Privacy notice

Who we are

kymeer.com is operated by Cyclades One LLP (“kymeer”, “we”). We decide why and how personal data collected through this website is used, so we are its data fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and its controller under the EU and UK General Data Protection Regulation (GDPR), where that applies.

This notice covers this website only. Data that customers and partners process in the kymeer platform or the partner portal is governed by their agreements with kymeer. Questions: [email protected].

What we collect and why

• Enquiries: name, work email, company, country, optional role and phone, your message and the page you sent it from. We use them to reply and to introduce the kymeer partner who will serve you.
• Document requests: name, work email and company. We use them to email you a download link and, as the form says, to contact you about that document.
• Vulnerability reports: summary, details and, if you give them, your email and the name to credit. They are encrypted when stored and used only to investigate and fix the issue.
• Security of the forms: with each submission we keep your IP address only as a salted hash, to limit abuse. Our hosting keeps short-lived server logs for security and troubleshooting.
• Consent records: which version of this notice you agreed to and when.
• Site statistics: anonymous statistics about every visit, described in the next section.

We do not ask for sensitive personal data and ask you not to include any in your message.

Site statistics

For every visit, whatever your cookie choice, we record the page, the referring website, campaign tags (utm_*), country, device type, browser and operating system, and clicks on calls to action, outbound links, downloads and form submissions. This uses no cookies and stores nothing on your device.

Your IP address is not stored. To count unique visitors it is combined with your browser’s user-agent under a random value that we keep for one day only and then delete, so visits can be counted but not linked across days or traced back to you.

If you choose “Allow measurement”, we also keep a random ID in your browser’s local storage so we can recognise your later visits; choosing “Anonymous only” deletes it. The ID is never combined with what you type into our forms.

Statistics are used only by kymeer to measure and improve this website. They are not used to profile you, never sold, and never shared for advertising or with any third party.

Legal basis

• Forms: your consent, given with each form. You can withdraw it at any time, as easily as you gave it, by writing to us; withdrawal does not affect what we did before.
• Optional browser ID: your consent, given in the banner and withdrawn by choosing “Anonymous only”.
• Anonymous statistics: they are designed not to identify anyone, because no IP address, cookie or lasting identifier is stored. Where the GDPR applies, we rely on our legitimate interest in understanding how our website is used. We have weighed that interest against yours and limited the data so that it cannot identify you.
• Security of the forms and site: our legitimate interest in keeping the website and its users safe, and, for submissions, the consent given with the form.

Who receives it

• The kymeer business team, and the kymeer partner we introduce you to. That partner is then responsible for its own use of your details under its own privacy notice.
• Enquiries are also recorded in kymeer’s partner portal so they can be assigned.
• Vulnerability reports are seen only by kymeer product security.
• Service providers who act on our instructions: Cloudflare (network and the security check on our forms), Mailgun (email delivery, EU region) and our hosting providers in India.
• Authorities, where the law requires us to disclose it.

We do not sell personal data and do not share it for advertising.

Where it is stored

Website submissions are stored in India. Email is delivered through Mailgun’s EU region, and Cloudflare operates a global network. The partner we introduce you to may be in another country. Where the GDPR applies to a transfer, we use the safeguards it requires, such as standard contractual clauses.

How long we keep it

• Enquiries: 24 months from submission.
• Document requests: 12 months from the request. Download links expire after 24 hours or five uses, whichever comes first.
• Vulnerability reports: 3 years from submission, so that we can track fixes and advisories.
• Copies of emails we have sent: 30 days after delivery.
• Site statistics: 13 months.
• Server logs: a short period, for security and troubleshooting.

Records are then deleted automatically, unless the law requires us to keep them longer.

How we protect it

Traffic to this website is encrypted. Vulnerability reports are encrypted at rest. IP addresses are kept only as hashes. Access is limited to the people who need it for the purposes above.

Your rights

• Under the DPDP Act: to obtain a summary of your personal data and how it is processed, to have it corrected, completed, updated or erased, to withdraw consent, to have grievances redressed, and to nominate someone to exercise your rights if you die or are unable to.
• Under the GDPR, where it applies: access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent, and complaint to your data protection authority.

Write to [email protected] with the subject “Privacy request”. We may need to confirm your identity, and we reply within 30 days. Because the anonymous statistics cannot be linked to you, we cannot find or delete your visits in them; choosing “Anonymous only” removes the optional browser ID.

Grievance officer

The Grievance Officer, Cyclades One LLP. Email [email protected] with the subject “Grievance”. If you are not satisfied with our response, you may complain to the Data Protection Board of India or, where the GDPR applies, to your data protection authority.

Children

This website is meant for businesses and is not directed at anyone under 18. We do not knowingly collect children’s data; if you believe we have, write to us and we will delete it.

Automated decisions

We do not make decisions about you based solely on automated processing.

Cookies and storage

See the cookies notice.

Changes

We will post any change here with a new effective date, and tell you directly where a change materially affects data you have already given us. Effective date: 31 October 2026.