Kantis — Privacy Policy

Last updated: October 2026

1. Who we are

Kantis ("Kantis," "we," "us," or "our") operates an AI-native compliance automation platform that helps B2B organisations achieve and maintain compliance with ISO 27001, UK GDPR, EU GDPR, SOC 2, and the EU AI Act. We provide automated evidence collection, AI-assisted policy generation, control mapping, and managed expert guidance.

Data controller contact details:

We Make Tech Ltd trading as Kantis
Company number: 16031474
Office 38, Area 1/1 60 Tottenham Court Road, Fitzrovia, London, United Kingdom, W1T 2EW
Email: support@getkantis.com
Web: https://www.getkantis.com

For all data protection enquiries, data subject rights requests, or complaints, please contact: support@getkantis.com

2. Scope of this Privacy Policy

2.1 This Privacy Policy explains how Kantis collects, uses, stores, shares, and protects personal data in connection with our website (https://www.getkantis.com), our Platform, and our Managed Services.

2.2 This Privacy Policy applies to the personal data of:

• Visitors to our website
• Prospective customers and business contacts
• Customers and their Authorised Users who access the Platform
• Individuals whose personal data is processed through the Platform on behalf of our customers (e.g., customer employees)
• People we contact about investing in Kantis, and people who introduce us to investors (see Section 13)

2.3 Our dual role — Data Controller and Data Processor. Kantis acts in two distinct capacities depending on the type of personal data involved:

2.4 Where Kantis acts as a Data Processor, our customers are responsible for ensuring there is a lawful basis for the processing and for informing their own employees and data subjects about the processing. If you are an individual whose data has been processed by Kantis on behalf of one of our customers, please direct any data protection enquiries to that customer in the first instance.

2.5 This Privacy Policy is intended to comply with both the UK General Data Protection Regulation (the "UK GDPR," being the EU GDPR as retained in UK law by the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019) and the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "EU GDPR"). Where we refer to "GDPR" without qualification, we mean both the UK GDPR and the EU GDPR as applicable.

3. What data we collect

We collect and process the following categories of personal data:

3.1 Account data (Controller)

When you register for the Platform or contact us, we collect:

• Full name
• Email address
• Company name
• Job title

This data is provided directly by you and is necessary for us to create and manage your account, communicate with you, and provide the Services.

3.2 Usage data (Controller)

We automatically collect data about how you interact with the Platform, including:

• Platform interactions: pages visited, features used, buttons clicked, time spent on pages
• Log data: IP address, browser type and version, operating system, device type, language preferences
• Performance data: page load times, errors encountered, session duration

This data helps us operate, maintain, and improve the Platform and to identify and resolve issues.

3.3 Infrastructure credentials and cloud configuration data (Processor)

To perform automated compliance checks and evidence collection, we may collect and process:

• Cloud provider access tokens (e.g., AWS, GCP, Azure access keys or OAuth tokens)
• API keys for third-party services integrated by the customer
• Cloud infrastructure configuration data (e.g., security group settings, IAM policies, encryption configurations, logging configurations)

This data is collected at the instruction of and on behalf of our customers to deliver the Services. Kantis acts as a Data Processor for this data. Access credentials are stored using encryption at rest and in transit, and are used only to perform read-level access to retrieve configuration metadata and evidence. We do not access the underlying data stored in customer cloud environments (e.g., database contents, storage bucket files) unless explicitly required to assess a specific compliance control and authorised by the customer.

3.4 Customer employee data (Processor)

As part of compliance control mapping (e.g., access control reviews, joiner/mover/leaver processes, security awareness training tracking for ISO 27001), we may process personal data about our customer's employees and contractors, including:

• Names and email addresses
• Job titles and roles
• Department and team information
• System access levels and permissions
• Security training completion status
• Employment start and end dates (relevant to access control lifecycle)

This data is provided to us by our customers or retrieved through authorised integrations with customer identity providers and HR systems. Kantis acts as a Data Processor for this data. We process it only to provide the Services and in accordance with our customer's instructions. Our customers are the Data Controllers and are responsible for providing notice to their employees and for establishing a lawful basis for the processing.

