Privacy Policy

1. Introduction

Kairos ("we", "our", or "us") is a UK-based managed execution studio that matches vetted talent with startups and SMEs. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website at itskairos.uk (the "Website") and use our services.

This policy is provided so that you can understand our processing before providing personal data. Where processing is optional, we will ask for the relevant choice or consent separately.

2. Who We Are

Kairos is a managed execution studio based in London, United Kingdom. We design and implement operational systems including AI automation, CRM architecture, brand execution, and growth infrastructure for startups and SMEs.

For any questions regarding this Privacy Policy or your personal data, please contact us at: team@itskairos.uk

3. Information We Collect

We collect information in the following ways:

3.1 Information You Provide Directly

When you use our contact form or career application form, we collect:

• Contact Form: Name, email address, phone number (optional), service need, and project description.
• Talent Accounts and Applications: Name, email address, location or time zone, chosen track, skills, availability, requested rate, portfolio or professional profile links, messages, interview transcript if you choose to provide one, and your résumé/CV.
• Business Accounts: Contact and company details, hiring needs, role briefs, budgets, timelines, messages, and optional brief attachments.
• Résumés and AI Extraction: The original file, a cryptographic file fingerprint, structured fields extracted from the résumé, validation and risk flags, model version, review status, and the identity of the authorised reviewer. We ask users not to include unnecessary special-category information in uploaded documents.

3.2 Information Collected Automatically

When you visit our Website, we automatically collect certain information through:

• Google Analytics (GA4): We use Google Analytics to understand how visitors interact with our Website. This may include your IP address (anonymised), browser type, device type, pages visited, time spent on pages, referring URLs, and general geographic location.
• Cookies and Similar Technologies: We use cookies to enhance your experience and gather analytics data. See Section 7 for more details.

4. How We Use Your Information

We use the personal data we collect for the following purposes:

• To respond to enquiries: When you submit a contact form, we use your details to review your request and respond within 24 hours.
• To process applications: When you apply through our careers page, we use your information to assess your suitability for available roles within our builder network.
• To assist résumé review: We use an AI service supplied by Groq to convert résumé text into a structured draft covering matters such as skills, experience, education, projects, and professional links. The draft is validated and reviewed by an authorised person. The AI does not approve, reject, or make the final ranking decision about an applicant.
• To match Talent and Businesses: We use profile and role information to produce deterministic compatibility scores and explain relevant experience. Consequential approval and rejection decisions remain subject to human review.
• To secure the service: We scan uploads for malicious content and maintain security and access audit records.
• To schedule consultations: After form submission, you may be redirected to our scheduling tool (Calendly) to book a discovery call.
• To improve our Website: We use analytics data to understand how visitors use our Website, identify areas for improvement, and optimise the user experience.
• To comply with legal obligations: We may process your data where necessary to comply with applicable laws and regulations.

5. Legal Basis for Processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases:

• Contract and Pre-contractual Steps: To create and operate an account, assess an application or company brief, facilitate matching, and take steps requested before an engagement.
• Legitimate Interests: To operate and improve the marketplace, assist human résumé review, protect accounts and documents, prevent abuse, maintain audit records, and understand service performance, after balancing those interests against individual rights.
• Consent: Where required for optional cookies, marketing, or genuinely optional processing. Consent may be withdrawn without affecting processing already carried out lawfully.
• Legal Obligation and Legal Claims: Where processing is necessary to meet a legal duty or establish, exercise, or defend legal claims.

6. Data Storage and Security

Your data is stored securely using the following infrastructure:

• Supabase: Contact form submissions and career applications are stored in a Supabase database with row-level security enabled. Supabase provides encryption at rest and in transit.
• Supabase Storage: Résumés, CVs, and company briefs are stored in private buckets. Access requires authorisation and uses short-lived links rather than permanent public URLs.
• Vercel: Our Website is hosted on Vercel, which provides SSL/TLS encryption for all data in transit.
• File Security: Uploads are subject to file-type, size, and malware checks. Sensitive file access and administrator actions are recorded in an append-only audit trail.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or method of electronic storage is 100% secure.

7. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to enhance your experience and collect analytics data. We use the iubenda Consent Solution to manage your cookie preferences in compliance with applicable laws.

