Apply
Legal

Privacy policy

What Kivo collects, why, who receives it and for how long. Ledger lines and invoices 6 years; Desk chat 12 months.

Version 1.0 · effective 7 Jul 2025

Document
Privacy policy
Version
1.0
Effective
7 Jul 2025
Status
Current
Entity and law
Kivo Club Ltd · England and Wales
DraftDraft for the lawyer; not for publication.
  1. 1Who. Kivo Club Ltd is the controller; registered with the Information Commissioner's Office (registration to be completed before launch); contact via the Desk and a privacy address (to be set).
  2. 2What we collect. Firm details (company number, registered name and address, legal form, staff count, region, tier); signatory and cardholder identity data (name, date of birth, address, identity document, as needed for KYB and the issuer's KYC); contact details; billing details (payment tokens from the payment provider; Kivo never stores card numbers); Ledger and invoice data (supplier, invoice number, amounts, dates); Desk cases and messages; event bookings and supplier ratings; sign-in and security records; usage analytics (application started, KYB passed, paid, first nomination, first invoice, first conversion).
  3. 3Why and on what basis. Performance of the membership contract; legal obligations (KYB, sanctions and PEP screening, accounting records); legitimate interests (running the Register, the Desk, security, reporting); consent (Kivo's letters about the Register and events; cookies that are not strictly necessary).
  4. 4Who receives it. The KYB and screening partner; the card issuer (cardholder identity and conversion instructions); our partner bank (load and FX instructions); the payment provider; the transactional email provider; Xero (supplier side, read-only); the airline programme (only if the member converts and the agreement is signed); hosting providers in the UK or EEA; professional advisers; authorities where the law requires. Suppliers see only their own invoices and the introductions a member accepts. Accountants see what the member shares by read-only link. Kivo does not sell data.
  5. 5Where. The United Kingdom or the European Economic Area (to be confirmed, spec 13); transfers outside protected by UK adequacy or standard clauses.
  6. 6How long. Ledger lines and invoices 6 years; Desk chat 12 months; KYB records as the partner's terms and the law require; sign-in logs 12 months; marketing consent until withdrawn; account data for the membership plus 6 years where needed for accounts.
  7. 7Your rights. Access, rectification, erasure (subject to the retention above), restriction, portability, objection, withdrawal of consent; handled within 30 days from the app or by writing to the Desk; complaint to the ICO.
  8. 8Security. MFA for signatories and admins; role-based access; audit log of admin actions; no PAN storage; annual penetration test; encryption in transit and at rest.
  9. 9Children. Not for anyone under 18.
  10. 10Changes. Version and date shown; material changes notified.

Previous versions

No previous versions.