3.5 Audit evidence (Processor)

Customers may upload or the Platform may automatically collect audit evidence, including:

• Screenshots of system configurations
• Configuration exports and technical reports
• Policy documents and procedural documentation
• Access review records and approval logs

To the extent this evidence contains personal data, Kantis processes it as a Data Processor on behalf of the customer.

3.6 Communications data (Controller)

Through our Managed Services and general business interactions, we may collect:

• Email correspondence between Customer and Kantis personnel
• Meeting notes and summaries from advisory sessions
• Records of support requests and responses

We process this data as a Data Controller for the purposes of delivering the Services, maintaining records of advice given, and improving our service quality.

3.7 Billing data (Controller)

Payment processing is handled by our third-party payment processor, Stripe. Kantis does not directly collect, store, or process credit card numbers, bank account details, or other payment instrument data. We receive from Stripe only:

• Transaction records (amounts, dates, invoice numbers)
• Billing contact information (name, email, company)
• Payment status (successful, failed, refunded)

Stripe's processing of your payment data is governed by Stripe's Privacy Policy.

3.8 Marketing and website data (Controller)

If you visit our website, subscribe to our newsletter, or interact with our marketing content, we may collect:

• Contact information you provide (name, email, company)
• Appointment details you provide when booking a meeting, including scheduling preferences and information submitted through our qualification form
• Cookie data and tracking information from optional analytics tools, where you have consented (see Section 12)
• Cookieless aggregate website analytics, such as page views, referrers, device type, country-level location, and performance information
• Limited cookieless advertising measurement data, such as website, device, and campaign interaction information on selected campaign pages (see Section 12)
• Referral source data (how you found us)

3.9 Booking requests on our website (Controller)

When you click a button on our website to book a call, we show a short form before the calendar. We save what you enter as you type it, before you pick a time, so we can follow up if you don't finish booking:

• Your details: work email, name and company website
• Optional details: anything you write in the notes field and how you heard about Kantis
• Context: the page you booked from, its language, and the campaign or website that sent you (for example an ad or a search engine)

We use this only to arrange the call and to follow up about your request by email, and we stop following up as soon as you ask. We store it in Airtable, our CRM, and the Kantis founder handling your request gets a short notification through Telegram. The form is processed by our website host, Vercel, in Frankfurt, Germany. Our lawful basis is legitimate interests (Section 5.2). You can ask us to delete this data or to stop contacting you at any time by emailing support@getkantis.com (Section 9). We keep it for the period set out for marketing and website data in Section 8.

3.10 Referrals through our website (Controller)

Anyone can introduce a company to us through our referral page (getkantis.com/refer). When they do, we receive:

• About the person introducing: their name and email address
• About the person being introduced: their name, work email, and optionally their company website and a short note on why the introduction may be useful

We ask the person introducing to tell you about it first. We use your details only to contact you once about this introduction, mentioning who introduced you, and to follow up if you reply. If you are the person introducing, we use your details to say thank you and to keep a record of who referred whom. We store this data in Airtable, our CRM, and the Kantis founder handling it gets a short notification through Telegram. The form is processed by our website host, Vercel, in Frankfurt, Germany. Our lawful basis is legitimate interests (Section 5.2). If you were introduced and don't want to hear from us, reply "no" or email support@getkantis.com and we will stop and delete your details (Section 9). We keep this data for the period set out for marketing and website data in Section 8.