7.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Website to function properly. These cannot be disabled.
• Analytics Cookies (Google Analytics): Help us understand how visitors interact with our Website. These cookies collect information anonymously and report Website trends without identifying individual visitors.
• Preference Cookies (iubenda): Store your cookie consent preferences.

7.2 Managing Cookies

You can manage your cookie preferences at any time via the cookie consent banner provided by iubenda. You may also configure your browser to refuse cookies or alert you when cookies are being sent. Please note that disabling cookies may affect the functionality of certain parts of the Website.

8. Third-Party Services

We use the following third-party services that may process your personal data:

9. Data Sharing and Disclosure

We do not sell, trade, or rent your personal data to third parties. We may share your information in the following limited circumstances:

• Service Providers: With trusted third-party services (listed above) that assist us in operating our Website and conducting our business, subject to confidentiality obligations.
• Approved Business Users: Relevant Talent profile information and, where needed for a genuine hiring or engagement decision, an original résumé may be made available to an approved Business account. Résumés are never intended to be public.
• Legal Requirements: If required by law, court order, or governmental regulation, or where disclosure is necessary to protect our rights, property, or safety.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change.

10. Data Retention

We apply the following standard retention periods and review data sooner when it is no longer required:

• Contact form submissions: Retained for up to 24 months from the date of submission, unless an ongoing business relationship is established.
• Original résumés, briefs, and application records: Retained while the account is active and needed to provide matching or recruitment services. Following rejection, account closure, or 24 months of inactivity, they are retained for no more than a further 12 months unless deleted earlier following a valid request or preserved under a documented legal hold.
• AI extraction records: Model details, extracted fields, validation results, risk flags, and review records are retained for up to 12 months from extraction. Accepted profile information that the user reviews or continues to use follows the account retention period.
• Security audit events: Identifiable security and access records are retained for 24 months from the event, then deleted or irreversibly anonymised. A narrowly relevant record may be retained longer where required by law or for a documented legal claim.
• Analytics data: Google Analytics data is retained in accordance with Google's data retention policies (typically 14 months).

10.1 Résumé Access

Résumés may be accessed by the person who supplied the document, approved Business users evaluating Talent through Kairos, specifically authorised Kairos staff whose role requires access, and contracted processors that provide storage, malware scanning, or AI extraction. Staff access requires an authorised staff account and is logged. We do not make résumés publicly searchable.

10.2 Account Deletion

After we verify an account-deletion or valid erasure request, we remove the account from active use and matching. Original files, AI extraction records, application data, and directly identifying profile information are deleted or irreversibly anonymised from live systems within 30 days, unless a legal exception applies. Limited security audit information may be pseudonymised and retained for the remainder of its 24-month security period. Deleted information may remain in restricted disaster-recovery backups until those backups expire under the provider's normal cycle; if a backup is restored, the deletion is reapplied.

10.3 Immutable Security Copies

Security audit records are designed to be append-only. We may also maintain encrypted, access-controlled immutable copies for incident investigation and accountability. Any such copy follows the same 24-month period unless subject to a documented legal hold and does not contain résumé text or uploaded files.

11. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing: Request that we limit the processing of your personal data in certain circumstances.
• Right to Data Portability: Request your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Object to our processing of your personal data where we are relying on legitimate interests.
• Right to Withdraw Consent: Where we rely on your consent to process data, you may withdraw that consent at any time.

To exercise any of these rights, contact us at team@itskairos.uk. Requests may be made in writing or verbally. We may ask for information reasonably necessary to verify identity and prevent disclosure to the wrong person. We record the request, search relevant live systems and processors, and respond without undue delay and normally within one calendar month after verification. Where the law permits extra time for a complex request, we will explain this within the first month. If we cannot fully comply, we will explain the reason and the right to complain to the Information Commissioner's Office.

12. International Data Transfers

Some providers, including Google, Supabase, Vercel, and Groq, may process personal data outside the United Kingdom. Before making a restricted transfer, we use an applicable UK adequacy regulation or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, and carry out any required transfer-risk assessment. You may contact us for information about the relevant safeguards.

13. Children's Privacy

Our Website and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at team@itskairos.uk and we will take steps to delete such information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will post the updated policy on this page with a revised "Last updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of the Website after any changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: