KAPP Privacy Policy
KAPP is a service for organizations, their employees, contractors and other authorized users. It includes the KAPP website, corporate web services, the KAPP mobile app and related server-side functions. KAPP helps organizations work with documents, training, events, requests, notifications, employee and contractor data, and incident materials.
This policy explains what personal data may be processed when a demo and guided onboarding are requested, when an organization is created and administered, and when KAPP is used by end users.
1. Who is involved in data processing
The client organization determines why and how data is used in its HR, training, production and other internal processes, assigns roles and rights, and decides what information its authorized users enter into KAPP. The owner of KAPP ensures the operation and protection of the service and processes data in order to provide the service.
The roles of the parties with respect to specific data may differ and may be further defined by the contract, the organization's instruction and applicable law. A question can be sent to us; if necessary, we will pass it on to the relevant organization or coordinate the response with it.
2. Where the data comes from
- from a company representative during a demo request, negotiations and guided onboarding;
- from the client organization, its administrators, HR department, managers and other authorized persons;
- from the user during activation, sign-in and use of the features available to them;
- from KAPP workflows, for example when a document is assigned, training is completed or the status of a request or incident changes;
- automatically from the device, the app and the network infrastructure when the service is used.
3. What data may be processed
Company requests and onboarding
- the representative's name, job title, work email and other business contact details provided;
- company name, team size, industry, country, intended use cases and setup requirements;
- the content of correspondence, arrangements, onboarding status and information needed to verify authority and create the organization's environment.
Organization, account and work profile
- organization and user identifiers, personnel number or other internal number;
- name, work contact details, role, account status, department, job title, manager and work location;
- organizational relationships, access rights and information on affiliation with a contractor;
- activation codes, a one-way password hash, session identifiers and state, and the time of their issuance and revocation.
Documents, training, requests and events
- the organization's documents, versions, files, assignments, deadlines and acknowledgements of review;
- requests and statements, attachments, authors, statuses, review history and comments;
- employee and contractor documents, document details, validity periods, files and verification results;
- assigned training programs, answers, attempts, results, certificates and progress;
- events, participants, confirmations, completion time, notes and related materials.
Materials uploaded by the organization may relate to identity, employment, qualifications, clearances, occupational safety, security or medical requirements and may therefore contain confidential information. The organization and users must add only the data necessary for the relevant workflow.
Incidents and safety
- the description, location, time and status of an incident;
- information about affected persons, witnesses, investigators and other participants;
- testimony, actions, findings, decisions, photos, videos, documents and other evidence;
- the record's processing history and information about authorized authors and reviewers.
Device and technical data
- IP address, client and device information, request path and time, response code and correlation identifiers;
- security events, audit logs, errors and service performance metrics;
- notification setting, platform, app version and push token, if notifications are enabled.
The mobile app does not request constant access to precise location. The location of an incident is entered as text. Photos, videos and files are transferred only after a user action, through the device's system tools.
4. What the data is used for
- to respond to a company's request, conduct a demo, and agree on and carry out guided onboarding;
- to create, configure and administer the organization's environment and its accounts;
- to provide the document, training, event, request, notification and incident features;
- to verify authority and access rights, maintain sessions and prevent unauthorized actions;
- to provide support, diagnose errors, ensure reliability and protect the service;
- to fulfil arrangements with the organization and applicable legal obligations;
- to keep the necessary history of actions and apply the organization's retention rules.
The public website does not use a form for hidden collection of submissions: an onboarding inquiry is sent by the user directly by email. The current version of the website has no advertising trackers. KAPP does not sell personal data.
5. Legal bases and the organization's choice
Depending on the situation, data is processed on the basis of an inquiry from a user or a company representative, the performance of contractual and pre-contractual actions, the organization's instructions, consent where it is required, legitimate interests in ensuring the security and operability of the service, and the requirements of applicable law. The organization is responsible for having a proper basis for the data that it enters into KAPP or instructs to be processed in KAPP.
6. Who may have access to the data
- the user's organization and persons with the relevant roles, assignments or authority;
- the owner of KAPP and authorized support and operations specialists, to the extent necessary;
- providers of hosting, databases, object storage, network infrastructure and notification delivery;
- professional advisers or government authorities, when this is required to protect rights or by law;
- a new owner of the service as part of a reorganization or business transfer, provided that proper data protection is maintained.
Messages sent to spongeaibek@gmail.com are delivered and stored using Google's Gmail email service. Therefore, passwords, codes, medical information, employee documents or incident materials should not be sent by ordinary email; for sensitive data, first agree on a secure channel.
Providers receive only the access necessary for their function. Current information about the infrastructure and the place of processing can be requested at the contact address.
7. Storage and international processing
Core records are stored in a server database, and files in object storage. Infrastructure providers may process data in the countries where they have a presence. The organization and the owner of KAPP determine the permissible configuration and the necessary measures, taking into account the contract and applicable law.
The retention period depends on the category of the record, the purposes of processing, the organization's rules, the contract and mandatory requirements. Business correspondence and onboarding information are kept for as long as necessary to respond, carry out onboarding, maintain contractual relations, resolve disputes and fulfil obligations. Work, training, medical, occupational safety, audit and security-related records may be kept longer. After the necessary period ends, data is deleted, anonymized or remains only where further retention is mandatory.
8. Local data and notifications
The mobile app may store a sign-in token in the device's secure storage, a profile cache, service identifiers, a push token and documents that the user has explicitly saved for offline access. Signing out deletes the local sign-in token and the profile cache and attempts to disable the push token. Offline copies are deleted by the user separately or when the app is deleted.
9. Data protection
KAPP uses a secure connection, access separation by organization and role, time-limited file links, upload checks, logging of significant actions and other organizational and technical measures. No method of storage or transmission eliminates risk completely. Report a possible security incident to spongeaibek@gmail.com.
10. User requests and rights
To request information about your data, correction, restriction of processing, withdrawal of previously given consent, or deletion of the account and related data, write to spongeaibek@gmail.com. State your name, organization and a work identifier sufficient to locate the record. Do not send a password, activation code or copies of sensitive documents in the first email.
To verify identity and authority, the request may be coordinated with the administrator of the relevant organization. The response and the scope of actions depend on the role of the parties, applicable law and the need to retain contractual, work, training, occupational safety, medical, audit or security-related records.
11. Children
KAPP is intended for organizations and work accounts and does not offer self-registration to children. If an organization provides access to a minor on a lawful basis, questions about such an account should be directed to the organization and the owner of KAPP.
12. Third-party links and changes to the policy
The KAPP website or materials may contain links to third-party resources. Their owners independently determine their own data processing rules. If the features, the set of data or the parties involved in processing change, this policy may be updated. The new version is published at this address with a new date.
13. Contact
Privacy questions, data requests, organizations' onboarding requests and technical support: spongeaibek@gmail.com.
Owner and publisher of KAPP: Adilzhan Akhmetkerey.