4. How we use your data

We use personal data for the following purposes:

5. Legal bases for processing under UK GDPR and EU GDPR

We rely on the following legal bases under both the UK GDPR and the EU GDPR:

5.1 Contractual necessity (Article 6(1)(b)). We process personal data where it is necessary for the performance of a contract with you or your organisation, or to take steps at your request prior to entering into a contract. This applies to:

• Account creation and management
• Providing the Platform and Managed Services
• Processing infrastructure credentials and cloud configuration data to perform compliance checks on your behalf
• Processing customer employee data for compliance control mapping (e.g., access reviews, joiner/mover/leaver processes)
• Billing and payment processing

5.2 Legitimate interests (Article 6(1)(f)). We process personal data where it is necessary for our legitimate interests (or those of a third party) and those interests are not overridden by your rights and freedoms. We have conducted a balancing assessment for each of the following legitimate interests:

• Maintaining and improving the Platform: We analyse usage patterns and platform performance data to identify issues, develop new features, and improve the user experience. We consider this proportionate because we use only usage metadata and aggregated data, not individual customer content.
• Security and fraud prevention: We monitor for suspicious activity, potential threats, and unauthorised access to protect our Platform, our customers, and their data.
• Business communications: We process contact information to respond to enquiries, provide support, and maintain business relationships.
• Booking requests: We save the details you enter in our website booking form so we can arrange the call and follow up if you don't finish booking (Section 3.9). We consider this proportionate because you started the request, we use the data only for that request, and we stop as soon as you object.
• Referrals: When someone introduces you to us through our referral page, we contact you once about that introduction (Section 3.10). We consider this proportionate because someone you know made the introduction and told you about it, we use the data only for that introduction, and we stop as soon as you object.
• Marketing to existing customers: We may send information about relevant products and services to existing customers (subject to your right to opt out at any time).
• Investor outreach: We contact people who may want to invest in Kantis, as described in Section 13. We consider this proportionate because we only contact people who publicly invest in startups, we limit how many follow-ups we send, and we stop as soon as you object.

You have the right to object to processing based on legitimate interests. See Section 9 for details.

5.3 Consent (Article 6(1)(a)). Where required, we obtain your consent before processing personal data, particularly for:

• Marketing communications to prospective customers
• Non-essential cookies and tracking technologies

You may withdraw your consent at any time by contacting support@getkantis.com or using the unsubscribe mechanism in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5.4 Legal obligation (Article 6(1)(c)). We process personal data where necessary to comply with a legal obligation to which we are subject, including tax reporting, regulatory requirements, and responding to lawful requests from authorities.

6. Data sharing and sub-processors

6.1 We do not sell personal data. We share personal data only in the circumstances described below.

6.2 Sub-processors. We use a limited number of third-party service providers ("Sub-processors") who process personal data on our behalf to support the delivery of the Services. Our Sub-processors include providers of:

• Cloud hosting and infrastructure (Vercel)
• Payment processing (Stripe)
• Analytics and product improvement (PostHog, Vercel Analytics)
• Email and communications (Brevo, formerly Sendinblue)
• Scheduling and meeting booking (Cal.com)
• Customer and investor relationship management (Airtable)
• Internal notifications about booking requests (Telegram)
• AI model providers (for AI-assisted features — see Section 6.5)

We maintain contracts with each Sub-processor that impose data protection obligations materially equivalent to those set out in this Privacy Policy and in accordance with Article 28 of the UK GDPR and EU GDPR. An up-to-date list of our Sub-processors is available on request by emailing support@getkantis.com. We will notify customers of any material changes to our Sub-processor list and provide an opportunity to object.

6.3 Professional advisers. We may share personal data with our legal, accounting, and other professional advisers where necessary for the provision of their services.

6.4 Law enforcement and regulators. We may disclose personal data where required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, the rights of others, or to prevent harm.

6.5 AI and machine learning. Certain features of the Platform use artificial intelligence and machine learning models. Where AI features process personal data:

• Customer Data (including infrastructure credentials and customer employee data) is not used to train general-purpose AI or machine learning models.
• We may use aggregated, anonymised usage data and Feedback (as defined in our Terms of Service) to improve our AI features.
• Where we use third-party AI model providers, such providers act as Sub-processors and are subject to the same data protection requirements described in Section 6.2.

