In short: when you use KT8 Tools or ReaderCount, some of the personal data we hold belongs to other people you deal with, such as your status page subscribers, your clients or your website’s visitors. For that data you are the controller and we are your processor. This agreement sets out how we look after it, as UK GDPR Article 28 requires. It applies automatically when you use our services as a business, and there’s nothing to sign.
1. About this agreement
This agreement is between KT8 Digital Limited (“KT8”, “we”), a company registered in England and Wales with company number 17532743, and the business that uses KT8 Tools or ReaderCount (“you”). It forms part of our terms of service and the ReaderCount terms, and applies whenever we process personal data on your behalf. If you’d like a copy with both our names on it for your records, email privacy@kt8.com.
Where this agreement and the terms differ about personal data we process for you, this agreement wins. Data we collect for our own purposes, such as your account, sign-ins and payments, is covered by our privacy policy instead, where we are the controller.
2. What we process for you
We process personal data for you only to provide the features you choose to use, for as long as you use them.
- Status page subscribers: the email addresses of people who subscribe to your status page, when they confirmed, and the incident emails we send them.
- Agency client portals: the email addresses of the people you add to a client portal (and names, if you add them), their sign-in records and any passkeys they add.
- Your team: the email addresses of people you add to your account or agency team, and what they do with the tools.
- Mail tester and DMARC reports: the email you send to a monitoring address, and the DMARC reports sent to us for your domains. These can contain email addresses, names and server IP addresses.
- ReaderCount: the pages your visitors read, where they came from, their country and type of device, and a visitor key that changes every day. ReaderCount sets no cookies. The ReaderCount privacy policy describes exactly what’s kept.
The people this data is about are your subscribers, clients, team members, email correspondents and website visitors. We don’t ask for special category data such as health information, and you shouldn’t send it to us through these features.
3. Our commitments
- We process the data only on your instructions, which are these terms and the way you set up and use our services. If we’re required by law to do anything else, we’ll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we’ll tell you.
- Everyone at KT8 who can see the data is bound to keep it confidential.
- We protect it with appropriate technical and organisational measures, including encryption in transit, sign-in with emailed codes, passkeys or authenticator apps, access limited to the people who need it, and security logs kept for 90 days.
- We only use the sub-processors listed below, and hold each of them to data protection terms that protect the data at least as well as this agreement.
- We help you respond when someone asks to see, correct or delete their data. Much of this you can do yourself, for example by removing a subscriber or client. If a request reaches us directly, we’ll pass it to you.
- We help you with security, breach notifications, data protection impact assessments and any consultation with the Information Commissioner’s Office, as far as they relate to our services and the information we have.
- We never sell the data, use it for adverts or use it for our own purposes.
4. Who helps us
You give us general permission to use these sub-processors. We’ll update this list and email you at least 30 days before we add or replace one, so you can object. If you object on reasonable data protection grounds and we can’t resolve it, you can stop using the affected feature or cancel your plan.
- Cloudflare, Inc.: hosting, databases and storage for KT8 Tools and ReaderCount, and sending emails when Amazon can’t.
- Amazon Web Services EMEA SARL: sending emails through Amazon SES in Ireland, including status page and client portal emails, receiving mail at monitoring addresses, and running speed tests in the countries you pick.
If you connect another service yourself, such as Google Search Console or an AI assistant in ReaderCount, that service works for you under its own terms, not as our sub-processor.
5. Outside the UK
Our data is stored in Western Europe, but Cloudflare’s network is worldwide, so data can pass through other countries on its way. Where a sub-processor handles personal data outside the UK, we rely on the safeguards in that sub-processor’s data protection terms.
6. If something goes wrong
If we become aware of a personal data breach affecting data we process for you, we’ll tell you without undue delay. We’ll explain what happened, what data and people are affected, what we’re doing about it and who you can contact, and we’ll add details as we learn them. This helps you meet your own duty to report breaches.
7. When you leave
You can export or delete most data yourself at any time. When you delete your account, we delete the data we process for you straight away, and it clears from our database backups within 30 days. When a plan ends, we delete what it paid for 30 days later, as our terms explain. We keep a copy only where the law requires it.
8. Checking we keep to this
We’ll answer reasonable questions and give you the information you need to show that we keep to this agreement. If that isn’t enough, you or an auditor you choose, bound to confidentiality, can inspect how we handle the data, with reasonable notice and at your own cost, no more than once a year unless there has been a breach.
9. General
This agreement lasts for as long as we process personal data for you. Limits on liability in our terms apply to it. It is governed by the law of England and Wales. For anything about it, email privacy@kt8.com.