Privacy Policy

8. Scope of this policy

This policy applies to information collected through the public pages of kaltova.info, including the contact form, newsletter form, cookie controls and ordinary hosting logs. It does not apply to websites reached through external links, which have their own notices and operating arrangements.

We do not ask visitors to submit special category information through the forms. Please avoid including account credentials, detailed personal histories or information about another person in a general enquiry.

• a) Public browsing is not conditional on newsletter subscription.
• b) Required form fields are limited to what is needed to respond.
• c) We may redact unnecessary personal details from correspondence.

9. Concrete retention approach

Our usual retention schedule is designed to remove information when it is no longer needed. Contact messages are reviewed after 24 months, newsletter suppression records after 12 months, and security logs after 90 days, unless a longer period is needed for a documented legal or security reason.

Backups may contain records for a short additional period while they cycle out of the hosting system. We do not restore deleted information merely to retain it, and access to older backups is restricted to authorised operational personnel.

• a) A request may be logged with a reference number.
• b) Duplicates may be removed before a deletion review.
• c) Retention extensions are recorded with a reason and review date.

10. Rights and request procedure

To exercise a relevant UK data protection right, email [email protected] or write to Kaltova Health Ltd, 43 Lister Gate, Nottingham NG1 1AA. Tell us whether you seek access, correction, deletion, restriction, objection or portability, and identify the email address or correspondence concerned.

We normally acknowledge a request within five working days and respond within one calendar month. A complex request may take longer where the law permits; if so, we will explain the extension before the first month ends and may ask for proportionate identity confirmation.

11. Named service categories and transfers

Kaltova may use a web host, transactional email provider, form delivery service, security layer and privacy-management tool. These providers act on instructions, receive only the information needed for their function and are expected to maintain suitable confidentiality and security arrangements.

Some infrastructure may process information outside the United Kingdom. Where that occurs, we use an adequacy decision, approved contractual safeguards or another lawful transfer mechanism applicable at the time, and we assess the provider's technical and organisational measures.

12. Security and incident response

Access to submitted information is limited by role, credentials and operational need. We use ordinary measures such as encrypted connections, provider access controls, update management and restricted administration, while recognising that no internet transmission can remove every technical risk.

If a personal data incident occurs, we will assess its nature, scope and likely effect. Where UK law requires notification to the Information Commissioner's Office, we aim to make that notification within 72 hours of becoming aware of the reportable breach, and we will contact affected people where the applicable threshold is met.

13. Children and automated activity

The site is written for adults and is not directed at children under 13. We do not knowingly request personal information from children, and a parent or guardian may contact us if they believe a child has submitted information.

Kaltova does not use personal information for solely automated decisions producing legal or similarly significant effects. We may use basic technical filtering to reduce spam or protect forms, but editorial enquiries are reviewed by people.

14. Complaints and revision history

Concerns should first be sent to [email protected]. We aim to acknowledge privacy concerns within five working days and provide a substantive response within one calendar month, subject to reasonable verification and any permitted extension.

You may also contact the Information Commissioner's Office if you remain concerned. This policy was reviewed on 9 September 2026; that revision added clearer retention periods, service categories, transfer safeguards and incident-response timings.

10. Scope in practical terms

This policy covers information received through the contact form, newsletter sign-up, cookie controls and ordinary hosting logs on kaltova.info. It does not govern external websites reached through links, embedded services operating under their own notices or information that a visitor submits directly to another organisation.

We ask visitors not to include unnecessary sensitive details in an ordinary enquiry. If such information is received, it may be restricted, redacted or deleted when it is no longer needed for the stated purpose.

• a) Browsing public articles does not require an account.
• b) Newsletter subscription is optional and separate from contact enquiries.
• c) We may retain a suppression record after an unsubscribe to respect that choice.

11. Concrete retention schedule

Contact correspondence is normally reviewed 24 months after the last meaningful exchange. Newsletter subscription records remain while the subscription is active, and suppression information may remain for 12 months after unsubscribe; security logs are ordinarily retained for 90 days.

Records may be retained longer where needed to establish, exercise or defend a legal position, investigate a security event or comply with a lawful request. Such extensions should have a documented reason and review point rather than remaining open-ended.

12. Rights and identity checks

To request access, correction, deletion, restriction, objection or portability where applicable, email [email protected] or write to Kaltova Health Ltd, 43 Lister Gate, Nottingham NG1 1AA. Identify the relevant email address, page or correspondence and state the right you wish to exercise.

We aim to acknowledge a request within five working days and respond within one calendar month. For complex or multiple requests, an extension may be available under UK data protection law; if used, we will explain it before the first month ends and request proportionate identity confirmation.

13. Service providers and international transfers

Relevant service categories may include website hosting, email delivery, form processing, security monitoring, consent management and map or font delivery. A provider receives only the information needed for its function and is expected to act under written instructions and suitable confidentiality controls.

Some infrastructure may process information outside the United Kingdom. Where applicable, Kaltova relies on an adequacy decision, international data transfer agreement, approved contractual safeguards or another lawful mechanism, with a proportionate review of technical and organisational measures.

14. Data protection review and breach response

Before introducing a processing activity that is likely to create a high risk to individuals, Kaltova will consider whether a Data Protection Impact Assessment is appropriate. The review considers purpose, necessity, proportionality, risks and measures that reduce those risks.

If a personal data incident is reported, we assess its scope, records involved and likely effect. Where UK law requires notification to the Information Commissioner's Office, we aim to notify within 72 hours of becoming aware of a reportable breach and will contact affected people where the applicable legal threshold is met.

15. Children and automated decision-making

The site is written for adults and is not directed at children under 13. We do not knowingly request information from children, and a parent or guardian can contact us if they believe a child has submitted information.

Kaltova does not use personal information for solely automated decisions producing legal or similarly significant effects. Basic technical filtering may reduce spam or protect forms, but editorial enquiries are reviewed by people.

16. Complaints and change log

Privacy concerns should first be sent to [email protected]. We aim to acknowledge them within five working days and provide a substantive response within one calendar month, subject to reasonable verification and any permitted extension.

You may contact the Information Commissioner's Office if your concern remains unresolved. This policy was reviewed on 9 September 2026; that entry added clearer retention periods, processor categories, transfer safeguards, impact-assessment criteria and incident-response timings.