Privacy notice

This notice explains what personal data KORTEKX collects, why, how long we keep it, and what you can do about it. It covers the website kortekx.com and the KORTEKX platform.

Status. The KORTEKX platform is being built and has no clients yet. Where this notice describes the platform, it describes how the platform will work once it is live. Everything else applies now, including this website (section 3), the people we talk to about our services (section 4), your rights (section 10) and complaints (section 12). We will update this notice when the platform goes live.

1. Who we are

KORTEKX is the trading name of Thomas Mamo, who is self-employed in Malta. KORTEKX is a sole-trader business, not a limited company.

• Name: Thomas Mamo, trading as KORTEKX
• Address: 5 Wonderland, Triq Gharghur, Naxxar NXR 4608, Malta
• Email: privacy@kortekx.com
• Malta VAT number: MT30731213

In this notice, "we" and "us" mean Thomas Mamo trading as KORTEKX. We have not appointed a data protection officer. Send any privacy question or request to the email above.

2. Our two roles

• We are the controller for this website, for the people we talk to about our services, and for the accounts of the businesses that use KORTEKX (our clients) and their staff. We decide how that data is used.
• We are a processor for the data our clients keep in KORTEKX about their own customers. The client decides how that data is used. We handle it only on the client's instructions, under a data processing agreement (GDPR Article 28).

If a business that uses KORTEKX holds your data, for example because you booked with it or sent it a message, that business is responsible for it. Its own privacy notice applies. Section 11 explains what to do.

3. The website

The site has no forms, no accounts, no cookies, no analytics and no advertising pixels.

What we collect. When you open a page, your browser sends our host, Cloudflare, Inc., the technical data every web request carries: your IP address, the date and time, the page asked for, the page you came from, and your browser and device type.

Why, and on what legal basis. To deliver the page and to protect the site from attacks. This is our legitimate interest in running a website that works and is safe (GDPR Article 6(1)(f)). We do not use this data to profile visitors.

How long. Our host, Cloudflare, processes technical data about each visit, such as your IP address and traffic routing data, to deliver and protect this site. The request records Cloudflare lets us see are kept for at least 31 days. Cloudflare's own use of this data is set out in its privacy policy, which gives no fixed period.

If you email us. We keep your email and our reply so we can answer you and do what you asked. The legal basis is taking steps you asked for before a contract (Article 6(1)(b)), or our legitimate interest in answering messages (Article 6(1)(f)).

4. People we talk to about our services

What we collect. Your name, business name, role, work email and phone, business address, and notes of our conversations.

Where it comes from. From you, from people who introduce you to us, or from public business sources. If we got your details from somewhere other than you, we tell you where when we first contact you, and at the latest within one month.

Why, and on what legal basis. To find businesses that may want KORTEKX and to talk to them about it. This is our legitimate interest in offering our service to businesses (Article 6(1)(f)). You can object at any time, and we stop.

Marketing. We do not send marketing emails, text messages or automated calls without your prior consent in writing. In Malta this rule protects businesses as well as people (S.L. 586.01, regulation 9). If you give consent, you can withdraw it at any time. Every marketing message tells you how.

5. Clients and their staff on the platform

What we collect.

• About the client business: its name, address, VAT number, billing contact, and contract and billing records.
• About each staff user: name, work email, phone number if given, role, sign-in details (passkey or two-factor set-up, and our session records), the devices signed in, and a record of actions taken in the account, with the IP address used.
• Support messages between the client and us.

Why, and on what legal basis.

• To provide the service under our contract with the client (Article 6(1)(b) where the client is a sole trader; otherwise our legitimate interest in providing the service the business signed up for, Article 6(1)(f)).
• To keep accounts secure and to look into misuse (Article 6(1)(f)).
• To issue invoices and keep tax records (legal obligation, Article 6(1)(c)).

We need the account details marked as required. Without them we cannot set up or run the account.

Our own access to client accounts. When KORTEKX staff need to work inside a client's account, for example for support, they sign in with two-factor checks, give a reason, and the access ends by itself within 60 minutes. Every action they take shows in the client's own activity log. Staff open data from Google, Microsoft or Meta only as section 6 allows.

