Who is responsible for processing your data
KAP Group is the data controller for OT9. To ask about the data we hold, the purposes of processing, withdrawal of consent or your data rights, contact us through Contact. Please include your name, the communication channel involved and a clear description of your request so we can identify the relevant record.
What data may enter our working records
The information depends on how contact began. An enquiry may include your name, role, company, business phone number, corporate email address, message content and correspondence history. In B2B communication, it may include publicly available information about a legal entity and a representative’s work contact details: name, role, public profile link, corporate email address or business phone number.
| Situation | What we record | Why we need it |
|---|---|---|
| Service enquiry | Contact details and the content of your request | To reply and prepare a proposal |
| Project correspondence | Business communication history | To fulfil agreements and avoid repeating questions |
| Business outreach | Company, role and corporate contact details | To assess whether a B2B offer is relevant |
We do not build profiles based on personal interests and do not use information unrelated to a business purpose.
Why we use this information
- to respond to an enquiry, arrange a call or send requested materials
- to enter into and fulfil an agreement, manage a project and handle payments
- to maintain business correspondence with a client, partner or company representative
- to assess whether a business contact is relevant to a B2B offer
- to protect our infrastructure and investigate technical incidents
A message sent to a work address does not create permission for unlimited future mailings. We remove a contact from further outreach when the recipient asks us not to write, says the offer is irrelevant, or no longer holds the relevant role.
Where business contacts come from
Information may come directly from you through a form, call, email, meeting or correspondence. For B2B research, we use public sources where a company or its representative has published work information, such as an official website, public corporate directory, industry resource, organisation profile or public professional profile. We do not request or obtain access to private accounts.
If a work list contains an outdated employee, incorrect role or someone else’s address, reply to the message and tell us. We will update the record, exclude the address from outreach or delete the data where further processing is not required.
Who may receive your data
Access is limited to employees and contracted providers who need the information for a specific task: handling an enquiry, delivering a project, supporting infrastructure or maintaining records. They act on our instructions and may not use the information for their own unrelated purposes.
- A request enters a working channel and is recorded only to the extent necessary.
- Access is given to the specialist responsible for the task.
- When the purpose is complete, data is deleted, anonymised or retained only for as long as necessary to meet obligations and record-keeping requirements.
We may also disclose information where required by authorised bodies under applicable law. In all other cases, we do not sell contact databases or provide them to third parties for their own outreach.
How data is protected and retained
We limit access by working role, use managed accounts, protect infrastructure and maintain activity records where technically appropriate. We retain data no longer than needed for the processing purpose, contract performance, resolution of an enquiry or mandatory legal requirements.
- Working access is granted only when needed
- A contact can be excluded from future communications
- Incorrect or outdated information is corrected or deleted
- Incidents are reviewed separately and further access is restricted where necessary
When this policy does not apply
This policy does not govern data processed by independent websites, services or social networks after you follow an external link. It also does not replace the terms of a specific agreement: where the parties agree a separate process for documents, access credentials or confidential information, that process applies unless it conflicts with mandatory requirements.
We may not be able to delete information immediately if it is needed for an unfinished obligation, confirmation of actions already taken or mandatory retention. If so, we will explain what remains and why.
How to exercise your rights
You may request information about processing, correct inaccurate data, ask us to stop non-essential communications, withdraw consent where processing relies on it, or raise a data-protection question. Write to us through Contact and include enough information to locate the relevant correspondence without risking disclosure to another person.
We may update this policy when our processing practices change. The current version is published on this page.