LEGAL
LEGAL
Privacy policy
Kuli is a platform provided by Kuli SAS, a French simplified joint-stock company with a capital of €100, registered in the Nanterre Trade and Companies Register under number 930 631 080, domiciled at 63 Rue Jules Guesde, 92300 Levallois-Perret, France.
Kuli is primarily hosted by Microsoft Azure.
Welcome to Kuli!
Please read this privacy policy carefully before using the Platform.
Kuli enables any legal entity with full legal capacity and registered on the website kuli.one (hereinafter a “Client”) to benefit from an enhanced user interface. Kuli provides each Client access to its platform (hereinafter the “Platform”).
Kuli offers a Platform that facilitates web-based personnel administration within a firm—used by their employees or designated natural persons within the Platform (hereinafter, each a “User”)—to streamline the monitoring of human resources, financial, and data security processes (hereinafter the "Services").
For more information regarding the Services, Kuli's Terms of Use and Terms of Service are available here: https://kuli.one/terms-of-services.
Kuli firmly believes that trust is key to its relationships with Clients and Platform Users. In this respect, the protection of Users' privacy is one of its top priorities.
This is why Kuli places great emphasis on collecting and processing Users' data with the utmost care and in compliance with the applicable legal framework.
To inform Clients and Users transparently, Kuli has implemented the privacy policy below, which explains in detail why and how personal data are processed when Users navigate the Platform.
Version in force as of: January 2025
1. Scope
This privacy policy (hereinafter the “Privacy Policy”) is intended to inform Users about how Kuli controls their use of their workspace on the Platform (hereinafter a "Workspace"), enabling them to be identified, either directly or indirectly (hereinafter “Personal Data”), as a controller or processor.
This Privacy Policy is accessible at any time on the website and prevails over any previous version. The Privacy Policy may evolve. The up-to-date version is the one available on the website when using it.
2. Identifying Data Controller and Processor
Regulation (EU) 2016/679 (General Data Protection Regulation) differentiates between the data “Controller” and “Processor.” In most cases, Kuli acts as a processor and each Client as a controller of the Users’ Personal Data. Clients may, for example, grant and remove access to a Workspace, assign roles, configure settings, access, modify, export, share, or remove Personal Data from a Workspace.
Kuli shall not be held liable for a Client’s collecting and processing of Personal Data for its own purposes.
Kuli may collect and receive Personal Data as a Controller, as described in Section 3 (Data Collected, Purposes, and Storage Periods).
3. Data Collected, Purposes, and Storage Periods
When Users navigate the Platform, Kuli processes Personal Data for specific purposes, each duly legitimized by a valid legal basis. Kuli stores Personal Data for a limited duration, not exceeding the fulfillment of the purposes described herein.
Users are under no obligation to provide Personal Data. Nevertheless, Kuli draws Clients' and Users’ attention to the fact that, in such a case, access to the Platform and use of the Services may be altered, if not impossible.
3.1 Account Management
Each User will have to join a Workspace to access the Platform.
The User will need to create an account when joining a Workspace. To manage each account and to allow Clients access to content reserved only for Workspace holders, Kuli collects and processes the following Personal Data: name, date of birth, telephone number, email, address, login, and password to access the account. The legal basis of this processing is the necessity for Kuli to perform the contract to which the User is a party—Kuli hereby refers to the User Terms available here https://kuli.one/terms-of-services.
Kuli will retain your Personal Data until such an account is closed. Nevertheless, if Kuli needs to retain your Personal Data for evidence purposes beyond the date the account is closed, the maximum retention period applicable will then be in line with the statute of limitation and will not exceed the period during which Kuli is required to retain evidence.
3.2 Browsing Information or "Cookies"
Kuli strives to make the Platform as useful as possible for Users. For example, Kuli may improve search functionality to help determine and rank the relevance of content or channels to a specific User, customize the Platform experience, or create new productivity features and products. Consequently, Kuli seeks to understand how Users interact with the Platform and needs to process various browsing information resulting from Cookies that qualify as Personal Data, for the performance of analytic operations related to Platform use.