6. Connected accounts: Google, Microsoft and Meta

Clients can connect their own Google, Microsoft and Meta accounts to KORTEKX. We get only the access the client approves on that provider's consent screen. The client can disconnect at any time, in KORTEKX or in the provider's own settings. When an account is disconnected, we stop using it and delete the stored access keys for it.

Some of the connections below are still being built. We collect nothing through a connection until clients can use it.

Google, Microsoft and Meta also hold this data on their own platforms. Their own privacy policies apply there.

For the data in these accounts we act as the client's processor (section 2). We hold the access keys and connection records as controller, to run the client's account (section 5).

For all three providers, we follow the same rules:

• We use the data only to provide the features the client sees and uses in KORTEKX.
• We do not sell it, and we do not use it for advertising.
• We do not use it to develop, improve or train any AI or machine-learning model. Where text goes to our AI provider to draft a reply (section 7), it is sent for that reply only and is not used to train any model.
• Our staff do not read it unless the client agrees for specific messages or data, and we record that agreement (for example, for support); it is needed for security, such as looking into abuse; or the law requires it.

Google user data

If a client connects a Google account, KORTEKX can access only the parts the client approves:

• Google Calendar: whether the client is free or busy at a given time (we do not read the details of its events in other calendars), and the events in a separate calendar that KORTEKX makes for bookings. KORTEKX creates, changes and cancels the booking events there, and reads changes the client makes in that calendar, so both stay the same. (Google permissions: calendar.freebusy and calendar.app.created.)
• Google Business Profile: the business's reviews, and the replies and posts the client approves. (Google permission: business.manage.)

How we use it. To make bookings and keep them in step with the client's booking calendar, to show reviews, and to post replies and updates the client approves. The text of a review may go to our AI provider (section 7) so it can draft a reply. The client's staff approve that reply before it is posted. A review reply is posted automatically only if the client has switched on automatic review replies in its settings. Data from Google Workspace APIs is never used to develop, improve or train generalised or non-personalised AI or machine-learning models.

Where we keep it, and for how long. In the client's system, in the EU (section 8). Free and busy times are checked when a booking time is offered or made, and are not stored. The booking events we create are part of the client's booking records and are kept for as long as the client keeps them (section 9). We keep Google Business Profile content for no more than 30 days, as Google requires.

Who we share it with. Only the providers in section 8, so they can run these features. We do not transfer it to anyone else, except for security, to comply with the law, or, with the client's explicit prior consent, as part of a merger or sale of the business.

Deleting it. The client can disconnect Google at any time. To have Google data we already hold deleted, email us (section 10).

KORTEKX's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Google's rules: Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy.

You can remove KORTEKX's access at any time in your Google Account, under Security, then Your connections to third-party apps and services (https://myaccount.google.com/linkedapps).

Microsoft data

If a client connects Microsoft 365, and its administrator approves, KORTEKX can:

• read and change calendar events, for bookings;
• stay connected until the client disconnects.

(Microsoft permissions: Calendars.ReadWrite and offline_access.)

Meta data: WhatsApp, Facebook Pages and Instagram

If a client connects a WhatsApp Business account, a Facebook Page or an Instagram professional account, KORTEKX can hold:

• the account or Page name and ID, and an access key;
• messages and comments sent to the account or Page, and the replies;
• for WhatsApp, the phone numbers of the people who message the business, and the delivery status of messages;
• the posts the client schedules.

We use it to show and answer messages in the client's inbox and to publish the posts the client approves. Message text may go to our AI provider (section 7) to draft a reply. To delete data we got from Meta, see Delete your data.

7. AI

Not switched on yet. Our AI features are still being built, and none of them is in use. This section describes how they will work. We will update this notice before any of them goes live.

What it will do. KORTEKX will use AI to draft replies to customer messages and reviews, to answer questions in a business's website chat, and to search a client's own documents.

Where it runs. We use Claude, made by Anthropic, through Amazon Bedrock. We set it to process requests only in AWS regions inside the EU. Search uses Amazon Titan embeddings in Milan, Italy. Amazon does not share these requests with Anthropic or any other model maker. Amazon says it does not use them to train models.

Labels. Every message our AI writes to a business's customer is marked as written by AI, from the first message. Where people talk directly with our AI, the EU AI Act (Article 50) requires this.

People stay in charge.

