Privacy Policy

1. Data Controller & Scope

This Privacy Policy explains how Kaltova ("we", "us", "our") collects, uses, stores, and protects personal data obtained through kaltova.info. Kaltova is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

This policy applies to all visitors to our website, newsletter subscribers, and individuals who contact our editorial desk.

2. Information We Collect

We believe in data minimisation and collect only information necessary to deliver our educational resources and respond to your requests:

• Contact Information: When you submit a message via our contact form or email us directly, we collect your name, email address, and the contents of your message.
• Newsletter Subscriptions: If you voluntarily sign up for our reading list, we collect your email address and subscription timestamp.
• Technical & Server Logs: When you access the website, our web server automatically collects standard internet log information, including your IP address, browser type and version, operating system, referring URL, pages visited, and date/time of access for security and operational reliability.
• Cookie Preferences: We record your cookie consent choice via the kaltova_consent cookie.

3. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we process personal data under the following lawful bases:

• Consent (Art. 6(1)(a)): For sending our email newsletter and for placing non-essential cookies where applicable. You may withdraw consent at any time.
• Legitimate Interests (Art. 6(1)(f)): For operating a secure, accessible website, maintaining server stability, protecting against abuse, and responding to general enquiries.
• Legal Obligation (Art. 6(1)(c)): Where required to comply with applicable statutory or regulatory obligations under UK law.

4. Data Retention Schedule

We keep your personal information only for as long as necessary to fulfill the purposes outlined in this policy:

• Contact Enquiries: Retained for 24 months following the last meaningful communication, after which records are securely deleted.
• Newsletter Subscriptions: Stored until you choose to unsubscribe. Unsubscribe suppression records may be retained for up to 12 months to ensure your preferences are respected.
• Server Logs: Standard security and access logs are retained for 90 days before automatic deletion, unless required longer for an active security investigation.
• Consent Records: Cookie consent preferences are stored for up to 365 days.

5. Your Data Protection Rights

Under UK data protection law, you have specific rights regarding your personal data:

• Right of Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restriction: Request that we restrict the processing of your data in certain circumstances.
• Right to Object: Object to the processing of your personal data based on legitimate interests.
• Right to Data Portability: Request transfer of your data to another organisation in a structured, machine-readable format.
• Right to Withdraw Consent: Withdraw previously given consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please email our team at [email protected]. We will respond within one calendar month.

6. Third-Party Service Providers (Processors)

We work with vetted service providers who process data on our behalf under strict contractual terms ensuring confidentiality and UK GDPR compliance:

• Website Hosting: Secure cloud infrastructure and server hosting located in the UK and EEA.
• Email Delivery: Transactional and newsletter email delivery providers.
• Security & DDoS Protection: Services used to maintain website integrity and prevent malicious attacks.
• Embedded Content: The contact page embeds a Google Maps iframe. Google operates under its own privacy policy.

We do NOT sell, rent, trade, or commercially exploit personal information to third parties.

7. International Data Transfers

Where third-party service providers process data outside the United Kingdom, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or standard contractual clauses approved under UK data protection law.

8. Security and Incident Management

We implement technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, or disclosure. All data transmissions across kaltova.info are encrypted using modern Transport Layer Security (TLS/HTTPS).

In the event of a personal data breach that presents a risk to individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware, and notify affected data subjects without undue delay where required by law.

9. Children's Privacy

Our website is directed at an adult audience (adults over 40) and is not intended for children under 16. We do not knowingly collect personal data from children. If a parent or guardian believes a child has provided us with personal information, please contact us for immediate removal.

10. Complaints & Supervisory Authority

If you have any questions or concerns about how we handle your data, please contact us first so we can resolve the matter. You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · Website: ico.org.uk

11. Contact Details

Kaltova
43 Lister Gate, Nottingham NG1 1AA, United Kingdom
Email: [email protected]
Telephone: 0115 946 1313 (Mon–Fri 9:00 AM – 5:00 PM GMT)