GDPR compliance

At KPilot, we are committed to ensuring the privacy and protection of your personal data in compliance with the General Data Protection Regulation (GDPR). This page outlines our approach to GDPR compliance and your rights under this regulation.

Our commitment to GDPR compliance

We have implemented comprehensive measures to ensure compliance with GDPR principles, including:

• Lawfulness, fairness, and transparency in data processing
• Purpose limitation (collecting data for specified, explicit, and legitimate purposes)
• Data minimization (collecting only what is necessary)
• Accuracy of personal data
• Storage limitation (keeping data only as long as necessary)
• Integrity and confidentiality (ensuring appropriate security)
• Accountability (taking responsibility for how we handle personal data)

Legal basis for processing

Under GDPR, we process personal data on one or more of the following legal bases:

• Consent: Where you have given clear consent for us to process your personal data for a specific purpose.
• Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legal obligation: Where processing is necessary for compliance with a legal obligation to which we are subject.
• Legitimate interests: Where processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your interests, rights, or freedoms.

Your rights under GDPR

The GDPR provides the following rights for individuals:

• Right to be informed: You have the right to be informed about the collection and use of your personal data.
• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to have inaccurate personal data rectified, or completed if it is incomplete.
• Right to erasure: You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing.
• Right to restrict processing: You have the right to request the restriction or suppression of your personal data.
• Right to data portability: You have the right to obtain and reuse your personal data for your own purposes across different services.
• Right to object: You have the right to object to the processing of your personal data in certain circumstances.
• Rights related to automated decision making and profiling: You have rights related to automated decision making and profiling.

Data protection officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact our DPO using the details set out below.

Data Protection Officer
KPilot, Inc.
Email: dpo@kpilot.com

International data transfers

We are based in the United States and may transfer your personal data to countries outside the European Economic Area (EEA). Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards, such as:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules
• Approved certification mechanisms

Data breach notification

In the event of a personal data breach, we will notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

If the breach is likely to result in a high risk to the rights and freedoms of natural persons, we will also notify the affected individuals without undue delay.

Data protection impact assessment

We carry out Data Protection Impact Assessments (DPIAs) for processing that is likely to result in a high risk to individuals, particularly when using new technologies.

Records of processing activities

We maintain records of our processing activities, including:

• Name and contact details of our organization
• Purposes of the processing
• Description of categories of individuals and personal data
• Categories of recipients of personal data
• Details of transfers to third countries and the safeguards in place
• Retention schedules
• Description of technical and organizational security measures

How to exercise your rights

To exercise any of your rights under GDPR, please contact our Data Protection Officer using the contact details provided above. We will respond to your request within one month.

You will not have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Complaints

You have the right to make a complaint at any time to the supervisory authority for data protection issues in your country. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us in the first instance.