), (ii) the United Kingdom General Data Protection Regulation as amended by the Data Protection Act 2018 (the "UK GDPR"), and (iii) the Swiss Federal Act on Data Protection ("FADP") (together, "European Data Protection Laws").
The Kontracks platform is operated by LWR Technologies, Inc., 390 NE 191st St STE 32488, Miami, FL 33179, United States ("Kontracks"). Kontracks acts as a processor on behalf of its Customers in respect of the personal data of Customers' End Customers, and as a controller in respect of the personal data of Customer's own administrators and Authorized Users to the extent we collect it for our own account management purposes (billing, support, security).
1. Controller / processor roles
- For End Customer data (the people Customer serves), the Customer is the controller; Kontracks is the processor. Processing is governed by the Data Processing Addendum.
- For Customer's account-management data (your administrator's email, billing contact, security incident contacts), Kontracks is the controller, and this Notice and the Privacy Policy describe our practices.
- For website visitors and marketing prospects, Kontracks is the controller.
2. Lawful bases for processing
Where Kontracks is the controller, we rely on the following Article 6 lawful bases:
| Purpose | Lawful basis |
|---|---|
| Providing the Service to Customer; account creation; authentication; security; support. | Contract (Article 6(1)(b)) |
| Billing and tax record-keeping. | Legal obligation (Article 6(1)(c)) |
| Security, fraud prevention, abuse detection, audit logging, debugging. | Legitimate interests (Article 6(1)(f)) — operating a secure platform. |
| Service improvement and aggregated benchmarking. | Legitimate interests (Article 6(1)(f)) — improving the Service while preserving Data Subject rights. |
| Marketing emails to existing Customers and prospects who have given consent or for whom soft opt-in applies. | Consent (Article 6(1)(a)) or legitimate interests (Article 6(1)(f)), with an unsubscribe link in every email. |
| Compliance with regulatory and law-enforcement requests. | Legal obligation (Article 6(1)(c)); compliance with court orders. |
Where the processing is for End Customer data on behalf of a Customer, Kontracks processes on the documented instructions of the Customer, and the Customer is responsible for identifying the lawful basis for its own processing under Article 6 (and, where applicable, Article 9 for special categories of data).
3. Categories of personal data and Data Subjects
The categories of personal data we process, the categories of Data Subjects, and the purposes of processing are described in Section 3 of the DPA and Sections 2–3 of the Privacy Policy.
4. International transfers
Kontracks is established in the United States and processes personal data on infrastructure located in the United States. Where Kontracks transfers personal data from the EEA, UK, or Switzerland to the United States (or to a sub-processor outside those jurisdictions), Kontracks relies on appropriate safeguards as follows:
- The EU Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 — Module Two (Controller-to-Processor) — incorporated by reference into the DPA;
- The UK International Data Transfer Addendum (Version B.1.0) issued under section 119A of the Data Protection Act 2018 for transfers originating in the UK;
- For Swiss transfers, the EU SCCs as adapted by the Federal Data Protection and Information Commissioner.
Kontracks has conducted a Transfer Impact Assessment under Recommendations 01/2020 of the European Data Protection Board and concluded that, taking into account the supplementary measures described in the Trust & Security Overview (encryption in transit, AES-256-GCM column-level encryption for sensitive tokens, contractual restrictions on government access disclosures, transparency reporting commitments), the data exported from the EEA, UK, and Switzerland receives an essentially equivalent level of protection. The Transfer Impact Assessment is available on request to privacy@kontracks.com.
5. Retention
We retain personal data for as long as needed for the purposes described in this Notice and the Privacy Policy, and to comply with our legal obligations. Specific retention periods are set out in the Privacy Policy and the DPA. When personal data is no longer needed, we delete it; where deletion is not immediately technically feasible (e.g., backup snapshots), we isolate it and delete it in line with the backup-rotation schedule.
6. Your rights as a Data Subject
Subject to applicable conditions and exemptions, you have the following rights under the EU GDPR, UK GDPR, and FADP:
- Right of access — to obtain confirmation of whether we process your personal data and a copy of that data;
- Right to rectification — to have inaccurate personal data corrected;
- Right to erasure ("right to be forgotten") — to have your personal data deleted, where applicable;
- Right to restriction of processing — to require us to limit processing in defined circumstances;
- Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller;
- Right to object — to object to processing based on legitimate interests, including profiling, and to object to direct marketing at any time;
- Right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (we do not currently make such decisions);
- Right to withdraw consent at any time where processing is based on consent;
- Right to lodge a complaint with a supervisory authority (Section 8 below).
7. How to exercise your rights
If Customer is the controller of your data (i.e., you are an End Customer of a Customer), please contact Customer directly. Customer is responsible for fulfilling your rights, and Kontracks will assist Customer through the in-product self-service tools. If you cannot identify or reach Customer, contact privacy@kontracks.com and we will route your request to the appropriate Customer.
If Kontracks is the controller of your data (e.g., you visit our marketing website, you are an administrator on a Customer account, you contact our support team), submit your request to privacy@kontracks.com. We will respond within one (1) month of receipt, with an extension of up to two further months where necessary, accounting for the complexity and number of requests. We may need to verify your identity before responding.
8. Supervisory authorities
You have the right to lodge a complaint with the supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement. A directory is maintained at edpb.europa.eu. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ico.org.uk). In Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
9. EU and UK representatives
Kontracks does not currently meet the thresholds under Article 27 of the EU GDPR or Article 27 of the UK GDPR requiring the designation of an EU or UK representative. We will update this Notice and designate a representative where required as our customer base expands.
10. Cookies and tracking
For information on cookies and similar technologies, including how to consent or withdraw consent, see the Cookie Policy.
11. Children
The Service is not directed to children under 16. We do not knowingly collect personal data from a child. If you believe a child has provided personal data to us, please contact privacy@kontracks.com.
12. Changes
We may update this Notice. Material changes will be communicated to administrator accounts and published here with a new effective date.
13. Contact
Data protection inquiries: privacy@kontracks.com
Mailing address: LWR Technologies, Inc., Attn: Privacy, 390 NE 191st St STE 32488, Miami, FL 33179, USA