Snapshot 20266
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Policy Last updated: 10 September 2026 BACKGROUND: Kanbanchi understands that your privacy is important to you and that you care about how your personal data is used and shared online. We respect and value the privacy of everyone who visits Our websites, www.kanbanchi.com and app.kanbanchi.com (“Our Sites”), and everyone who uses the Kanbanchi services (“Our Services”). We collect and use Personal Data as described in this Privacy Policy and in accordance with applicable Data Protection Laws. Please read this Privacy Policy carefully and ensure that you understand it. This Privacy Policy explains how Kanbanchi collects, uses, stores, shares and protects Personal Data, the circumstances in which Kanbanchi acts as a Controller or Processor, and the rights available to individuals under applicable Data Protection Laws. By using Our Sites or Services, you acknowledge that you have read this Privacy Policy. Where We rely on consent for a particular processing activity, We will request that consent separately where required by law. 1. Definitions and Interpretation In this Policy, the following terms shall have the following meanings: “Account” means the account used by a Customer or End User to access Our Services, together with associated profile, authentication and administrative information; “Cookie” means a small text file placed on your computer or device by Our Sites when you visit certain parts of Our Sites and/or when you use certain features of Our Sites. Details of the Cookies used by Our Sites are set out in section 13, below; “Customer” means an individual acting for business or professional purposes, or a legal entity, educational institution or other organisation, that uses Our Services; “Customer Personal Data” means Personal Data that We process on behalf of a Customer in connection with Our Services where the Customer acts as Controller and We act as Processor; “End User” means an individual whom a Customer authorises to access or use Our Services; “Personal Data” means any information relating to an identified or identifiable individual and has the meaning given to that or an equivalent term under applicable Data Protection Laws; “Data Protection Laws” means privacy and data protection laws applicable to the relevant processing, including the UK GDPR and Data Protection Act 2018, the EU GDPR where applicable, and other applicable national or state privacy laws, as amended or replaced from time to time; and “We/Us/Our” means Kanbanchi Ltd., a limited company registered in England and Wales under company number 10478311, whose registered address is C K R House, 70 East Hill, Dartford, England, DA1 1RZ. References to a Controller, Processor, Subprocessor, Data Subject or processing have the meanings given to the corresponding concepts under applicable Data Protection Laws. 2. Information About Us 2.1 Our Sites and Services are owned and operated by Kanbanchi Ltd., a limited company registered in England and Wales under company number 10478311, whose registered address is C K R House, 70 East Hill, Dartford, England, DA1 1RZ. 2.2 Our VAT number is GB 291018222 3. What Does This Policy Cover? This Privacy Policy applies to Personal Data processed through Our Sites and Our Services and to related interactions with Kanbanchi, including account administration, billing, customer support, sales, marketing, security and product analytics. Kanbanchi may process Personal Data in different roles depending on the context. We generally act as a Controller for Personal Data that We process for Our own account administration, billing, security, legal compliance, sales, marketing, website and similar business purposes. Where We process Customer Personal Data solely on behalf of a Customer in providing Our Services, the Customer generally acts as Controller and Kanbanchi acts as Processor, unless applicable law or a separate agreement establishes a different role. Our Sites and Services may contain links to or integrate with third-party services. Those third parties may process Personal Data under their own terms and privacy policies where they act independently of Kanbanchi. 4. Your Rights 4.1 Depending on the applicable Data Protection Laws and the circumstances of the processing, you may have rights including: 4.1.1 The right to be informed about the collection and use of your Personal Data; 4.1.2 The right of access to Personal Data held about you; 4.1.3 The right to rectification of inaccurate or incomplete Personal Data; 4.1.4 The right to request erasure of Personal Data; 4.1.5 The right to restrict processing; 4.1.6 The right to data portability where applicable; 4.1.7 The right to object to certain processing, including certain direct marketing; 4.1.8 Rights relating to automated decision-making and profiling where applicable; and 4.1.9 The right to withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal. 4.2 These rights are subject to the conditions, limitations and exceptions provided by applicable law. If Kanbanchi processes the relevant Personal Data as a Processor on behalf of a Customer, you should normally direct your request to that Customer. We will provide reasonable assistance to the Customer in responding to applicable Data Subject requests. If Kanbanchi acts as Controller for the relevant Personal Data, you may contact Us using the details in section 14. If you have a complaint about Our processing of your Personal Data, please contact Us first so that We can investigate it. You may also have the right to lodge a complaint with the UK Information Commissioner’s Office or another competent supervisory authority. 4.3 Right to object. Where We process Personal Data on the basis of legitimate interests, you have the right to object to that processing in circumstances provided by applicable law. You have the right to object at any time to the use of your Personal Data for direct marketing purposes. 5. Data privacy: What Data Do We Collect? 