GDPR Compliance

1. Overview

HotKV Ltd ("we", "our", "us") is committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK General Data Protection Regulation ("UK GDPR"). This page explains how we comply with these regulations and outlines your rights as a data subject.

2. Data Controller

HotKV Ltd is the data controller for personal data collected through the HotKV™ website and managed service platform. For any data protection inquiries, you may contact us at:

• Email: privacy@hotkv.com
• Entity: HotKV Ltd
• Company number: 17144043
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Jurisdiction: England and Wales, United Kingdom

HotKV Ltd is not the controller in one case. For personal data that a participant puts on an early access trial instance, the participant is the controller. We act as their processor under the processing terms in the Early Access Programme Agreement. Where we use data from a trial instance for our own purposes, such as security, investigating misuse, controlling cost or complying with the law, we are a controller for that use.

3. Lawful Basis for Processing

We process personal data under one or more of the following lawful bases as defined in Article 6 of the GDPR:

• Contract performance: Processing necessary to provide the Service you have requested (e.g., account creation, instance provisioning, billing)
• Legitimate interests: Processing necessary for our legitimate business interests, such as fraud prevention, security monitoring, and service improvement, provided these interests do not override your fundamental rights
• Consent: Where you have given explicit consent, such as opting in to marketing communications. You may withdraw consent at any time
• Legal obligation: Processing necessary to comply with applicable laws and regulations

When you sign an agreement in the console, such as the Early Access Programme Agreement, we keep a record of the signature. The lawful basis is our legitimate interests in having evidence of the agreement and in being able to establish, exercise or defend legal claims.

4. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR and UK GDPR:

• Right of access (Article 15): You may request a copy of the personal data we hold about you
• Right to rectification (Article 16): You may request correction of inaccurate or incomplete personal data
• Right to erasure (Article 17): You may request deletion of your personal data where there is no compelling reason for continued processing
• Right to restrict processing (Article 18): You may request that we limit how we use your data in certain circumstances
• Right to data portability (Article 20): You may request your data in a structured, commonly used, machine-readable format
• Right to object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes
• Rights related to automated decision-making (Article 22): We do not use automated decision-making or profiling that produces legal effects

We keep signed agreement records even if you ask us to erase them or object to their use. The GDPR and UK GDPR allow this where the data is needed to establish, exercise or defend legal claims (Articles 17(3)(e) and 21(1)).

To exercise any of these rights, contact us at privacy@hotkv.com. We will respond to your request within 30 days.

5. Data We Collect

For a detailed breakdown of the personal data we collect, please refer to our Privacy Policy. In summary, we collect:

• Account information (name, email, company name)
• Usage data (IP address and hash, user agent, approximate location, pages visited)
• Billing metadata (via Stripe; we do not store payment card details)
• Instance metrics, including outbound traffic volume (for monitoring and billing)
• Signed agreement records (full name, and for a business its legal name, country and registration number, account details, IP address, browser user agent, approximate country, login method and time of signing)
• Data on early access trial instances, which we process for the participant who put it there

6. Data Retention

We retain personal data only as long as necessary:

• Account data: retained while your account is active
• Login history: 90 days
• Audit logs: 1 year
• Signed agreement records: 7 years from the date of signing, also after account deletion
• After account deletion: personal data removed within 30 days, except signed agreement records and unless retention is required by law

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including:

• United Kingdom: where HotKV Ltd is incorporated (UK adequacy decision in place)
• United States: via cloud infrastructure providers (Cloudflare, Google Cloud Platform, Microsoft Azure, Stripe)

Early access trial instances, and the data on them, are hosted by Microsoft Azure in the United States (East US region). Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework (or the EU-US Data Privacy Framework) where the recipient is certified under it, or on standard contractual clauses together with the UK International Data Transfer Addendum.

Where transfers occur outside the EEA or the UK, we rely on the safeguards that the GDPR and UK GDPR allow for each transfer.

8. Sub-Processors

We use the following third-party sub-processors who may process personal data on our behalf:

For early access trial instances, we tell participants by email or in the console before we add or replace a sub-processor, as the Early Access Programme Agreement describes.

9. Data Protection Measures

We implement the following technical and organizational measures to protect your data:

• Encryption in transit (TLS) and at rest where applicable
• Password hashing using PBKDF2-SHA256 with 100,000 iterations
• Rate limiting and brute-force protection
• Session management with idle timeouts and active-session review and revocation
• Multi-factor authentication (TOTP and WebAuthn passkeys) support
• Audit logging of administrative actions
• Regular security reviews

10. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay in accordance with Article 34.

11. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

• Information Commissioner's Office (ICO)
• Website: ico.org.uk
• Phone: 0303 123 1113

You may also contact the supervisory authority in your country of residence.

12. Changes to This Policy

We may update this GDPR compliance page from time to time. Changes will be reflected in the "Last updated" date at the top. Material changes will be communicated via email or notice on the Service.

13. Contact

For any GDPR-related questions, data subject requests, or concerns, contact us at privacy@hotkv.com.