In this respect, the legal basis Kuli relies upon is its legitimate interest, which consists of (i) understanding how its Platform is browsed by Users and visitors (including Clients); and (ii) improving the Platform where needed.
The Personal Data processed by Kuli or on its behalf for performing analytic operations shall not be retained by Kuli after the analytic operations are finalized and the corresponding reports/summaries are completed. Where the applicable retention period expires, Kuli either deletes your Personal Data or irrevocably anonymizes it so that you can no longer be identified.
3.3 Communication with Kuli
Kuli collects and processes User's Personal Data for managing and following up on any questions, requests, or feedback a User may submit. As such, please note that this processing is only carried out if a User submits a question, request, or feedback directly on the Platform or to Kuli's email or postal address. Otherwise, User's Personal Data is not processed for this purpose. This processing requires Kuli to collect and process the following categories of Personal Data: (i) identification data (i.e., the information the User provides, including their name and email address) and (ii) the content of the message(s) User sends to Kuli as part of the question, request, or feedback.
While processing User's Personal Data for this purpose, Kuli relies on its legitimate interest, which consists of duly managing its relationships with Users.
Kuli will not retain Personal Data for this purpose for more than two (2) years following the last contact on User's initiative.
3.4 Third-Party Integrations
You may connect third-party integrations to your Kuli account, which may ask for certain permissions to access data or send information to your Kuli account. It is your responsibility to review any third-party integrations you authorize.
4. Minimization
In any event, and disregarding the processing purpose at stake, please note that Kuli will comply with a strict data minimization principle and will thus only collect and process Personal Data which is necessary for the above purposes.
5. Archiving
Where Kuli considers it does not need to retain User's Personal Data in its active database, it will archive it and will ensure that access thereto is restricted to a limited number of persons who have an actual need to access User's Personal Data.
Kuli keeps a register of processing activities carried out on behalf of Clients when they act as controller. Kuli provides the controller with all the information necessary to demonstrate compliance with its obligations and allow audits to be carried out.
6. Data Recipients
Kuli shares and discloses Personal Data with Clients, solely in accordance with a Client’s instructions, in compliance with the Terms of Service and with any applicable law and legal process.
Kuli shares User's Personal Data with third-party service providers and suppliers which assist Kuli in fulfilling the purposes specified in this Privacy Policy. The service providers and suppliers may have access to Personal Data for the sole and exclusive purpose of carrying out the missions assigned to them. Kuli ensures that the service providers and suppliers offer sufficient guarantees for the performance of the mission and comply with the applicable laws and regulations.
Furthermore, as the case may be, Kuli shares User's Personal Data with competent courts and any other governmental and/or public authorities requesting access to User's Personal Data, within the extent legally permitted.
In any event, Kuli communicates User's Personal Data to the above recipients on a strictly need-to-know basis and only as necessary for fulfilling duly identified processing purposes.
Kuli keeps an up-to-date list of the subcontractors: AWS, Datadog, Rollbar, Slack, Hubspot, Heroku.
Transfers Outside the European Union
Personal Data may be processed outside the European Union territory. In that situation, Kuli shall take all necessary precautions and alternatively or cumulatively ensures that (i) an adequacy decision has been taken by the European Commission regarding the country of destination; (ii) contractual clauses adopted by the European Commission or the supervisory authority have been signed with the recipient.
Please note that, as part of the processing implemented for the purposes mentioned above in Section 3 (Data collected, purposes and storage periods), Kuli transfers User's Personal Data to Google LLC which is located outside the European Union, in the United States of America.
This country does not benefit from an adequacy decision by the European Commission, depriving transferred Personal Data of an adequate level of protection.
