Kolay İK Contracts & Policies

Privacy Policy (UK)

Last Updated: 30.03.2026

Effective Date: 30.03.2026

Kolay IK Limited ("Kolay IK", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This policy is for information purposes only and does not form part of any contract. This Privacy Policy explains how we look after your personal data when you visit our website (kolayik.co.uk) or use our services, and tells you about your privacy rights and how the law protects you.

1. WHO WE ARE AND OUR ROLE

1.1. Data Controller vs. Data Processor: It is important to understand our role under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• As a Data Controller: When you visit our website, contact our sales/support teams, or when we manage our business relationship with your company, Kolay IK Limited is the Data Controller. This policy primarily applies to this data.
• As a Data Processor: When your employer uses the Kolay IK HR SaaS platform and uploads your employee data (e.g., payroll, leave requests), your employer is the Data Controller, and we act purely as a Data Processor acting on their documented instructions. If you are an employee of a Kolay IK customer, you should direct any data privacy requests to your employer first.

1.2. Contact Details:

• Company Name: Kolay IK Limited
• Registered Address: Capital Office, 124-128 City Road, London, EC1V 2NX
• Privacy Email Address: privacy@kolayik.co.uk

2. THE DATA WE COLLECT AND OUR LAWFUL BASIS

We will only use your personal data when the law allows us to. We have set out below a description of all the ways we plan to use your personal data and the legal bases we rely on to do so.

• To register you as a new B2B customer — Type of data: Identity, Contact; Lawful basis: Performance of a contract with you.
• To manage our relationship (invoicing, support) — Type of data: Identity, Contact, Financial; Lawful basis: Performance of a contract; Necessary for our legitimate interests (to keep our records updated).
• To administer and protect our business and website — Type of data: Technical (IP address), Usage; Lawful basis: Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security).
• To deliver relevant website content and marketing — Type of data: Identity, Contact, Usage; Lawful basis: Consent (for direct marketing emails); Legitimate interests (for non-marketing communications and website analytics).

Note: Where we rely on Legitimate Interests, we have conducted a Legitimate Interests Assessment (LIA) to ensure your interests and fundamental rights do not override our interests.

(Note: We do not process Special Categories of Personal Data (such as health, trade union, or ethnicity data) either as a Controller or a Processor, unless specifically instructed under a separate agreement.

3. DISCLOSURES OF YOUR PERSONAL DATA

We may share your personal data with the following categories of external third parties:

• Service Providers (listed as Sub-processors in Annex 2 of our Data Processing Agreement): Sub-processors acting as processors who provide cloud hosting (Amazon Web Services), IT and email delivery (Brevo, Google Workspace), customer support (Crisp), and system administration services (Sentry).
• Professional Advisers: Acting as processors or joint controllers, including lawyers, bankers, auditors, and insurers based in the UK or EEA where adequacy applies.
• Regulatory Authorities: HM Revenue & Customs, regulators, and other authorities acting as processors or joint controllers based in the United Kingdom or EEA where adequacy applies.

4. INTERNATIONAL TRANSFERS

Kolay IK Limited is a UK-registered company. To ensure the highest level of data protection, all customer platform data and primary databases are hosted securely within the European Economic Area (EEA), specifically in Frankfurt, Germany, via Amazon Web Services (AWS).

The UK recognizes the EEA as providing an "adequate" level of data protection. Therefore, data transfers to our Frankfurt servers are lawful under UK GDPR Chapter V without the need for additional safeguards such as an International Data Transfer Agreement (IDTA).

5. DATA RETENTION

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, tax, accounting, or reporting requirements.

• Customer account data (billing/contracts): Retained for 6 years after the contract ends to comply with UK tax and company laws.
• Platform Employee Data (Processor role): Deleted or returned to the Controller upon termination of the subscription, as governed by our Data Processing Agreement.

6. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under UK data protection laws in relation to your personal data:

• Request access to your personal data (Subject Access Request).
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data.
• Object to the processing of your personal data where we are relying on a legitimate interest.
• Request restriction of processing of your personal data.
• Request the transfer of your personal data to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of the rights set out above, please contact us at privacy@kolayik.co.uk. We will respond to all legitimate requests within one calendar month, which may be extended in complex cases. Please note that if we process your data on behalf of your employer, we will forward your request to them as the Data Controller.

7. DATA PROTECTION COMPLAINTS PROCEDURE (DUAA 2025 COMPLIANT)

In accordance with the Data (Use and Access) Act 2025 (DUAA), Kolay IK Limited will operate a statutory data protection complaints procedure from 19 June 2026 onwards. We take your privacy concerns seriously and are committed to resolving them fairly and transparently.

7.1. How to Submit a Complaint

To help us process your complaint efficiently, please submit it in writing using one of the following methods:

• By Email: Send your complaint to privacy@kolayik.co.uk. Please use the subject line "Data Protection Complaint".
• By Post: Privacy Team, Kolay IK Limited, Capital Office, 124-128 City Road, London, EC1V 2NX.

7.2. What to Include in Your Complaint

To allow us to investigate effectively, please provide:

• Your full name and contact email address.
• Your relationship to Kolay IK (e.g., direct customer, website visitor, or an employee of a Kolay IK customer).
• If you are an employee of a Kolay IK customer, please state your employer's name.
• Clear details of your complaint and how you believe your data protection rights have been impacted.

7.3. Our Complaint Handling Process

Once we receive your complaint, we will follow this structured process:

• Step 1: Triage (Controller vs. Processor): We will first determine our legal role with respect to your data. If your complaint relates to HR data uploaded to our platform by your employer, Kolay IK acts only as a Data Processor. As a Processor, we act only on the documented instructions of your employer (the Controller) and therefore will forward your request to them for their attention. If you are an employee of a Kolay IK customer, please direct your request primarily to your employer.
• Step 2: Acknowledgement: For all complaints in which we act as the Data Controller, we will formally acknowledge receipt within 30 days of receipt.
• Step 3: Investigation and Progress: We will investigate your concerns impartially and without undue delay, and keep you informed of the progress of our investigation where appropriate. We may contact you if we need further information to understand the issue fully.
• Step 4: Resolution and Timescale: We will provide you with a written response detailing the outcome of our investigation and any actions we have taken or intend to take to resolve the matter. We aim to provide a substantive response within 90 days, where possible; if the investigation will take longer, we will inform you why.

7.4. Escalation to the ICO

If you remain dissatisfied with our response or how we have handled your complaint, you have a statutory right to escalate the matter to the UK’s Information Commissioner’s Office (ICO).

• ICO Website: <https://ico.org.uk/make-a-complaint/>
• ICO Helpline: 0303 123 1113

We respectfully request that you complete our internal complaints procedure before contacting the ICO so that we can resolve your concerns directly.

8. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies on our website (kolayik.co.uk). For detailed information about how we use cookies, the purposes for which we use them, and how you can manage your preferences, please refer to our dedicated Cookie Policy.

9. CHILDREN’S PERSONAL DATA

Our website and services are not directed at children. We do not knowingly process personal data relating to children.

10. AUTOMATED DECISION-MAKING

We do not make decisions about you based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

11. UPDATES TO THIS POLICY

We may update this policy from time to time. We encourage you to review this policy periodically to stay informed about how we are protecting your personal data.

‍