1.Who we are and our role
Kindal is operated by Demy Corp Ltd, company number 16497991, registered at 29 Coppice Wood Grove, Guiseley, Leeds, England, LS20 9JU (we, us or Kindal).
For account, website and commercial relationship data, we are the data controller. When an employer uses Kindal for workforce administration, that employer is normally the controller of employee data and we process it on the employer's documented instructions. Employees should usually direct workplace-data requests to their employer.
2.Personal data we collect
Depending on how you use Kindal, we may process:
- identity and contact details, including name, work email, profile image and login identifiers;
- employment data such as role, department, start date, manager, leave, onboarding tasks and emergency contacts;
- documents and information uploaded or requested through the service, which may contain sensitive personal data;
- account, subscription, support and communication records;
- technical and usage data, including IP address, browser details, timestamps, audit events and diagnostic logs; and
- information supplied by your employer, an authorised user, Google sign-in or an integration you connect.
3.How and why we use data
We use data to provide and secure Kindal; authenticate users; manage people, leave, tasks, onboarding and documents; send service messages; provide support; maintain audit records; improve reliability; prevent misuse; administer subscriptions; and comply with law.
Where we act as controller, our legal bases may include contract, legal obligation, consent, and legitimate interests in operating and protecting the service. Employers are responsible for identifying a valid basis and any additional condition for sensitive workforce data. We do not sell personal data or use workforce data for third-party advertising.
5.International transfers
Where data is processed outside the United Kingdom, we use safeguards required by applicable law, which may include UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, plus supplementary protections where appropriate.
6.Retention
Customer content is retained for the subscription term and deleted or returned according to the customer's instructions and our agreement, subject to backups and legal obligations. Account, billing, audit and security records are kept only as long as reasonably necessary for their purpose, disputes, fraud prevention and compliance.
After deletion, residual backup copies are isolated from ordinary use and removed on the applicable backup cycle.
7.Security
We use proportionate controls including encryption in transit, access controls, private data stores, secret management, logging, backups and least-privilege permissions. No online system is risk-free. Customers must protect credentials, manage user access promptly and report suspected compromise.
8.Your rights
Subject to law, you may request access, correction, deletion, restriction or portability; object to processing; and withdraw consent without affecting earlier processing. We may verify your identity. For employer workspace data, we may refer the request to that employer as controller.
You may complain to the UK Information Commissioner's Office at ico.org.uk.
10.Changes and contact
We may update this policy as the service or law changes. We will publish the revised date and give reasonable additional notice for material changes.
For questions or rights requests, email info@imortol.com or write to Demy Corp Ltd, 29 Coppice Wood Grove, Guiseley, Leeds, England, LS20 9JU. If your request concerns an employer workspace, identify the employer and use your account email.