Nevertheless, User is hereby expressly informed that Kuli implements the following guarantees, additionally to the measures listed above, to protect User's Personal Data in the event of such transfer: encryption; Kuli undertakes to limit as much as possible the data that could not be encrypted to cases of absolute necessity; management of security incidents; access limited to authorized personnel and to the extent necessary; a secure subcontractor architecture in accordance with industry standards; regular reviews of the internal policies of its providers to assess the adequacy of the personal data security measures implemented; identification and implementation of additional or alternative solutions if necessary.
In addition, Kuli undertakes to inform the person concerned by a transfer of his/her data outside the European Union about: the laws and regulations that would allow U.S. government authorities to access the personal data being transferred; any requests for access to Personal Data by public authorities that Kuli has received during the previous semester.
Finally, Kuli certifies that it has not deliberately, or as a matter of legal obligation, created backdoors or similar programs that could be used to access the system and/or personal data, nor has it created or modified its business processes in a manner that would facilitate such access.
Users' Rights
As data subjects, Users benefit from various rights regarding the processing of their Personal Data. These are as follows:
Right to request from Kuli access to and rectification or erasure of User's Personal Data;
Right to request from Kuli restriction of the processing concerning User;
Right to object to the processing of User's Personal Data;
Right to portability of User's Personal Data;
Right to give guidelines regarding the use of User's Personal Data after User's death;
Right to complain with the French Data Protection Authority (CNIL), the competent supervisory authority.
To exercise User's rights or for any question on Personal Data protection, Users shall make a request accompanied by proof of identity by mail addressed to Kuli - 63 rue Jules Guesde, 92300 Levallois-Perret, France or by email at admintools@kuli.one.
Kuli shall strive to reply without undue delay and at the latest within one (1) month after the receipt of the request.
Kuli reserves the right to extend this period to three (3) months in the case of a complex request. Kuli is committed to protecting User's Personal Data and complying with the applicable data protection legal framework.
This is the reason why Kuli requires User's assistance to this end. Thus, Users commit to informing Kuli if the Personal Data they shared with us becomes obsolete or inaccurate.
In addition, in the event User provides Kuli with information enabling to identify directly or indirectly any other natural persons (e.g., User sends a request to Kuli with the contact email address available on the Services and shares personal data concerning another natural person in User's email), User represents and warrants that, prior to sharing this information with Kuli, such other natural persons have been provided with this Privacy Policy and, to the extent applicable, have consented to the processing of their data.
When Kuli acts as processor of Personal Data, Clients are responsible for the processing of requests from Users to exercise their rights. However, Kuli undertakes to assist Clients in the processing of these requests.
9. Security
Kuli undertakes to take appropriate technical and organizational measures to ensure the security and confidentiality of the personal data processed.
Kuli is a platform provided by Kuli SAS, a French simplified joint-stock company with a capital of €100, registered in the Nanterre Trade and Companies Register under number 930 631 080, domiciled at 63 Rue Jules Guesde, 92300 Levallois-Perret, France.
Kuli is primarily hosted by Microsoft Azure.
Welcome to Kuli!
Please read this privacy policy carefully before using the Platform.
Kuli enables any legal entity with full legal capacity and registered on the website kuli.one (hereinafter a “Client”) to benefit from an enhanced user interface. Kuli provides each Client access to its platform (hereinafter the “Platform”).
Kuli offers a Platform that facilitates web-based personnel administration within a firm—used by their employees or designated natural persons within the Platform (hereinafter, each a “User”)—to streamline the monitoring of human resources, financial, and data security processes (hereinafter the "Services").
For more information regarding the Services, Kuli's Terms of Use and Terms of Service are available here: https://kuli.one/terms-of-services.
Kuli firmly believes that trust is key to its relationships with Clients and Platform Users. In this respect, the protection of Users' privacy is one of its top priorities.
This is why Kuli places great emphasis on collecting and processing Users' data with the utmost care and in compliance with the applicable legal framework.
