Commitment to Zero Unauthorized Data Monetization
Kiko.one operates on a clear B2B subscription model. We do not sell, rent, or trade your organization’s customer or employee data to advertisers or third-party data brokers under any circumstances.
01Overview & Scope
This Privacy Policy describes how Kiko.one, Inc. ("Kiko", "we", "us", or "our") collects, processes, and protects personal and organizational data when you access or use our website (kiko.one), our unified HRMS, Sales CRM, and work coordination modules, mobile applications, APIs, or related enterprise services (collectively, the "Services").
Depending on your relationship with Kiko.one, we may act as either a Data Controller or a Data Processor under applicable global data protection regulations, including the European Union General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA:
- Data Controller: For marketing visitors, account administrators, and direct billing representatives who configure and manage customer accounts.
- Data Processor: For customer business data (e.g., employee personnel records, payroll details, sales opportunities, pipeline records, customer contact databases) processed on behalf of our enterprise subscribers.
02Information We Collect
We collect information directly from you, automatically through your interaction with our infrastructure, and through authorized integrations you connect.
Account & Administrator Data
Full names, corporate email addresses, phone numbers, corporate role, tenant workspace domain, and cryptographic credentials required for identity provisioning.
Enterprise Customer Data
Data entered into Kiko HRMS (payroll brackets, leave requests, performance reviews) and Kiko Sales CRM (leads, pipeline transactions, meeting notes, customer email threads).
Usage & Diagnostic Telemetry
IP addresses, browser client fingerprints, platform navigation events, API latency metrics, error stack traces, and session duration to ensure high-performance reliability.
Billing & Transaction Records
Payment card tokens, company tax identification numbers, billing addresses, and invoices. Full primary credit card numbers are handled directly by PCI-DSS Level 1 certified processors.
03Legal Bases for Processing (GDPR Article 6)
For individuals situated within the European Economic Area (EEA), United Kingdom, and Switzerland, our legal bases for processing personal data include:
- Performance of a Contract: Providing, maintaining, and fulfilling our service contract with your enterprise employer or tenant.
- Legitimate Business Interests: Monitoring security anomalies, preventing fraud, improving platform throughput, and supporting enterprise continuity without overriding fundamental individual rights.
- Legal Compliance: Complying with mandatory statutory audits, tax obligations, and regulatory disclosure mandates.
- Consent: Where explicitly provided, such as opting into product update newsletters or voluntary usability research studies.
04How We Use Your Data
We process collected data strictly for the following business operational purposes:
Powering HR attendance calculations, payroll processing, CRM deal pipelines, task assignments, and multi-workspace sync.
Authenticating team members, enforcing Single Sign-On (SAML/SCIM), detecting unauthorized credential access, and maintaining audit logs.
Dispatching urgent security alerts, billing invoices, maintenance downtime notices, and responding to help desk inquiries.
05Third-Party Sub-processors
To provide enterprise-grade reliability, Kiko.one partners with vetted infrastructure sub-processors. Each sub-processor executes an enterprise Data Processing Addendum (DPA) containing standard contractual safeguards:
| Sub-processor | Role / Service | Data Location | Security Certifications |
|---|---|---|---|
| Amazon Web Services (AWS) | Primary Cloud Infrastructure, Databases & Object Storage | US East (N. Virginia), EU (Frankfurt) | SOC 1/2/3, ISO 27001, FedRAMP |
| Cloudflare, Inc. | Edge CDN, WAF, DDoS Mitigation & DNS Resolution | Global Anycast Network | SOC 2 Type II, ISO 27001 |
| Stripe, Inc. | Subscription Billing & Payment Gateway Execution | United States / Global | PCI-DSS Level 1, SOC 1/2 |
| PostHog (Self-Hosted / Cloud) | Product Experience Telemetry & Performance Metrics | EU / US Isolation | SOC 2 Type II, GDPR Compliant |
06International Data Transfers
When data is transferred outside the European Economic Area or Switzerland, Kiko.one implements recognized cross-border transfer mechanisms approved by the European Commission, specifically:
- Standard Contractual Clauses (SCCs): Incorporating the 2021/914 modular EU Standard Contractual Clauses with robust supplemental technical controls.
- EU-U.S. Data Privacy Framework (DPF): Adhering to validated commercial privacy principles for participating cloud service providers.
- EU Regional Data Residency: Enterprise plan subscribers may request dedicated tenant pinning within European data centers upon deployment.
07Data Retention & Deletion
We retain Customer Data for as long as your workspace active subscription persists. Upon contract termination or explicit workspace deletion request:
- Grace Period: Account data enters a 30-day soft-retention state to permit disaster recovery or customer data export in structured JSON/CSV format.
- Permanent Purge: Following the 30-day window, primary customer records are purged from production clusters within 60 days, and subsequent database backup snapshots expire within standard 90-day rotation cycles.
- Statutory Retention: Invoices and transaction receipts are retained for 7 years to satisfy corporate accounting and tax mandates.
08Your Privacy Rights (GDPR & CCPA/CPRA)
Depending on your jurisdiction, you enjoy enforceable statutory rights regarding your personal records:
Note: If your information is stored in Kiko.one on behalf of your employer (the Data Controller), please direct initial access or deletion requests to your company HR administrator.
09Technical & Organizational Safeguards
Kiko.one maintains defense-in-depth architectural safeguards to protect customer data from unauthorized disclosure, destruction, or interception:
- Encryption in Transit: Mandatory TLS 1.3 encryption across all public edge nodes and internal microservice APIs.
- Encryption at Rest: AES-256 encryption applied to all relational database storage volumes, file caches, and snapshot backups.
- Least-Privilege RBAC: Strict role-based access control with time-limited JIT (Just-In-Time) credentials for infrastructure engineers.
- Audit Logging: Tamper-evident logging of administrative actions with continuous SIEM monitoring.
10Contacting Our Data Protection Officer
If you have questions, complaints, or wish to exercise your rights under this Privacy Policy, our legal team and appointed Data Protection Officer can be reached directly at: