Privacy Policy

DRAFT — not legally reviewed.

This Privacy Policy explains how Inteligenta AIX [[legal form, registered address, registration number]] (“we”, “us”) processes personal data when you visit this website or use an account in kovac, our hosted platform for building AI agents over an organisation’s documents (the “Service”).

We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and North Macedonia’s Law on Personal Data Protection (Official Gazette of the Republic of North Macedonia No. 42/2020).

1. Who is responsible

We are the controller for the personal data described in this policy: data about visitors to this website, about people who contact us, and about the accounts of Users of the Service.

We are not the controller of the documents, conversations and other content our customers put into the Service (“Customer Content”). For Customer Content, the customer organisation is the controller and we act as its processor under our Data Processing Agreement. If your personal data is in Customer Content, or you used a chat widget on a customer’s website, please contact that organisation.

Contact for privacy matters: [[DPO/contact]].

2. What we collect

Website visitors. This website sets no cookies, loads no analytics or tracking scripts, and serves its fonts from our own servers. When you request a page, our servers receive technical data your browser sends with every request: IP address, date and time, the page requested, the referring page and your browser’s user agent. We use it in server logs only, as described in section 3. See the Cookie notice for details.

People who contact us. If you write to us, we process your name, contact details, organisation and the content of your message.

Users of the Service. When your organisation gives you access to kovac, we process:

• account data held by the sign-in service: your name, username, email address, the workspaces you belong to, your role and any departments you are assigned to;
• sign-in data: when you last signed in, and the session data needed to keep you signed in;
• activity records: entries in your workspace’s audit log that record which user made a change to knowledge, access settings or configuration, and when;
• usage data: measurements of how the Service is used per workspace (for example, the number of searches and agent runs, and the number of active users per day), used for quotas, billing and capacity;
• technical logs: IP address, user agent, requested address, timestamps and error information generated when your browser or integration calls the Service;
• support data: what you tell us when you ask for help.

We do not intentionally collect special categories of personal data about Users.

3. Why we process it and on what legal basis

We rely on the following legal bases under Article 6(1) GDPR and the corresponding provisions of North Macedonia’s Law on Personal Data Protection:

• To provide the Service under our contract with your organisation (account management, sign-in, roles, workspaces, support): our legitimate interest in performing the contract with your organisation, Article 6(1)(f), and where you contract with us yourself, performance of a contract, Article 6(1)(b).
• To keep the Service and its customers secure (technical logs, audit log, abuse prevention, rate limiting, investigating incidents): our legitimate interest in the security of our systems and our customers’ data, Article 6(1)(f).
• To measure usage, apply quotas and bill (usage data): performance of the contract and our legitimate interest in accurate billing, Article 6(1)(b) and (f).
• To answer enquiries (contact data): our legitimate interest in responding to you, Article 6(1)(f), or steps you request before entering into a contract, Article 6(1)(b).
• To comply with legal obligations (for example accounting and tax records, responses to lawful requests): Article 6(1)(c).

We do not use personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not sell personal data.

4. How long we keep it

• Account data: for as long as your account exists, then [[period]].
• Sign-in and session data: sessions end after at most seven days; sign-in records are kept [[period]].
• Audit log entries: for the retention period your organisation configures for its workspace, [[default period]] by default.
• Usage data: [[period]].
• Technical logs: [[period]].
• Enquiries and support correspondence: [[period]].
• Accounting records: as required by law, [[period]].

5. Who receives it

Personal data is accessible only to our staff who need it to operate and support the Service, and to the administrators of your own organisation’s workspace, within the limits of their role.

We use the sub-processors listed in the table at the end of this policy to deliver the Service. We may also disclose personal data to authorities where the law requires it, and to professional advisers bound by confidentiality.

6. International transfers

[[State where the Service and its sub-processors store and process data. Where personal data is transferred outside North Macedonia and the European Economic Area to a country without an adequacy decision, describe the safeguard relied on, for example the European Commission’s standard contractual clauses under Article 46 GDPR and the corresponding provisions of the Law on Personal Data Protection, and how a copy can be obtained.]]

7. How we protect it

Each customer’s data is separated from every other customer’s by rules enforced in the database itself. Access is limited by role, sign-in goes through a dedicated identity service, connections are encrypted in transit, credentials for third-party services are stored encrypted, and changes are recorded in an audit log. More detail is on our security page.

8. Your rights

Under the GDPR and the Law on Personal Data Protection you have the right to:

• access the personal data we hold about you (Article 15 GDPR);
• have inaccurate data corrected (Article 16);
• have data erased (Article 17);
• restrict processing (Article 18);
• receive your data in a portable format (Article 20);
• object to processing based on our legitimate interests (Article 21);
• withdraw consent at any time where we rely on consent, without affecting earlier processing.

To exercise a right, contact [[DPO/contact]]. We will respond within one month, which may be extended where the law allows. If your request concerns Customer Content, we will pass it to the organisation responsible and assist it.

9. Complaints

You can lodge a complaint with the Personal Data Protection Agency of the Republic of North Macedonia [[confirm name and contact details]], or with a supervisory authority in the EU Member State where you live, work or where the alleged infringement took place (Article 77 GDPR). We would appreciate the chance to address your concern first.

10. Children

The Service is intended for organisations and is not directed at children. We do not knowingly collect children’s personal data.

11. Changes

We will update this policy when our processing changes and show the date it takes effect at the top of this page. Where a change is significant, we will inform account holders before it takes effect.