To inform Clients and Users transparently, Kuli has implemented the privacy policy below, which explains in detail why and how personal data are processed when Users navigate the Platform.
Version in force as of: January 2025
1. Scope
This privacy policy (hereinafter the “Privacy Policy”) is intended to inform Users about how Kuli controls their use of their workspace on the Platform (hereinafter a "Workspace"), enabling them to be identified, either directly or indirectly (hereinafter “Personal Data”), as a controller or processor.
This Privacy Policy is accessible at any time on the website and prevails over any previous version. The Privacy Policy may evolve. The up-to-date version is the one available on the website when using it.
2. Identifying Data Controller and Processor
Regulation (EU) 2016/679 (General Data Protection Regulation) differentiates between the data “Controller” and “Processor.” In most cases, Kuli acts as a processor and each Client as a controller of the Users’ Personal Data. Clients may, for example, grant and remove access to a Workspace, assign roles, configure settings, access, modify, export, share, or remove Personal Data from a Workspace.
Kuli shall not be held liable for a Client’s collecting and processing of Personal Data for its own purposes.
Kuli may collect and receive Personal Data as a Controller, as described in Section 3 (Data Collected, Purposes, and Storage Periods).
3. Data Collected, Purposes, and Storage Periods
When Users navigate the Platform, Kuli processes Personal Data for specific purposes, each duly legitimized by a valid legal basis. Kuli stores Personal Data for a limited duration, not exceeding the fulfillment of the purposes described herein.
Users are under no obligation to provide Personal Data. Nevertheless, Kuli draws Clients' and Users’ attention to the fact that, in such a case, access to the Platform and use of the Services may be altered, if not impossible.
3.1 Account Management
Each User will have to join a Workspace to access the Platform.
The User will need to create an account when joining a Workspace. To manage each account and to allow Clients access to content reserved only for Workspace holders, Kuli collects and processes the following Personal Data: name, date of birth, telephone number, email, address, login, and password to access the account. The legal basis of this processing is the necessity for Kuli to perform the contract to which the User is a party—Kuli hereby refers to the User Terms available here https://kuli.one/terms-of-services.
Kuli will retain your Personal Data until such an account is closed. Nevertheless, if Kuli needs to retain your Personal Data for evidence purposes beyond the date the account is closed, the maximum retention period applicable will then be in line with the statute of limitation and will not exceed the period during which Kuli is required to retain evidence.
3.2 Browsing Information or "Cookies"
Kuli strives to make the Platform as useful as possible for Users. For example, Kuli may improve search functionality to help determine and rank the relevance of content or channels to a specific User, customize the Platform experience, or create new productivity features and products. Consequently, Kuli seeks to understand how Users interact with the Platform and needs to process various browsing information resulting from Cookies that qualify as Personal Data, for the performance of analytic operations related to Platform use.
In this respect, the legal basis Kuli relies upon is its legitimate interest, which consists of (i) understanding how its Platform is browsed by Users and visitors (including Clients); and (ii) improving the Platform where needed.
The Personal Data processed by Kuli or on its behalf for performing analytic operations shall not be retained by Kuli after the analytic operations are finalized and the corresponding reports/summaries are completed. Where the applicable retention period expires, Kuli either deletes your Personal Data or irrevocably anonymizes it so that you can no longer be identified.
3.3 Communication with Kuli
Kuli collects and processes User's Personal Data for managing and following up on any questions, requests, or feedback a User may submit. As such, please note that this processing is only carried out if a User submits a question, request, or feedback directly on the Platform or to Kuli's email or postal address. Otherwise, User's Personal Data is not processed for this purpose. This processing requires Kuli to collect and process the following categories of Personal Data: (i) identification data (i.e., the information the User provides, including their name and email address) and (ii) the content of the message(s) User sends to Kuli as part of the question, request, or feedback.
While processing User's Personal Data for this purpose, Kuli relies on its legitimate interest, which consists of duly managing its relationships with Users.