6.6 Customer-authorised applications and AI assistants. Customers and their authorised users may connect third-party applications — including AI assistants such as Claude or ChatGPT — to the Services, for example through our API or our MCP server. Where a user authorises such a connection:

• Access is granted through the user's own sign-in (OAuth), is limited to the data that user's role in the customer's organisation allows, and is re-checked on every request.
• Every connection and the access it enables are recorded in the customer's audit trail, and connections are time-limited and can be revoked at any time by the user or by the customer's administrators in the product settings.
• The third-party provider receiving the data is chosen and engaged by the customer (or its authorised user) under the customer's own agreement with that provider. It acts on the customer's instruction and is not a Kantis Sub-processor, and Section 6.2 does not apply to it.

6.7 Business transfers. In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, personal data may be transferred to the successor entity. We will notify you of any such transfer and any changes to the applicable privacy practices.

7. International data transfers

7.1 Kantis is based in the United Kingdom. Our customers are primarily located in the United Kingdom, the European Economic Area ("EEA"), and Japan.

7.2 UK to EEA transfers. The United Kingdom has recognised the EEA as providing an adequate level of data protection, and the European Commission has adopted an adequacy decision for the United Kingdom under Article 45 of the EU GDPR. Accordingly, transfers of personal data between the UK and EEA do not require additional safeguards.

7.3 Transfers to Japan. Both the European Commission and the United Kingdom have adopted adequacy decisions recognising Japan as providing an adequate level of data protection. Accordingly, transfers of personal data to Japan do not require additional safeguards beyond those provided under the adequacy framework.

7.4 Transfers outside the UK and EEA. Where we transfer personal data to countries outside the UK and EEA that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards in accordance with the UK GDPR and EU GDPR, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) of the EU GDPR
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as approved by the UK Information Commissioner's Office under Section 119A of the Data Protection Act 2018
• Supplementary measures where necessary, following a transfer impact assessment

7.5 Our primary infrastructure is hosted in Frankfurt, Germany (EU) and Tokyo, Japan. Some of our service providers store personal data outside the UK, EEA and Japan. For example, Airtable, our CRM, stores data in the United States. For these transfers we rely on one of the safeguards in Section 7.4. For Airtable, that is the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, which form part of Airtable's data processing addendum.

8. Data retention

8.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our specific retention periods are as follows:

8.2 When personal data is no longer required, we will securely delete or anonymise it. Where immediate deletion is not technically feasible (e.g., data in backup archives), we will isolate the data and protect it from further processing until deletion is possible.

9. Your rights under UK GDPR and EU GDPR

9.1 Under both the UK GDPR and the EU GDPR, you have the following rights in relation to your personal data (subject to certain conditions and exceptions):

Right of access (Article 15). You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data together with information about the processing.

Right to rectification (Article 16). You have the right to request correction of inaccurate personal data and completion of incomplete personal data.

Right to erasure (Article 17). You have the right to request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing and there are no overriding legitimate grounds.

Right to restriction of processing (Article 18). You have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.

Right to data portability (Article 20). You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where the processing is based on consent or contractual necessity and is carried out by automated means.

Right to object (Article 21). You have the right to object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims. You have an absolute right to object to processing for direct marketing purposes at any time.

Right to withdraw consent. Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Right not to be subject to automated decision-making (Article 22). You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Kantis does not currently make decisions based solely on automated processing that produce legal or similarly significant effects.

9.2 How to exercise your rights. To exercise any of these rights, please contact us at support@getkantis.com. We will respond to your request within one (1) month. In certain circumstances, we may extend this period by up to two (2) additional months, in which case we will inform you of the extension and the reasons for it. We may ask you to verify your identity before acting on your request.

9.3 Right to lodge a complaint. If you are not satisfied with our response to your data protection enquiry, or if you believe that we are processing your personal data in violation of applicable data protection law, you have the right to lodge a complaint with a supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Website: https://ico.org.uk. Telephone: 0303 123 1113.
• European Union: You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. A list of EU supervisory authorities is available at https://edpb.europa.eu.