5.1 Depending upon your use of Our Sites and Services and Our relationship with you, We may collect or process some or all of the following categories of Personal Data: 5.1.1 name; 5.1.2 business or organisation name; 5.1.3 job title; 5.1.4 contact information such as email address and telephone number; 5.1.5 city, country and other account or organisation information; 5.1.6 account, profile and authentication-related information; 5.1.7 subscription, billing, transaction and payment-related information; 5.1.8 communications with Us, including sales enquiries and customer support requests; 5.1.9 technical and usage information, including IP address, browser, device and application activity information; 5.1.10 security, authentication, audit and operational log information; 5.1.11 marketing preferences, campaign and engagement information; 5.1.12 website, product-usage, analytics and feedback information; and 5.1.13 other Personal Data you choose to provide to Us. 5.2. Where We act as Processor for Customer Personal Data, the information processed through Our Services may also include identifiers and account information; user-generated board, list, card, task and comment content; collaboration and activity information; attachment references and metadata and, where accessed to provide Our Services, information contained in linked files; support communications; and other Personal Data that a Customer or its End Users choose to submit or make accessible through the Services. Underlying attachment files connected to Kanbanchi boards are stored in the Customer’s connected Google Drive or Microsoft OneDrive rather than being persisted as attachment files in Kanbanchi’s application database. Kanbanchi processes the references, metadata and access information necessary to provide the relevant functionality. 5.3. We do not store full credit-card details. Payment and subscription information may be processed by approved payment, billing and subscription service providers as necessary to process payments and administer subscriptions. We use third-party service providers and Subprocessors as described in section 8. 5.4. We may obtain Personal Data directly from you, from the Customer or organisation that administers your Account, through Customer-selected integrations, and from service providers involved in operating Our Sites and Services. Where We obtain Personal Data from another source, We process it only where We have an appropriate lawful basis and provide any additional information required by applicable law. 5.5. Certain Account, contact, authentication and billing information may be necessary to create or administer an Account, enter into or perform a subscription, or provide particular Services. If required information is not provided, We may be unable to create or administer the Account, process a subscription or provide the relevant functionality or support. 6. Data Privacy: How Do We Use Your Data? 6.1 Personal Data is processed securely and retained only for as long as necessary for the applicable purpose, subject to applicable legal, regulatory, contractual, security and retention requirements. More information regarding retention and deletion is provided below and in Kanbanchi’s documented retention and deletion framework. 6.2 Our processing of Personal Data will have an appropriate lawful basis under applicable Data Protection Laws. Depending on the processing activity, this may include performance of a contract, compliance with a legal obligation, Our legitimate interests or those of another party, or consent where consent is required. We may use Personal Data for purposes including: 6.2.1 Providing and managing your Account; 6.2.2 Providing and managing access to Our Sites and Services; 6.2.3 Providing, maintaining and securing Our Services; 6.2.4 Personalising and configuring your experience; 6.2.5 Administering subscriptions, billing and payments; 6.2.6 Communicating with you regarding Our Sites and Services; 6.2.7 Sending transactional and service-related communications; 6.2.8 Providing customer support; 6.2.9 Responding to enquiries and requests; 6.2.10 Detecting, investigating and preventing fraud, misuse and security incidents; 6.2.11 Maintaining logs, security monitoring and audit evidence; 6.2.12 Analysing use of Our Sites and Services and obtaining feedback to improve their operation, performance and user experience; 6.2.13 Complying with legal, regulatory and contractual obligations; and 6.2.14 Marketing Our Services where permitted by law. The lawful basis applicable to a particular activity depends on the purpose and circumstances of the processing. Where We act as Controller, We generally rely on performance of a contract where the individual is a party to the relevant contract, including applicable Account and subscription administration; legal obligations for applicable tax, accounting, regulatory and compliance activities; and legitimate interests for purposes such as operating and securing Our Services, providing services and support to organisational Customers and their End Users, preventing fraud and misuse, managing customer relationships, improving Our Sites and Services and conducting appropriate business-to-business communications. Where We rely on legitimate interests, We consider the necessity of the processing and balance those interests against the rights and interests of affected individuals. We rely on consent where consent is required by applicable law, including for certain marketing or Cookie-related activities. Where Kanbanchi acts solely as Processor of Customer Personal Data, the Customer is responsible for determining the applicable lawful basis for that processing. 6.3 With your permission and/or where otherwise permitted by applicable law, We may use your Personal Data for marketing purposes, including contacting you with information, news and offers concerning Our Services. You may unsubscribe or opt out of marketing communications at any time using the instructions provided in Our communications or by contacting Us. 6.4 We do not control independent processing carried out by Customer-selected or other independent third-party services. Where a Customer enables an integration such as Google Workspace, Google Drive, Microsoft 365 or Microsoft OneDrive, information may be exchanged with that service as necessary to operate the integration and the third party’s own terms and privacy practices may apply. 6.5 Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that is permitted or required on another lawful basis. 