• At launch, the client's staff approve every AI reply before it is sent.
• Later, a client may let one type of reply go out on its own. That happens only after the AI has passed our quality test for that client, and we keep checking a sample of replies. If quality drops, approval comes back.
• Complaints always go to a person.
• Emergencies get a fixed message, written by people, with the 112 number and the business's own contact line, and go to a person.
• We do not switch on AI for a business in the health sector until a data protection impact assessment is done.

We do not use AI, or any automated system, to make decisions about people that have legal or similarly significant effects on them.

8. Who helps us, and where data goes

The live system and every backup are in the EU.

Transfers outside the EU. Some of these providers are based in the United States or belong to US groups, so some data, or access to it, may leave the EU. For Amazon, Google and Sentry we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which they are certified. For Cloudflare we rely on the Data Privacy Framework while its certification is active, and otherwise on the European Commission's standard contractual clauses. For Porkbun we rely on the standard contractual clauses. You can ask us for a copy of these safeguards.

Changes for clients. We tell clients before we add or replace a provider that handles their customers' data, so they can object, as our data processing agreement says.

Others. We share personal data with public authorities only when the law requires it. Our sales partner, who works with us to find and serve clients, sees sales contacts and client account details. Our professional advisers, such as our lawyer and accountant, see what they need, under a duty of confidentiality. If the business is sold, the buyer would take over the data, and we would tell you first. Section 6 still applies: data we receive from Google, Microsoft or Meta is not shared with our sales partner or our advisers unless the law requires it, and it passes to a buyer only with the client's explicit prior consent.

9. How long we keep data

Backups. The live database can be restored to any point in the last 30 days. We also keep locked, encrypted copies at two other EU providers for 30 days. "Locked" means no one, not even us, can change or delete a copy before its time is up. That protects your data from attacks and mistakes. It also means a deletion reaches the backups only when the copies expire: after we delete your data, the last backup copies of it are gone within 35 days. Until then we use those copies only to recover from a failure, and every restore re-applies all deletions before the system restarts.

Record of deletions. To make sure a restore never brings deleted data back, we keep a short record of each deletion. It holds an ID and a scrambled key, not the data itself. We keep it for 30 days longer than our longest backup.

10. Your rights

You have the right to:

• get a copy of your personal data;
• have wrong data corrected;
• have your data deleted;
• have its use restricted;
• object to how we use it, including the right to stop marketing at any time;
• get data you gave us in a common machine-readable format, or have it sent to someone else;
• withdraw your consent at any time, where we rely on consent. This does not affect what we did before.

To use any of these rights, email privacy@kortekx.com. It is free. We may ask you to prove who you are. We answer within one month. If a request is complex, we may need up to two more months; we will tell you within the first month if so, and why.

11. If a business that uses KORTEKX holds your data

If you are a customer of a business that uses KORTEKX, that business decides how your data is used. Contact the business first. If you write to us instead, we pass your request to the business without delay and help it to answer.

12. Complaints

You can complain to Malta's data protection authority:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta
Phone: +356 2328 7100 (working days, 10am to 1pm)
Email (general enquiries): idpc.info@idpc.org.mt
File a complaint online (the IDPC takes electronic complaints only through this form): https://idpc.org.mt/file-a-complaint/

You can also complain to the authority in the EU country where you live, where you work, or where you think the problem happened. We would like the chance to fix things first, so please tell us, but you do not have to.

13. Cookies

This website sets no cookies. It does not store or read anything on your device, and it uses no analytics, tracking or advertising tools. That is why there is no cookie banner. If this ever changes, we will update this notice and ask for your consent first where the law requires it (S.L. 586.01, regulation 5).

The KORTEKX platform, where clients sign in, uses only the cookies strictly needed to keep users signed in and secure. The law allows these without consent.

14. Security

Backups are encrypted and locked. Client admins must sign in with a second factor, and KORTEKX staff always do. Each client's data is kept separate from every other client's.

15. Children

KORTEKX is a service for businesses. It is not meant for children, and we do not knowingly collect children's data for our own purposes. A business that uses KORTEKX may hold data about customers of any age; that business is responsible for it.

16. Changes to this notice

We update this notice when what we do changes. The date at the top shows the latest version. If a change matters for clients, we tell them by email before it takes effect.