Kuli will not retain Personal Data for this purpose for more than two (2) years following the last contact on User's initiative.
3.4 Third-Party Integrations
You may connect third-party integrations to your Kuli account, which may ask for certain permissions to access data or send information to your Kuli account. It is your responsibility to review any third-party integrations you authorize.
4. Minimization
In any event, and disregarding the processing purpose at stake, please note that Kuli will comply with a strict data minimization principle and will thus only collect and process Personal Data which is necessary for the above purposes.
5. Archiving
Where Kuli considers it does not need to retain User's Personal Data in its active database, it will archive it and will ensure that access thereto is restricted to a limited number of persons who have an actual need to access User's Personal Data.
Kuli keeps a register of processing activities carried out on behalf of Clients when they act as controller. Kuli provides the controller with all the information necessary to demonstrate compliance with its obligations and allow audits to be carried out.
6. Data Recipients
Kuli shares and discloses Personal Data with Clients, solely in accordance with a Client’s instructions, in compliance with the Terms of Service and with any applicable law and legal process.
Kuli shares User's Personal Data with third-party service providers and suppliers which assist Kuli in fulfilling the purposes specified in this Privacy Policy. The service providers and suppliers may have access to Personal Data for the sole and exclusive purpose of carrying out the missions assigned to them. Kuli ensures that the service providers and suppliers offer sufficient guarantees for the performance of the mission and comply with the applicable laws and regulations.
Furthermore, as the case may be, Kuli shares User's Personal Data with competent courts and any other governmental and/or public authorities requesting access to User's Personal Data, within the extent legally permitted.
In any event, Kuli communicates User's Personal Data to the above recipients on a strictly need-to-know basis and only as necessary for fulfilling duly identified processing purposes.
Kuli keeps an up-to-date list of the subcontractors: AWS, Datadog, Rollbar, Slack, Hubspot, Heroku.
Transfers Outside the European Union
Personal Data may be processed outside the European Union territory. In that situation, Kuli shall take all necessary precautions and alternatively or cumulatively ensures that (i) an adequacy decision has been taken by the European Commission regarding the country of destination; (ii) contractual clauses adopted by the European Commission or the supervisory authority have been signed with the recipient.
Please note that, as part of the processing implemented for the purposes mentioned above in Section 3 (Data collected, purposes and storage periods), Kuli transfers User's Personal Data to Google LLC which is located outside the European Union, in the United States of America.
This country does not benefit from an adequacy decision by the European Commission, depriving transferred Personal Data of an adequate level of protection.
Nevertheless, User is hereby expressly informed that Kuli implements the following guarantees, additionally to the measures listed above, to protect User's Personal Data in the event of such transfer: encryption; Kuli undertakes to limit as much as possible the data that could not be encrypted to cases of absolute necessity; management of security incidents; access limited to authorized personnel and to the extent necessary; a secure subcontractor architecture in accordance with industry standards; regular reviews of the internal policies of its providers to assess the adequacy of the personal data security measures implemented; identification and implementation of additional or alternative solutions if necessary.
In addition, Kuli undertakes to inform the person concerned by a transfer of his/her data outside the European Union about: the laws and regulations that would allow U.S. government authorities to access the personal data being transferred; any requests for access to Personal Data by public authorities that Kuli has received during the previous semester.
Finally, Kuli certifies that it has not deliberately, or as a matter of legal obligation, created backdoors or similar programs that could be used to access the system and/or personal data, nor has it created or modified its business processes in a manner that would facilitate such access.
Users' Rights
As data subjects, Users benefit from various rights regarding the processing of their Personal Data. These are as follows:
Right to request from Kuli access to and rectification or erasure of User's Personal Data;
Right to request from Kuli restriction of the processing concerning User;
Right to object to the processing of User's Personal Data;
Right to portability of User's Personal Data;
Right to give guidelines regarding the use of User's Personal Data after User's death;
Right to complain with the French Data Protection Authority (CNIL), the competent supervisory authority.