6.6 Retention and deletion. We do not keep Personal Data longer than necessary for the applicable purpose. Different categories of information have different retention periods. Active customer and Account data is generally retained while required for the active service or customer relationship. Accounts that remain inactive for 365 consecutive days and do not have an active subscription may be subject to deletion after the applicable notification process. When a board is deleted, restoration availability depends on the applicable Google Drive or Microsoft OneDrive trash/recycle-bin lifecycle and the Customer’s account type and configuration. Related board data may remain in Kanbanchi active systems for operational and recovery purposes for up to 365 days where the board is not restored. Kanbanchi-controlled scheduled production database backups are maintained in Google Cloud Platform and are retained for seven days from creation. Data deleted from live systems may remain temporarily in an existing recovery copy until that copy expires; during that period, the data is kept beyond normal operational use. Customer-created or scheduled Kanbanchi board backups are stored in the Customer’s connected Google Drive or Microsoft OneDrive. They are customer-controlled and their retention and deletion are governed by the Customer’s settings and the applicable provider lifecycle rather than a Kanbanchi-defined retention period. Some minimum records may be retained longer where required for legal, tax, accounting, fraud-prevention, security, audit, dispute-resolution, contractual or regulatory purposes or where a legal or investigation hold applies. 6.7 Children and educational use. Kanbanchi is not directed to children under 13 as a standalone service and We do not seek to contract directly with children under 13. Educational institutions and other organisations may authorise students or other minors to use Our Services under their direction. The Customer is responsible for determining which child-privacy and education laws apply to its use, managing access and obtaining any permissions or consents required of the Customer. Where We process such Personal Data on behalf of an educational institution or other Customer, We process it in Our role as Processor in accordance with the applicable agreement and Data Protection Laws. 7. Data Privacy: How and Where Do We Store Your Data? 7.1 We keep Personal Data only for as long as necessary for the applicable processing purpose and in accordance with the retention principles described in section 6. 7.2 Kanbanchi uses Google Cloud Platform (GCP) to host its principal application environment. Kanbanchi’s current documented primary location for Kanbanchi-controlled application and board data is the United States, US Central region. Underlying files attached to Kanbanchi boards remain stored in the Customer’s connected Google Drive or Microsoft OneDrive, depending on the integration. Kanbanchi processes the references, metadata and access information necessary to provide board and attachment functionality. Customer-created or scheduled Kanbanchi board backups are stored in the Customer’s connected Google Drive or Microsoft OneDrive and are governed by the Customer’s settings and the applicable provider lifecycle. Kanbanchi separately maintains scheduled production database backups in GCP for recovery purposes, currently retained for seven days. Other approved service providers may process Personal Data in other locations as described in section 8. 7.3 Data security is very important to Us. We maintain technical and organisational measures appropriate to the risks of processing. These measures include, as applicable, encryption in transit, provider-managed encryption at rest for GCP-hosted application data, identity and access controls, role-based access and least privilege, logging and monitoring, vulnerability management, secure development practices, incident-response controls, backup and recovery controls, personnel security measures and vendor risk management. Current security and assurance information, including information concerning ISO 27001 and SOC 2 assurance, is available through Kanbanchi’s Security page and Trust Center. 8. Data Privacy: Do We Share Your Data? 8.1 We use third-party service providers and Subprocessors to operate, secure and support Our Sites and Services. Depending on the service and the parties’ respective roles, these providers may process Personal Data on Our behalf as processors or Subprocessors, or may process certain Personal Data as independent controllers under their own privacy terms. They may include providers of cloud hosting and infrastructure, customer support, communications, billing and payment processing, analytics and product measurement, marketing and CRM, security and monitoring, website functionality and other services required to operate Kanbanchi. We require service providers processing Personal Data on Our behalf to be subject to appropriate privacy, confidentiality and security obligations. 8.2 Kanbanchi maintains information about relevant Subprocessors through its Trust Center or another reasonably accessible location. The current Subprocessor list is available through the Trust Center and may be updated as Our service providers change. Updates to the list, including relevant additions or replacements, are published through the Trust Center. Where applicable Data Protection Laws or expressly agreed customer-specific terms require a different or additional form of notice, We will provide it as required. 8.3 Analytics, marketing and service improvement. We may use approved analytics, CRM, marketing and service providers to understand how Our Sites and Services are used, measure performance, manage communications and improve Our Services. Where Cookies or similar technologies are used for these purposes, further information and available controls are provided in Our Cookie Policy and cookie preference tools. 8.4 Support and communications. Information submitted through customer support or other communication channels may be processed in approved support and communications systems to respond to requests and provide support. 