10. Security measures

10.1 We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, loss, misuse, alteration, or destruction. Our security measures include:

• Encryption: All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent encryption. Infrastructure credentials and cloud tokens are subject to additional encryption and access controls.
• Access controls: Access to personal data is restricted to authorised Kantis personnel on a need-to-know basis. We enforce multi-factor authentication and least-privilege access principles.
• Infrastructure security: The Platform is hosted on secure cloud infrastructure in Frankfurt, Germany (EU) and Tokyo, Japan, with firewalls, intrusion detection, and regular vulnerability assessments.
• Monitoring and logging: We maintain audit logs of access to the Platform and Customer Data, and we monitor for suspicious activity.
• Employee obligations: All Kantis personnel with access to personal data are subject to contractual confidentiality obligations and receive data protection training.
• Incident response: We maintain an incident response plan and will notify affected customers and supervisory authorities of qualifying personal data breaches in accordance with Articles 33 and 34 of the UK GDPR and EU GDPR.
• Regular review: We regularly review and update our security measures in line with industry best practices and the requirements of ISO 27001.

10.2 While we implement strong security measures, no system is completely secure. We cannot guarantee the absolute security of personal data. If you become aware of any security vulnerability or incident affecting the Services, please contact us immediately at support@getkantis.com.

11. Data Processing Agreement

11.1 Where Kantis processes personal data on behalf of a customer as a Data Processor (as described in Section 2.3), the Kantis Data Processing Agreement ("DPA") applies and is incorporated into Kantis's Terms of Service by reference. It is deemed accepted by the customer upon first use of the Services. The DPA meets the requirements of Article 28 of the UK GDPR and EU GDPR.

11.2 The DPA covers, among other things:

• The subject matter, duration, nature, and purpose of the processing
• The types of personal data and categories of data subjects
• The obligations and rights of the Data Controller (customer) and Data Processor (Kantis)
• Sub-processor management, including 30-day prior notification of changes and objection rights
• Technical and organisational security measures (Schedule 2 of the DPA)
• Data subject rights assistance
• Security incident notification to Customer within 48 hours
• Data deletion or return upon termination
• Annual audit rights

11.3 Where Customer Data includes personal data of individuals located in the EEA, the DPA incorporates the EU Standard Contractual Clauses (Module 2: Controller to Processor). Where Customer Data includes personal data of individuals located in the United Kingdom, the DPA incorporates the UK International Data Transfer Addendum to the EU SCCs. See the full DPA for details.

12. Cookies and tracking technologies

12.1 Our website uses a small number of cookies and similar technologies. We use Vercel Analytics and Speed Insights for cookieless, aggregate website and performance statistics. These tools help us understand overall traffic patterns without setting analytics cookies. On our ISO 27001 campaign pages (/iso-27001-for-small-teams and /iso-27001-for-us-startups) and our booking page (/book), we also use PostHog in cookieless mode if you have not accepted optional analytics, to understand how visitors from our advertising use these pages (for example which sections they view and whether they open the booking form or calendar). In this mode PostHog stores nothing on your device and records no sessions; it counts visits using a hash of your IP address and browser user agent that PostHog computes on its servers with a salt that changes daily, and the IP address is not stored. We rely on our legitimate interests (Article 6(1)(f)) in measuring our advertising; you can object at any time (Section 9).

12.2 We use the following types of cookies:

• Strictly necessary cookies: Required for the website to function and cannot be disabled. These include session cookies and security cookies.
• Cookie consent preference: Used to remember whether you accepted or rejected optional analytics and advertising measurement technologies.
• Language preference: If you choose a language with the language switcher, a first-party cookie (kantis_locale, 12 months) remembers it so the website opens in that language next time. On your first visit, our hosting provider uses the country derived from your IP address at the time of the request to show the website in your language; this country is not stored.
• Optional analytics cookies: Help us understand how visitors interact with our website. We use PostHog for this purpose, and it only sets cookies or uses browser storage if you accept optional analytics cookies (see 12.1 for the pages measured without cookies).
• Advertising measurement technologies: For advertising in ChatGPT, we use the OpenAI (ChatGPT Ads) measurement pixel only after you accept optional technologies, to measure whether a ChatGPT ad led to a booked call. It sets the first-party cookies __oppref (30 days) and __obref (365 days), and __oaiq_consent to remember your choice.