To exercise User's rights or for any question on Personal Data protection, Users shall make a request accompanied by proof of identity by mail addressed to Kuli - 63 rue Jules Guesde, 92300 Levallois-Perret, France or by email at admintools@kuli.one.
Kuli shall strive to reply without undue delay and at the latest within one (1) month after the receipt of the request.
Kuli reserves the right to extend this period to three (3) months in the case of a complex request. Kuli is committed to protecting User's Personal Data and complying with the applicable data protection legal framework.
This is the reason why Kuli requires User's assistance to this end. Thus, Users commit to informing Kuli if the Personal Data they shared with us becomes obsolete or inaccurate.
In addition, in the event User provides Kuli with information enabling to identify directly or indirectly any other natural persons (e.g., User sends a request to Kuli with the contact email address available on the Services and shares personal data concerning another natural person in User's email), User represents and warrants that, prior to sharing this information with Kuli, such other natural persons have been provided with this Privacy Policy and, to the extent applicable, have consented to the processing of their data.
When Kuli acts as processor of Personal Data, Clients are responsible for the processing of requests from Users to exercise their rights. However, Kuli undertakes to assist Clients in the processing of these requests.
9. Security
Kuli undertakes to take appropriate technical and organizational measures to ensure the security and confidentiality of the personal data processed.
Kuli is a platform provided by Kuli SAS, a French simplified joint-stock company with a capital of €100, registered in the Nanterre Trade and Companies Register under number 930 631 080, domiciled at 63 Rue Jules Guesde, 92300 Levallois-Perret, France.
Pappers
Kuli is primarily hosted by Microsoft Azure.
Welcome to Kuli!
Please read this privacy policy carefully before using the Platform.
Kuli enables any legal entity with full legal capacity and registered on the website kuli.one (hereinafter a “Client”) to benefit from an enhanced user interface. Kuli provides each Client access to its platform (hereinafter the “Platform”).
Kuli offers a Platform that facilitates web-based personnel administration within a firm—used by their employees or designated natural persons within the Platform (hereinafter, each a “User”)—to streamline the monitoring of human resources, financial, and data security processes (hereinafter the "Services").
For more information regarding the Services, Kuli's Terms of Use and Terms of Service are available here: https://kuli.one/terms-of-services.
Kuli firmly believes that trust is key to its relationships with Clients and Platform Users. In this respect, the protection of Users' privacy is one of its top priorities.
This is why Kuli places great emphasis on collecting and processing Users' data with the utmost care and in compliance with the applicable legal framework.
To inform Clients and Users transparently, Kuli has implemented the privacy policy below, which explains in detail why and how personal data are processed when Users navigate the Platform.
Version in force as of: January 2025
1. Scope
This privacy policy (hereinafter the “Privacy Policy”) is intended to inform Users about how Kuli controls their use of their workspace on the Platform (hereinafter a "Workspace"), enabling them to be identified, either directly or indirectly (hereinafter “Personal Data”), as a controller or processor.
This Privacy Policy is accessible at any time on the website and prevails over any previous version. The Privacy Policy may evolve. The up-to-date version is the one available on the website when using it.
2. Identifying Data Controller and Processor
Regulation (EU) 2016/679 (General Data Protection Regulation) differentiates between the data “Controller” and “Processor.” In most cases, Kuli acts as a processor and each Client as a controller of the Users’ Personal Data. Clients may, for example, grant and remove access to a Workspace, assign roles, configure settings, access, modify, export, share, or remove Personal Data from a Workspace.
Kuli shall not be held liable for a Client’s collecting and processing of Personal Data for its own purposes.
Kuli may collect and receive Personal Data as a Controller, as described in Section 3 (Data Collected, Purposes, and Storage Periods).
3. Data Collected, Purposes, and Storage Periods
When Users navigate the Platform, Kuli processes Personal Data for specific purposes, each duly legitimized by a valid legal basis. Kuli stores Personal Data for a limited duration, not exceeding the fulfillment of the purposes described herein.
