This Privacy Notice is issued by KINORBIT LTD pursuant to Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”). It sets out the personal data we process about you, the purposes and lawful bases of that processing, the recipients of the data, the applicable retention periods, the safeguards applied to international transfers, and the rights available to you as a data subject.
1.1 The controller in respect of the personal data processed through this website is KINORBIT LTD, a company incorporated in England and Wales under company number 17402687 (the “Controller”, “we”, “us” or “our”). Our registration with the Information Commissioner’s Office (“ICO”) will be published in this Notice prior to the launch of the mobile application.
1.2 Enquiries concerning this Notice, and requests to exercise the rights described in section 13, may be addressed to us at support@kinorbit.co.uk. We have not appointed a Data Protection Officer, not being required to do so under Article 37 UK GDPR; the contact above is our designated point of contact for data protection matters.
2.1 The terms “personal data”, “processing”, “controller”, “processor” and “data subject” bear the meanings given to them in Article 4 UK GDPR. “Platform” means the KinOrbit website and, upon their release, the KinOrbit mobile application and school administration portal.
2.2 This Notice applies to the processing of personal data carried out by the Controller through the Platform. Where a School invites or administers its community, responsibilities may be allocated between the School and the Controller in the manner described in section 12.
3.1 We may process the following categories of personal data:
4.1 In accordance with Articles 5(1)(c) and 25 UK GDPR, we limit our processing to the personal data that is adequate, relevant and necessary for the purposes set out in this Notice, and we apply data protection by design and by default, including high-privacy default settings.
4.2 You may control the personal data that is made visible to other users through your privacy settings, including the masking of identifying details.
4.3 We do not carry out behavioural profiling for the purposes of third-party advertising, and we do not sell personal data.
5.1 We process personal data on one or more of the following lawful bases under Article 6(1) UK GDPR:
6.1 We process personal data for the following purposes:
7.1 Other users. Where you connect with another user or join a group, the profile information you have elected to share is disclosed to the relevant members, subject to your privacy settings (including address masking).
7.2 Schools. A School may access the members associated with its community for the purposes of onboarding and verification.
7.3 Processors. We engage third-party processors who process personal data solely on our documented instructions pursuant to written terms compliant with Article 28 UK GDPR. These fall within the following categories of recipient: our cloud hosting and database provider, our authentication provider, our email-delivery provider, our identity-verification and payment provider, and our push-notification provider.
7.4 Local authorities. Aggregated or pseudonymised travel-planning data only, pursuant to a separate agreement.
7.5 Competent authorities. Where required by law, or where necessary to protect the vital interests of any person (safeguarding).
7.6 We do not sell personal data.
8.1 Where any recipient identified in section 7 processes personal data outside the United Kingdom, such transfers are effected in accordance with Chapter V UK GDPR, relying on an adequacy decision (Article 45), appropriate safeguards under Article 46 (including the UK International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses), or an applicable derogation, so as to ensure a level of protection consistent with UK law. Further details of the safeguards applied are available on request.
9.1 In accordance with the storage-limitation principle in Article 5(1)(e) UK GDPR, we retain personal data only for so long as is necessary for the purposes set out in this Notice or as required to meet our legal obligations. Account and related personal data are retained for the duration of your account and are thereafter deleted or anonymised within [period, e.g. 12 months] of closure. Research and survey responses are anonymised within 30 days of the closure of the relevant research. Detailed retention periods are set out in our internal retention schedule, available on request.
10.1 Pursuant to Article 32 UK GDPR, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption in transit, access controls, row-level access segregation and the principle of least privilege. No system can be guaranteed to be wholly secure. Where a personal data breach occurs, we will notify the ICO and, where required, affected data subjects in accordance with Articles 33 and 34 UK GDPR.
11.1 The website deploys strictly necessary cookies by default. Non-essential analytics or measurement cookies are deployed only with your consent under the Privacy and Electronic Communications Regulations 2003 (“PECR”), which you may manage or withdraw at any time. The mobile application does not use advertising cookies.
12.1 Where a School onboards its community, the School may act as an independent controller or joint controller in respect of the enrolment data it provides, and the Controller may act as its processor for those activities pursuant to a data-processing agreement between the parties. In respect of the coordination service used directly by members, KINORBIT LTD acts as controller. Where you are uncertain which party to approach, you may contact us and we will direct your request accordingly.
13.1 Subject to the conditions and exemptions in the UK GDPR and the DPA 2018, you have the right to request access to your personal data (Article 15); rectification (Article 16); erasure (Article 17); restriction of processing (Article 18); data portability (Article 20); and to object to processing (Article 21), as well as the right to withdraw consent (Article 7(3)). Requests may be submitted to support@kinorbit.co.uk and will be actioned within one month of receipt, subject to any permitted extension under Article 12(3).
13.2 You have the right to lodge a complaint with the ICO under Article 77 UK GDPR (ico.org.uk; 0303 123 1113). We would, however, welcome the opportunity to address your concerns in the first instance.
14.1 We may amend this Notice from time to time; material changes will be notified by email or published on this page, and the effective date above will be updated accordingly. Enquiries: support@kinorbit.co.uk.