Privacy Policy

Kikan System is currently developed and operated by its founder as an individual project. A legal entity will be established before the Service becomes generally available. Until then, the operator and data controller for the website is the founder.

The operating company is not yet registered. It will be established before the Service becomes generally available, and this notice will be updated then.

You can contact us at any time at [email protected].

Because Kikan System is delivered as software that businesses use to run their operations, there are two relationships to understand:

• For information about website visitors and prospective customers (Section 3A), Kikan System is the data controller; we decide why and how that information is used.
• For Customer Data that your organization enters into the Service (Section 3C), your organization is generally the data controller and Kikan System acts as a data processor, handling that data on your behalf under your instructions and your customer agreement. The detailed terms are set out in a separate Data Processing Addendum (DPA) agreed with each customer.

If your organization uses the Service to manage information about your employees or contacts, you remain responsible for having a lawful basis and providing any notices they are due; Kikan System supports you in fulfilling those obligations.

A. Website visitors. When you browse kikansystem.com or submit the contact form, we may handle: your name, work email, company name, and any message you choose to send (via a third-party form service); usage and analytics data collected through Google Analytics (for example approximate region, browser and device type, pages viewed, and how you reached the site); and basic technical data transmitted as part of normal web requests.

B. Account data. When the Service is available, customer users will have account information such as name, email address, organization, role, and authentication data needed to sign in and keep the account secure.

C. Customer Data in the Service. The Service is a modular ERP. Depending on the modules a customer uses, it may hold business records and personal data that the customer chooses to enter, such as: customer, supplier, and business-partner contacts; sales and purchase records; inventory data; accounting and tax records; CRM data; employee information including attendance, timesheet, leave, and expense records; project and manufacturing data; and B2B-portal accounts for external business-partner users. Kikan System does not decide what data customers enter; customers are responsible for the lawfulness of the Customer Data they provide.

We use information only for defined purposes:

• Website: to respond to inquiries, provide information about Kikan System, improve the website through aggregated analytics, and detect abuse or fraudulent submissions.
• Service: to provide, maintain, secure, and support the Service for our customers, to process Customer Data according to each customer's instructions and agreement, and to comply with legal obligations.

We do not sell personal information, and we do not use Customer Data to train our own models. Aggregated, de-identified data may be used to improve the Service.

Where laws such as the EU/UK GDPR apply, we rely on: your consent (for example analytics cookies, which you can withdraw); the performance of a contract and steps taken at your request (providing the Service and responding to inquiries); our legitimate interests (securing and improving the Service); and compliance with legal obligations. For Customer Data processed as a processor, the legal basis is determined by the customer controller under the DPA.

The website uses Google Analytics to understand usage in aggregate; Google Analytics may set cookies on your device, which you can control or block in your browser settings without affecting website access. The Service uses only the technical and session cookies necessary to keep you signed in and the application working; additional non-essential cookies, if any, will be listed here before launch.

The website relies on: Web3Forms (delivers contact-form submissions to us by email) and Google Analytics (aggregated usage data).

The Service runs on cloud infrastructure and relies on standard service providers, such as those for hosting, transactional email, and error and performance monitoring. We enter into appropriate agreements with these providers, notify customers of material changes to sub-processors, and make a current sub-processor list available on request and in the DPA. Some elements of the Service are still under development; contact us for current details.

Website contact-form submissions are kept only as long as needed to respond and for reasonable follow-up. Analytics data is retained according to the relevant provider's default settings. Customer Data is retained for the duration of the customer relationship and afterward as set out in the customer agreement and DPA, including any backup or legal-hold periods, and is then deleted or returned.

Third-party services and sub-processors may process data outside your country, so information may be transferred to and stored in other locations. By using the website or Service you acknowledge this possibility. Where required, we apply appropriate safeguards, such as standard contractual clauses. The primary location where Customer Data is stored will be confirmed with each customer.

We take reasonable technical and organizational measures to protect information, including access controls and monitoring. For Customer Data, the specific security commitments are set out in the customer agreement and DPA. No system is completely secure, so we cannot guarantee absolute security, but we work to protect the information entrusted to us.

If a personal-data breach affecting Customer Data occurs, we will assess and contain it and notify affected customers without undue delay, in line with the DPA and applicable law, so customers can meet their own notification obligations. For website visitor data, we will handle any incident in accordance with applicable law.

Depending on your location, you may have rights such as access, correction, deletion, objection to, or restriction of certain processing. Website visitors can exercise these rights by emailing [email protected]. If you are a user of the Service whose data was entered by your organization, your rights regarding Customer Data are generally handled through your organization (the controller); we assist organizations in fulfilling such requests under the DPA.

The website and Service are intended for business use and are not directed at individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can delete it.

We may update this Privacy Policy as the Service develops, when the operating entity is established, and when sub-processors and hosting are confirmed. The "Last updated" date above reflects the latest version. We will notify customers of material changes affecting Customer Data as required by the DPA.

For any privacy question or request, contact us at [email protected]. Once a legal entity is established, a formal postal address and a data-protection or privacy contact will be added here.