Users are under no obligation to provide Personal Data. Nevertheless, Kuli draws Clients' and Users’ attention to the fact that, in such a case, access to the Platform and use of the Services may be altered, if not impossible.
3.1 Account Management
Each User will have to join a Workspace to access the Platform.
The User will need to create an account when joining a Workspace. To manage each account and to allow Clients access to content reserved only for Workspace holders, Kuli collects and processes the following Personal Data: name, date of birth, telephone number, email, address, login, and password to access the account. The legal basis of this processing is the necessity for Kuli to perform the contract to which the User is a party—Kuli hereby refers to the User Terms available here https://kuli.one/terms-of-services.
Kuli will retain your Personal Data until such an account is closed. Nevertheless, if Kuli needs to retain your Personal Data for evidence purposes beyond the date the account is closed, the maximum retention period applicable will then be in line with the statute of limitation and will not exceed the period during which Kuli is required to retain evidence.
3.2 Browsing Information or "Cookies"
Kuli strives to make the Platform as useful as possible for Users. For example, Kuli may improve search functionality to help determine and rank the relevance of content or channels to a specific User, customize the Platform experience, or create new productivity features and products. Consequently, Kuli seeks to understand how Users interact with the Platform and needs to process various browsing information resulting from Cookies that qualify as Personal Data, for the performance of analytic operations related to Platform use.
In this respect, the legal basis Kuli relies upon is its legitimate interest, which consists of (i) understanding how its Platform is browsed by Users and visitors (including Clients); and (ii) improving the Platform where needed.
The Personal Data processed by Kuli or on its behalf for performing analytic operations shall not be retained by Kuli after the analytic operations are finalized and the corresponding reports/summaries are completed. Where the applicable retention period expires, Kuli either deletes your Personal Data or irrevocably anonymizes it so that you can no longer be identified.
3.3 Communication with Kuli
Kuli collects and processes User's Personal Data for managing and following up on any questions, requests, or feedback a User may submit. As such, please note that this processing is only carried out if a User submits a question, request, or feedback directly on the Platform or to Kuli's email or postal address. Otherwise, User's Personal Data is not processed for this purpose. This processing requires Kuli to collect and process the following categories of Personal Data: (i) identification data (i.e., the information the User provides, including their name and email address) and (ii) the content of the message(s) User sends to Kuli as part of the question, request, or feedback.
While processing User's Personal Data for this purpose, Kuli relies on its legitimate interest, which consists of duly managing its relationships with Users.
Kuli will not retain Personal Data for this purpose for more than two (2) years following the last contact on User's initiative.
3.4 Third-Party Integrations
You may connect third-party integrations to your Kuli account, which may ask for certain permissions to access data or send information to your Kuli account. It is your responsibility to review any third-party integrations you authorize.
4. Minimization
In any event, and disregarding the processing purpose at stake, please note that Kuli will comply with a strict data minimization principle and will thus only collect and process Personal Data which is necessary for the above purposes.
5. Archiving
Where Kuli considers it does not need to retain User's Personal Data in its active database, it will archive it and will ensure that access thereto is restricted to a limited number of persons who have an actual need to access User's Personal Data.
Kuli keeps a register of processing activities carried out on behalf of Clients when they act as controller. Kuli provides the controller with all the information necessary to demonstrate compliance with its obligations and allow audits to be carried out.
6. Data Recipients
Kuli shares and discloses Personal Data with Clients, solely in accordance with a Client’s instructions, in compliance with the Terms of Service and with any applicable law and legal process.
Kuli shares User's Personal Data with third-party service providers and suppliers which assist Kuli in fulfilling the purposes specified in this Privacy Policy. The service providers and suppliers may have access to Personal Data for the sole and exclusive purpose of carrying out the missions assigned to them. Kuli ensures that the service providers and suppliers offer sufficient guarantees for the performance of the mission and comply with the applicable laws and regulations.
