Privacy Policy
Version 1.1, effective 5 November 2026 (1.0: 1 November 2026; 1.1 adds the business registers).
1. Who we are
KFBASE LTD, registered in England and Wales, company number 17554532, registered office 5 Hereward Close, Impington CB24 9NH, United Kingdom. Contact for privacy matters: office@kfbase.com. Registration with the Information Commissioner’s Office (ICO): applied for; the number will be added here. EU representative under Article 27 GDPR, for people in the European Union: Michal Kolakowski, Dzielin 7, 06-415 Czernice Borowe, Poland, gdpr-representative@kfbase.com.
2. Two roles: whose data is it?
- Data in a company’s account — its workers, its clients, tasks, photos, messages, hours, absences, quotes and invoices — is controlled by that company (our customer). We process it only on its behalf, under our Data Processing Agreement. If you are a worker or a client of one of our customers, contact that company about your data; we will help it answer you.
- Data about our customers and visitors — who signs in, who buys a plan, who writes to us, who visits kfbase.com — is controlled by us. This policy is mainly about that.
3. What we collect, why, and on what basis
| Data | Purpose | Legal basis (UK/EU GDPR) |
|---|---|---|
| Account: name, e-mail, the Google or Apple account identifier you sign in with, chosen language | Signing in, running your account | Contract (Art. 6(1)(b)) |
| Business details of the customer: company name, time zone, currency, contact e-mail and phone | Providing the Service | Contract |
| Billing: plan, number of licences, Stripe customer and subscription identifiers, payment status | Charging and accounting; card details are handled by Stripe, we never see them | Contract; legal obligation (accounting records) |
| Problem reports and ideas you send in the app, with technical details (app version, page, device) | Fixing problems, improving the Service | Legitimate interests (Art. 6(1)(f)) |
| E-mails you send us | Answering you | Legitimate interests / contract |
| Technical logs: IP address, time, request, errors | Security, preventing abuse, keeping the Service running | Legitimate interests |
| Phone app: push notification token, device model and app version | Sending notifications you expect from the app | Contract |
| Polish business registers (CEIDG, KRS): NIP, business name, registered address, REGON, KRS number and status, including sole traders | Letting our customers fill in a client’s details from its NIP | Legitimate interests (Art. 6(1)(f)) |
We do not sell personal data, do not use it for advertising, and do not use analytics or tracking tools on kfbase.com or in the app. We make no decisions based solely on automated processing, and no profiling, that produce legal or similarly significant effects for you.
Where the data comes from. Mostly from you. Some comes from others: your name and e-mail address from Google or Apple when you sign in with them; your name, e-mail and phone from the company’s owner or administrator who adds you to its business; payment status from Stripe. If you run a business in Poland, its entry in the public registers CEIDG (Centralna Ewidencja i Informacja o Działalności Gospodarczej) and KRS (Krajowy Rejestr Sądowy): we keep a copy of the details listed above, with no phones or e-mail addresses, so that our customers can fill in an invoice to you by typing your NIP. You can object at office@kfbase.com; we then leave your entry out of every later copy.
4. Cookies and similar
- App (firma.kfbase.com): one strictly necessary session cookie to keep you signed in (30 days). Google’s and Apple’s sign-in scripts are loaded only when you click “Sign in with Google” or “Sign in with Apple”; until then nothing is sent to them. The phone app stores its sign-in token on the device (until you sign out or the office disconnects the phone).
- kfbase.com: one cookie remembering the language you chose (no consent needed: it is for a function you use). The site uses your country, as reported by Cloudflare, only to pick the language; it is not stored.
5. Who we share it with
| Provider | What for | Role | Where |
|---|---|---|---|
| Hetzner Online GmbH | The server running the Service and the database | our processor | EU (Germany) |
| Cloudflare, Inc. | Secure connection (HTTPS), website, file storage and backups (stored in the EU), e-mail routing | our processor | EU storage; global network |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments and invoices for plans | processor for our invoicing; independent controller for payment processing, fraud prevention and its legal duties | EU / US |
| Google LLC | “Sign in with Google”; Android push notifications (Firebase) | independent controller for your Google account and sign-in; our processor for notifications | US / global |
| Apple Inc. | “Sign in with Apple”; iPhone push notifications | independent controller for your Apple account and sign-in; our processor for notifications | US / global |
| Expo (650 Industries, Inc.) | Delivering push notifications to the phone app | our processor | US |
| GitHub, Inc. | Problem reports become tickets in our private repository (your message and technical details; your name and e-mail stay with us) | our processor | US |
| Google LLC (Google Workspace) | Business e-mail and communications | our processor | US / global |
The Service and its database are in Germany. Notifications to phones pass through Expo and Google or Apple (US / global): they carry only a short text (for example a task title and the sender’s name) and the device’s token.
When a company connects its own Fakturownia or Xero account, invoice data goes to that provider on the company’s instruction, under the company’s own contract with it.
Transfers outside the UK and the EU. For data from the EU, we rely on the EU–US Data Privacy Framework where the US recipient is certified, and otherwise on the European Commission’s standard contractual clauses. For data from the UK, we rely on the UK Extension to the Data Privacy Framework where the recipient has joined it, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses. You can ask us for a copy of the relevant safeguards.
Business communications. When you write to us, we use your contact details and messages to answer you and to run our business; our e-mail and communication tools are provided by the service providers listed above.
6. How long we keep it
- Account data: while the account exists, then deleted within 30 days of closing it — except the billing records below.
- Billing records (plan, payments, invoices, the company and contact they were issued to): as long as tax and accounting law requires (UK: 6 years after the end of the accounting period).
- Problem reports: 12 months, then deleted.
- E-mails and other correspondence with us: as long as needed to answer and run the business (for example during a contract and the limitation period for claims), reviewed every year.
- Technical logs: deleted automatically as they rotate (at most 30 MB per service, oldest first), which is usually a few weeks.
- Backups: 30 days of history; deleted data disappears from backups within 30 days.
- Demo companies: deleted automatically after a few hours.
- The copy of the business registers: replaced by a new copy about once a month; a business removed from the registers disappears with the next copy.
7. Your rights
You can ask us for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interests. Write to office@kfbase.com (in the European Union you may also write to our representative, gdpr-representative@kfbase.com); we answer within one month. You can also complain to a supervisory authority: in the UK the Information Commissioner’s Office (ico.org.uk), in Poland the Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or the authority where you live or work.
8. Security
Connections are encrypted (HTTPS). Each company’s data is kept separate and access is checked on every request. Secrets such as invoicing tokens are encrypted in the database. Backups are continuous. Our staff may view a company’s data read-only only to resolve problems it reported or to keep the Service secure, in sessions of at most one hour, and such access is logged.
9. Children
The Service is for businesses and is not intended for children under 16.
10. Changes
We will publish changes here and, if they are significant, tell our customers by e-mail or in the Service before they take effect.