Privacy Policy

1. Who we are

Kaspio is a brand owned and operated by The Naela Group Ltd, a company registered in England & Wales under company number 15786719 (“we”, “us”, “our”). Any reference to “Kaspio” in this policy refers to The Naela Group Ltd trading as Kaspio.

For the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, The Naela Group Ltd is the “data controller” responsible for your personal data when you use our website and marketing services. When you use the Kaspio platform as a customer’s employee or contractor, that customer is the controller of the data they upload and we act as their “data processor”.

2. The information we collect

We may collect and process the following categories of personal data:

• Contact & enquiry data — your name, email address, company name and the contents of any message you send us through our contact, free-trial or sign-up forms.
• Account data — details needed to create and manage your Kaspio account, such as your name, email address, role and the organisation you belong to.
• Customer content — the operational data you and your organisation enter into the platform (for example clients, assets, jobs, quotes and invoices). This is processed on your organisation’s behalf.
• Technical data — limited information such as your IP address, browser type and basic security/authentication logs, used to keep the service secure and working.

3. How we use your information

We use personal data to:

• respond to your enquiries and provide the information or quote you request;
• create, secure and administer your account and provide the Kaspio platform;
• send service-related communications (for example sign-up confirmations, invoices, and important account notices);
• operate, maintain, secure and improve our website and services;
• comply with our legal and regulatory obligations.

4. Our lawful bases

We rely on the following lawful bases under the UK GDPR:

• Contract — where processing is necessary to provide the services you or your organisation have asked for.
• Legitimate interests — to run, secure and improve our business, where this is not overridden by your rights.
• Consent — where you have given it, for example certain optional communications. You may withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

5. Sharing your information

We do not sell your personal data. We share it only with trusted service providers who help us run Kaspio, and only as far as needed to deliver the service. These currently include:

• Supabase — secure database, authentication and file storage hosting;
• Vercel — website and application hosting;
• Resend — transactional email delivery;
• Xero — accounting integration, where you choose to connect it;
• professional advisers, and authorities where we are legally required to disclose data.

These providers act under contract and are only permitted to use your data to provide their services to us. Some may process data outside the UK; where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

6. How long we keep it

We keep personal data only for as long as necessary for the purposes set out above, to provide the service, and to meet our legal, accounting or reporting requirements. Enquiry data is typically retained for up to 24 months unless you become a customer. When data is no longer needed it is securely deleted or anonymised.

7. How we protect your data

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the regulator of any breach where required.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data in certain circumstances;
• restrict or object to certain processing;
• request portability of data you have provided to us;
• withdraw consent where we rely on it.

To exercise any of these rights, email hello@kaspio.co.uk. If your data was entered into the platform by an organisation using Kaspio, you may need to contact that organisation directly as the controller of that data.

9. Cookies

Our website uses a small number of cookies. For full details of what we use and why, please see our Cookie Policy.

10. Complaints

If you have a concern about how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “last updated” date at the top of this page. Please check back periodically to stay informed.