Privacy policy

1.Who is responsible

Kowiste is the controller of the personal data described here, except for data we process on behalf of a customer (see “Data our customers put in the platform”).

For anything about privacy, write to info@kowiste.com.

2.This website

This website sets no cookies and uses no analytics or advertising tools. Its fonts are served from our own server, so no third party learns that you visited.

If you switch to the dark theme, the choice is saved in your browser's local storage. It never leaves your device.

Like any web server, ours records technical data about each request — IP address, time, page and browser — to keep the site running and secure. These records are kept only as long as that purpose needs.

When you write to us with “Contact us”, we use your email address and your message to answer you, and keep them as long as the conversation needs.

3.Your account on the platform

To give you an account we process your name, email address, organization and role, and a phone number if you add one. We use them to sign you in, to send the notifications you or your organization set up, and to support you.

Sign-in runs on our own service. It uses only the cookies and browser storage needed to keep you signed in.

We keep a security log of sign-in activity for 90 days and application logs for 30 days. Passwords never appear in logs, and email addresses and phone numbers are removed from them.

4.Data our customers put in the platform

Organizations use Kowiste to store readings from their devices and information about their users and assets. For that data the organization is the controller and we are its processor: we handle it only to provide the service, under the data processing terms of our agreement with them.

Each organization's data is kept in its own database schema. Readings are kept for the retention period set for each branch; notifications in the app and generated reports for 90 days; the last 100 messages of each device.

If your data is in an organization's account and you want to exercise your rights, contact that organization; we will help them answer.

5.Why we may use it

We use personal data only when the law allows it:

• to provide the service you or your organization signed up for (performance of a contract);
• to keep the website and platform secure and working, and to answer you (our legitimate interests);
• to meet legal obligations, such as tax and accounting rules.

6.Who we share it with

We don't sell personal data. A small number of providers process it on our behalf, under contract:

• Brevo (Sendinblue SAS, France), to send email;
• the provider that hosts our servers.

If your organization uses a dedicated instance or runs Kowiste on its own servers, its data stays on that infrastructure. If a provider processes data outside the European Economic Area, we rely on an adequacy decision or the European Commission's standard contractual clauses.

7.Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to its use, or to receive it in a portable format. Write to info@kowiste.com; we answer within one month.

You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

8.How we protect it

Each organization and branch has its own database schema; devices sign in with their own credentials; API keys are stored only as hashes; the services run in hardened, read-only containers; and every request is traced so problems can be investigated.

9.Changes to this policy

If we change this policy we will update the date at the top, and tell account holders by email when the change matters.