Privacy Policy

Last updated: 2026-08-20

This Privacy Policy explains how Kirk Group Services Ltd (Company No. 17172191, registered in England and Wales at [REVIEW: registered office address for Kirk Group Services Ltd]) — trading as KSite — collects, uses, shares and protects personal data. We are the “controller” of personal data about our subscribers and their authorised users.

If you are a customer of one of our subscribers (for example, a homeowner or business whose property has been surveyed using KSite), the subscriber firm is the controller of that data — KSite acts as the “processor” on their behalf. Contact the subscriber directly for requests about that data.

1. What data we collect

Account data

• Your name and email address
• Your business (tenant) name
• Your role (admin / operative)
• Encrypted password (via AWS Cognito — we never see it in plain text)

Service data you create

• Customer, site and job records you enter
• Survey notes, snag lists, materials lists
• Photos and voice notes you attach (including EXIF and, if you grant permission, GPS coordinates captured at photo time)
• Customer signatures captured on-device
• Business branding you upload (logo, address, tax IDs)

Payment data

• Card and billing details are handled entirely by Stripe, Inc. — KSite never stores your card number, CVV or expiry.
• We retain a Stripe customer ID + subscription ID linking your KSite tenant to your Stripe record.

Technical data

• IP address (used for session security and abuse prevention)
• User-agent string (which app + version you’re using)
• Timestamps of key actions (job created, PDF generated, etc.)

2. Why we process this data

Under UK-GDPR Article 6, we rely on the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the KSite service you’ve subscribed to (or trialled).
• Legal obligation (Art. 6(1)(c)) — accounting, tax and fraud-prevention records we’re required to keep.
• Legitimate interests (Art. 6(1)(f)) — service security, abuse detection, product improvement (no marketing without your explicit opt-in).

3. Who we share data with (sub-processors)

We do not sell your data. We share it only with sub-processors we rely on to deliver the service. All sub-processors are contractually bound to protect your data to at least the standard set out here.

4. Data location and international transfers

Your KSite data (accounts, jobs, photos, signatures) is stored in AWS’s Dublin, Ireland region. It does not leave the European Economic Area for storage or processing.

Payment data handled by Stripe may be processed in the US under Stripe’s Standard Contractual Clauses and the UK Addendum. App Store and Play Store data handled by Apple / Google is subject to their own respective transfer safeguards.

5. How long we keep your data

We keep data only as long as needed to provide the service and to meet legal obligations.

• Free tier: deleted files recoverable for 7 days.
• Pro tier: deleted files recoverable for 30 days.
• Team tier: deleted files recoverable for 60 days.
• Enterprise tier: deleted files recoverable for 365 days.
• Job records remain in your tenant until you delete them or close your account.
• After account closure, we retain accounting and audit records (Stripe payments, subscription history) for 6 years as required by UK tax law, then delete them.

6. Your rights

You have the following rights over your personal data under UK-GDPR:

• Access — request a copy of the data we hold on you
• Rectification — correct anything inaccurate
• Erasure — ask us to delete your data (subject to the retention obligations above)
• Portability — receive your data in a machine- readable format for transfer to another controller
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email privacy@ksite.uk. We respond within one calendar month.

If you’re unhappy with our response, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

7. Security

• All connections use TLS 1.2+ end-to-end (HTTPS enforced).
• Data at rest in AWS is encrypted with AES-256.
• Passwords are hashed by AWS Cognito — we never store them in plain text.
• Access to production systems is limited to Kirk Group Services engineering staff with multi-factor authentication.
• Every business-data record is scoped to your tenant at the authorisation layer — cross-tenant reads and writes are blocked at the API resolver level.

8. Cookies

The KSite web dashboard uses essential cookies only (session token, authentication). We do not use tracking or advertising cookies, and we do not integrate third-party analytics beyond privacy-preserving server-side aggregates. [REVIEW: update this section if analytics tooling is added post-launch.]

9. Children

KSite is a business tool for contractors and is not intended for use by anyone under 18. We do not knowingly collect data from children. If you believe we have, contact privacy@ksite.uk.

10. Changes to this policy

We’ll notify you by email of any material changes at least 30 days before they take effect. The “Last updated” date at the top of this page always reflects the current version.

11. Contact us

Kirk Group Services Ltd
Company No. 17172191
[REVIEW: registered office address for Kirk Group Services Ltd]
Data protection queries: privacy@ksite.uk
General support: hello@ksite.uk

Legal notice: this policy is a first-pass template drafted by the KSite team. It has not been reviewed by a solicitor and must not be relied upon as a definitive legal document until such review is complete.