Data controller

The data controller is K inventory, Tour Ariane - Regus, 5 place de la Pyramide, 92800 Puteaux, France, reachable at contact@k-iop.com.

This policy covers the site k-iop.com. Processing of the data you place inside the K.IOP platform falls under the service contract and its data processing annex, where you remain the controller and K.IOP the processor within the meaning of Article 28 of the GDPR.

What we collect, and why

One processing operation, one purpose, one legal basis. Nothing is collected “just in case”.

Processing	Data	Legal basis	Retention
Contact form	Name, company, work email address, phone if given, message content	Legitimate interest: answering a commercial enquiry	3 years after the last exchange
Newsletter	Email address	Consent, collected through an unticked checkbox	Until unsubscription, then 3 years on a suppression list
Web server logs	IP address, timestamp, page requested, user agent	Legitimate interest: security and technical diagnosis	12 months
Analytics	Visit identifier, pages viewed, referral source	Consent, collected through the cookie banner	13 months

Required fields are marked in every form. You are never obliged to give more; without the required fields we simply cannot handle your request.

Recipients and processors

Your data is accessible only to K inventory staff who need it, and to the following processors, bound by contract under Article 28 of the GDPR:

Service	Processor	Location
Hosting of the site and platform	OVH SAS	France
Analytics	Analytics processor	European Union
AI assistant and AI steps in workflows	Anthropic Ireland Limited	Ireland

Your data is neither sold, nor rented, nor exchanged. It is passed to a third party only on requisition by a competent judicial or administrative authority.

To date, no third-party processor is involved in newsletter delivery (the form is not yet active) or in customer relationship management (the internal tool under consideration would be self-hosted, with no processor to declare). This table will be completed as soon as either service goes live.

Artificial intelligence models

The data you place in K.IOP is never used to train a model, neither ours nor a third party's.

When you use the model that comes with your plan, the calls go today to Claude, published by Anthropic. That provider may change: this policy and the subprocessor table are updated whenever it does, and you can switch AI off for your whole organisation or use your own provider key.

Agents query your documents at the moment of the question and cite their sources. When you use your own provider keys (BYOK), the calls go to the provider you chose, under the terms of your own contract with them.

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability over your data, as well as the right to lay down directives on its fate after your death.

To exercise these rights, write to contact@k-iop.com or to the registered office address given above. We answer within one month. Proof of identity will be asked for only in case of reasonable doubt as to your identity, and destroyed immediately after checking.

Withdrawing your consent to the newsletter takes one click, from the unsubscribe link in every mailing, with no need to write to anyone.

Complaints

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority:

CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
www.cnil.fr/fr/plaintes

Security

Encryption in transit and at rest, per-client data isolation, access control, operation logging and regular backups. The whole infrastructure is hosted in France.

In the event of a data breach likely to result in a high risk to your rights, you would be informed as soon as possible, in accordance with Article 34 of the GDPR.

Changes to this policy

Any substantial change is flagged on this page and, where the processing rests on your consent, notified to you before it takes effect. The last update date appears at the top of the page.

Privacy policy