8.5 Billing and payment providers. Subscription, billing and payment information may be processed by approved billing and payment providers. We do not use payment information for purposes unrelated to payment, subscription administration, accounting, fraud prevention or other legitimate business and legal requirements. 8.6 Aggregated and anonymised information. We may create and use aggregated or irreversibly anonymised information that does not identify you or another individual for analytics, security, service operation, capacity planning, research and improvement purposes. 8.7 International transfers. Personal Data may be processed in countries other than the country in which you are located. Where an international transfer requires additional safeguards under applicable Data Protection Laws, We use an applicable lawful transfer mechanism. Depending on the relevant data flow, recipient, destination and applicable law, this may include an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, the EU-US Data Privacy Framework or UK Extension where the relevant recipient and transfer are eligible, or another lawful jurisdiction-specific mechanism. The precise mechanism depends on the relevant provider, processing activity, roles, destination and applicable law. International transfer and data-location arrangements for underlying files stored in a Customer’s Google Drive or Microsoft OneDrive are also affected by that Customer’s provider agreement, tenant configuration and the applicable Google or Microsoft safeguards. Use of Our Sites or Services is not itself relied upon as consent or as the legal mechanism for an international transfer. Further information about the safeguards applicable to a particular transfer, including how to obtain a copy of relevant contractual safeguards where available, may be requested using the contact details in section 14. 8.8 Legal disclosures. We may disclose Personal Data where required by applicable law, court order, governmental or regulatory authority, or where reasonably necessary to establish, exercise or defend legal rights, investigate fraud or security incidents, or protect Our rights, users or systems. 9. Data Privacy: What Happens If Our Business Changes Hands? 9.1 We may, from time to time, expand, reorganise or reduce Our business, and this may involve a merger, acquisition, financing, sale or transfer of all or part of Our business or assets. Personal Data relevant to the affected business may be transferred as part of such a transaction, subject to applicable Data Protection Laws and appropriate confidentiality and security protections. 9.2 Where required by applicable law, We will provide notice of a material change in Controller or otherwise provide information regarding the transfer. Any successor handling Personal Data will be required to process it in accordance with applicable law and the obligations applicable to the transferred data. 10. Data Privacy: How Can You Control Your Data? When you submit Personal Data via Our Sites, you may be given options to control or restrict certain uses of your information. In particular, We aim to provide appropriate controls over direct marketing, including the ability to opt out of marketing communications using unsubscribe links, Account settings where available, cookie preference tools or by contacting Us. 11. Data Privacy: Your Right to Withhold Information 11.1 You may access certain areas of Our Sites without providing Personal Data directly to Us. However, to use certain features and functions of Our Services, some Personal Data may be required. 11.2 You may restrict Our use of non-essential Cookies using the cookie preference tools available on Our Sites. Further information is available in Our Cookie Policy. 12. Data Privacy: How Can You Access Your Data? Where Kanbanchi acts as Controller, you may request access to Personal Data We hold about you and exercise other applicable Data Subject rights by contacting Us using the details in section 14. We will normally respond without charge, although applicable law may permit a reasonable fee or refusal in limited circumstances, for example where a request is manifestly unfounded or excessive. Where the relevant Personal Data is Customer Personal Data processed by Kanbanchi on behalf of a Customer, you should generally submit your request to the Customer that controls the relevant Account or workspace. We will provide reasonable assistance to the Customer as required by applicable Data Protection Laws and Our contractual obligations. 13. Our Use of Cookies Our Sites may place and access first-party and third-party Cookies and similar technologies on your computer or device. We use Cookies to operate and secure Our Sites, remember preferences, provide functionality, understand usage and performance and, where permitted and selected through the applicable consent controls, for analytics or marketing purposes. The particular Cookies and third-party technologies in use may change over time. The current categories, providers, purposes, retention information and available controls are set out in Our Cookie Policy and cookie preference interface. 14. Contacting Us If you have any questions about Our Sites, Our Services or this Privacy Policy, or wish to exercise a privacy right relating to Personal Data for which Kanbanchi acts as Controller, please contact Us at: [email protected] or by post at Kanbanchi Ltd., C K R House, 70 East Hill, Dartford, England, DA1 1RZ. Please provide sufficient information for Us to understand and, where appropriate, verify and respond to your request. 15. Changes to Our Privacy Policy We may change this Privacy Policy from time to time to reflect changes in law, Our Services, Our processing activities, security requirements or business practices. Any updated Privacy Policy will be posted on Our Sites and will show the date on which it was last updated. Where required by applicable law, We will provide additional notice by reasonable means. We may also provide additional notice of other material changes where appropriate. We recommend that you review this Privacy Policy periodically to remain informed about how We process Personal Data. Cookies? We use cookies to show you relevant content and improve your experience. You consent to our Cookie policy, Privacy Policy and Terms & Conditions if you continue to use this website.