Furthermore, as the case may be, Kuli shares User's Personal Data with competent courts and any other governmental and/or public authorities requesting access to User's Personal Data, within the extent legally permitted.
In any event, Kuli communicates User's Personal Data to the above recipients on a strictly need-to-know basis and only as necessary for fulfilling duly identified processing purposes.
Kuli keeps an up-to-date list of the subcontractors: AWS, Datadog, Rollbar, Slack, Hubspot, Heroku.
Transfers Outside the European Union
Personal Data may be processed outside the European Union territory. In that situation, Kuli shall take all necessary precautions and alternatively or cumulatively ensures that (i) an adequacy decision has been taken by the European Commission regarding the country of destination; (ii) contractual clauses adopted by the European Commission or the supervisory authority have been signed with the recipient.
Please note that, as part of the processing implemented for the purposes mentioned above in Section 3 (Data collected, purposes and storage periods), Kuli transfers User's Personal Data to Google LLC which is located outside the European Union, in the United States of America.
This country does not benefit from an adequacy decision by the European Commission, depriving transferred Personal Data of an adequate level of protection.
Nevertheless, User is hereby expressly informed that Kuli implements the following guarantees, additionally to the measures listed above, to protect User's Personal Data in the event of such transfer: encryption; Kuli undertakes to limit as much as possible the data that could not be encrypted to cases of absolute necessity; management of security incidents; access limited to authorized personnel and to the extent necessary; a secure subcontractor architecture in accordance with industry standards; regular reviews of the internal policies of its providers to assess the adequacy of the personal data security measures implemented; identification and implementation of additional or alternative solutions if necessary.
In addition, Kuli undertakes to inform the person concerned by a transfer of his/her data outside the European Union about: the laws and regulations that would allow U.S. government authorities to access the personal data being transferred; any requests for access to Personal Data by public authorities that Kuli has received during the previous semester.
Finally, Kuli certifies that it has not deliberately, or as a matter of legal obligation, created backdoors or similar programs that could be used to access the system and/or personal data, nor has it created or modified its business processes in a manner that would facilitate such access.
Users' Rights
As data subjects, Users benefit from various rights regarding the processing of their Personal Data. These are as follows:
Right to request from Kuli access to and rectification or erasure of User's Personal Data;
Right to request from Kuli restriction of the processing concerning User;
Right to object to the processing of User's Personal Data;
Right to portability of User's Personal Data;
Right to give guidelines regarding the use of User's Personal Data after User's death;
Right to complain with the French Data Protection Authority (CNIL), the competent supervisory authority.
To exercise User's rights or for any question on Personal Data protection, Users shall make a request accompanied by proof of identity by mail addressed to Kuli - 63 rue Jules Guesde, 92300 Levallois-Perret, France or by email at admintools@kuli.one.
Kuli shall strive to reply without undue delay and at the latest within one (1) month after the receipt of the request.
Kuli reserves the right to extend this period to three (3) months in the case of a complex request. Kuli is committed to protecting User's Personal Data and complying with the applicable data protection legal framework.
This is the reason why Kuli requires User's assistance to this end. Thus, Users commit to informing Kuli if the Personal Data they shared with us becomes obsolete or inaccurate.
In addition, in the event User provides Kuli with information enabling to identify directly or indirectly any other natural persons (e.g., User sends a request to Kuli with the contact email address available on the Services and shares personal data concerning another natural person in User's email), User represents and warrants that, prior to sharing this information with Kuli, such other natural persons have been provided with this Privacy Policy and, to the extent applicable, have consented to the processing of their data.
When Kuli acts as processor of Personal Data, Clients are responsible for the processing of requests from Users to exercise their rights. However, Kuli undertakes to assist Clients in the processing of these requests.
9. Security
Kuli undertakes to take appropriate technical and organizational measures to ensure the security and confidentiality of the personal data processed.