12.3 Apart from the cookieless measurement on the pages described in 12.1, PostHog is disabled by default and only runs after you accept optional analytics. The OpenAI (ChatGPT Ads) measurement pixel does not load unless you accept, and rejecting later stops it and removes its cookies. Rejecting optional technologies does not prevent you from using the website or booking a meeting.

12.4 You can accept, reject, or change your cookie preferences through the cookie banner or the Cookie settings link in the website footer. You may also withdraw your consent by clearing your browser cookies, after which the consent banner will reappear.

13. Investor outreach and fundraising contacts

13.1 What this section covers. Kantis is raising investment. This section explains how we use personal data about people we contact, or plan to contact, about investing in Kantis. This includes angel investors, people at funds and syndicates, and people who introduce us to investors. We are the Data Controller for this data.

13.2 What data we use.

• Your name, your role, and the company or fund you work with
• Your LinkedIn profile URL and what your public profile shows
• Public shareholder information from Companies House filings, such as your name and the companies you hold shares in
• Your attendee profile on event platforms, such as the Slush or Web Summit apps
• Your public reactions and comments on our LinkedIn posts
• Contact details you have made public for business use or given to us, such as an email address
• Our notes on why you may be interested, and a record of our messages with you
• If you open our pitch deck from a link we send, the email address you enter and which pages you viewed

We do not collect special category data, such as health data or political opinions.

13.3 Where we get it.

• The Companies House public register
• LinkedIn
• Event platforms, such as the Slush and Web Summit apps
• News articles and public startup databases that name a company's investors
• People who introduce us to you
• You, when you reply to us or meet us

If you want to know where we found your details, ask us and we will tell you.

13.4 Why we use it. To contact you one to one about investing in Kantis, to follow up on our conversation, and to keep a record of who we have spoken to. We usually write by LinkedIn message, through an event app, or by email. If we contact you without an introduction and you do not reply, we send at most five follow-ups and then stop. We may send you our investor updates by email through Brevo. Every update has an unsubscribe link.

13.5 Lawful basis. We rely on legitimate interests (Article 6(1)(f)). Our interest is raising investment for Kantis from people who are likely to want to hear about early-stage companies. We only contact people with a public sign that they invest in startups, such as shares in other startups, an investor profile, or an investor listing at an event. Given these limits and your right to object at any time, we have concluded that our interest does not override your rights.

13.6 How long we keep it. We keep your details while we are raising investment, or while we may want to talk to you about a future round. We review our list at least once a year and delete the records we no longer need. If you ask us to delete your details, we do it straight away. If you invest in Kantis, we keep the records that company law requires.

13.7 Your right to object. You can object at any time, and you do not need to give a reason. Reply "no" to any message from us, or email support@getkantis.com. We stop straight away and delete your details. We keep only your name and profile link, marked "do not contact" in our CRM, and if we have emailed you, your email address on Brevo's blocklist. This is so that we never contact you again. Your other rights in Section 9 also apply.

13.8 Who has access. Only Kantis staff working on fundraising. We keep this data in Airtable, our CRM, and send investor updates through Brevo (see Section 6.2). We also use service providers that help us send messages and share our pitch deck. Airtable stores data in the United States; Section 7.5 explains how we protect this transfer. We do not sell this data or share it with anyone for their own use.

13.9 Questions. Email support@getkantis.com or reply to our message.

14. Children's data

The Services are not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.

15. Changes to this Privacy Policy

15.1 We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. We will post the updated Privacy Policy on our website and update the "Last updated" date at the top of this page.

15.2 Where changes are material, we will provide you with reasonable notice, such as by email or through a prominent notice on the Platform, before the changes take effect.

15.3 We encourage you to review this Privacy Policy periodically for any changes.

16. Contact us

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data protection rights, please contact us:

We Make Tech Ltd trading as Kantis
Company number: 16031474
Office 38, Area 1/1 60 Tottenham Court Road, Fitzrovia, London, United Kingdom, W1T 2EW
Email: support@getkantis.com
Web: https://www.getkantis.com

For complaints, you may also contact the UK Information Commissioner's Office (ICO) at https://ico.org.uk.