Privacy Policy

Who we are

This policy is issued by [Kalplex legal entity], a company registered under number [company number] with its registered office at [registered address] ("Kalplex", "we", "us"). We are the controller of personal data about the businesses that use Kalplex, their users and visitors to our website.

When a business uses Kalplex to manage its own customers, that business is the controller of its customers' data and we process it on its behalf. If you pay a business through Direct Debit, see Information for payers.

Information we collect

• Account details: your email address and a securely hashed password, handled by our authentication provider.
• Business details: your business name, the creditor name shown to your customers and whether you use GoCardless's test or live environment.
• GoCardless credentials: the access token and webhook secret you provide. These are stored only on our servers and are never shown in the browser after you save them.
• Customer records you create: your customers' names and email addresses, and the GoCardless references, mandate status, payment amounts, dates, status and return reasons we receive from GoCardless.
• Technical data: IP address, browser and device information, and server and error logs created when you use the site.
• Communications: messages you send us and our replies.

We do not collect or store bank account details. Payers enter them on GoCardless's secure pages.

How we use it

• to provide Kalplex and carry out your instructions (performance of our contract with you);
• to keep the service secure, prevent fraud and abuse, and fix problems (our legitimate interests);
• to send service messages and respond to support requests (contract and legitimate interests);
• to meet legal, tax and accounting obligations (legal obligation); and
• to send product news if you ask for it, which you can stop at any time (consent).

We do not sell personal data and we do not use it for advertising.

Who we share it with

We use service providers who process data for us under contract:

When you connect GoCardless, we send it the customer and payment instructions needed to collect your payments. GoCardless handles that data as an independent controller under its privacy notice.

We may also share data with professional advisers, with authorities where the law requires it, or with a buyer if our business is sold, in which case this policy will continue to protect it.

International transfers

Some providers may process data outside the European Economic Area or the UK. Where they do, we rely on an adequacy decision or on standard contractual clauses approved by the European Commission or the UK authorities.

How long we keep it

• Account and business details: while your account is open and for up to 6 years after it closes, for legal and tax purposes.
• Customer records: for as long as the business that owns them instructs, and deleted within 30 days of that business closing its account unless the law requires otherwise.
• Server and error logs: up to 90 days.

How we protect it

Data is encrypted in transit. Each business's records are isolated from every other business at the database level. Payment-provider credentials are readable only by our servers, and status updates from GoCardless are accepted only after their signature has been verified. Read more in Security.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to how we use it, to data portability, and to withdraw consent at any time.

To use these rights, contact privacy@kalplex.com. If your data is held by a business that uses Kalplex, contact that business first; we will help it respond.

You can also complain to your data protection authority, although we would appreciate the chance to resolve your concern first.

Changes and contact

We will update this policy when our practices change and show the new date at the top. Significant changes will be announced by email or in the app.

Privacy questions: privacy@kalplex.com. Postal address: [registered address].