Privacy Policy
Your data at Kawlya: contact enquiries, call recordings retained for 30 days, European hosting and your privacy rights.
Draft for review before publication. Confirm the email provider, other telephone service providers, retention for data other than recordings and safeguards for any transfers. Also verify caller information and the legal basis for recording.
1. Scope and data controller
This policy describes processing on kawlya.com and its contact form, together with retention of recordings from the Kawlya telephone service. The app.kawlya.com application allows business customers to manage their activity. Processing on their behalf also requires appropriate information for their customers and a data processing agreement setting out each party’s role.
The controller for website processing is KAWLYA, a French simplified joint-stock company (SAS), at 47 rue Vivienne, 75002 Paris, France, SIREN 106 479 041, registered office SIRET 106 479 041 00019. Contact contact@kawlya.com for personal data enquiries.
2. Information collected
When you use the contact form, we receive the information you enter: your name, email address, message and, if supplied, company and telephone number. Required fields are identified on the form. Without the necessary information, we cannot properly handle your enquiry.
The message is stored in our management area and sent by email to the team responsible for replying. We also record the language, receipt date and handling and notification statuses to follow up the request and limit duplicate submissions.
Technical information may be processed to deliver requests and protect the website, including IP addresses and browser information. Turnstile anti-spam protection is described below. Do not include passwords, payment card details or unnecessary sensitive information in your message.
Calls handled by the service are recorded. Recordings contain participants’ voices and information shared during the conversation. They are used to investigate complaints about telephone exchanges and are retained for 30 days from the call.
3. Purposes and legal bases
We use your contact details and message to answer your enquiry and continue the correspondence you requested. Depending on the enquiry, the basis is taking pre-contractual steps at your request or our legitimate interest in responding to enquiries addressed to our business.
Preventing abuse and securing the form serve our legitimate interest in protecting the website. Where a legal obligation requires retaining a document or disclosing it to an authority, that processing relies on the obligation. Sending a contact enquiry does not automatically subscribe you to a newsletter.
Recordings are used to investigate complaints. Callers must be informed at the beginning of the conversation and be able to find out how to exercise their rights. [Confirm before publication: the legal basis, responsibilities of Kawlya and the business receiving the call, and the actual objection or consent arrangements required by that basis.]
4. Recipients and providers
Authorised Kawlya administrators and people handling your enquiry can access the information needed for their work. Hosting, email and security providers may be involved in operating the website.
Data is hosted in Europe with Hetzner. Access to recordings must be restricted to people authorised to handle complaints. Form responses exist both in the management area and in email; retention arrangements must cover both locations and their backups.
[Complete before publication: email, telephony and artificial intelligence providers, other recipients and the actual locations from which they access data.]
5. Cloudflare Turnstile anti-spam protection
The form uses Cloudflare Turnstile to distinguish visitors from bots. Cloudflare processes technical signals such as IP addresses, browser characteristics and information about the website visited.
Cloudflare acts as a processor when providing this protection and as a separate controller for certain processing to improve bot detection. Its notice explains these uses and how to exercise your rights with Cloudflare.
Cloudflare Turnstile Privacy Addendum
6. Retention
Call recordings are retained for 30 days from the call. This period applies to audio files; it does not determine retention periods for appointments, contact details, enquiries or billing documents.
Retention periods must reflect the time needed to handle an enquiry, follow it up and meet applicable obligations. Messages, notification emails, technical logs and backups may require different retention rules.
[Complete before publication: retention for enquiries that do not proceed; correspondence that becomes contractual; technical logs; and deletion cycles for email and backups.] This draft does not claim that automatic deletion is already configured.
7. Cookies and browser storage
The website remembers your light or dark theme preference in your browser’s local storage. French or English navigation may also use a language preference cookie. Authentication cookies are used for administrators accessing the management area.
You can clear this information in your browser settings; you may then need to choose your preferences again. [Check before publication: the actual tracker inventory, including anything introduced by security services or other external tools. Arrange consent for uses that require it.]
8. Transfers and security
Data hosting is provided by Hetzner in Europe. That location does not by itself establish where every connected third-party service processes data, including anti-spam protection, email and telephone service providers. [Check before publication: any processing outside the European Economic Area, countries concerned and safeguards applicable to each transfer.]
Messages in the management area are accessible only to authorised administrators. Form checks and anti-spam verification help limit abusive submissions. The operator must maintain server, email, access and backup security; no internet transmission is entirely risk-free.
9. Your rights and contact
Subject to the conditions in applicable law, you can request access, correction or erasure, restriction of processing, object to certain uses and obtain portability where it applies. Where processing relies on consent, you can withdraw it for the future.
Send requests to contact@kawlya.com, identifying the enquiry concerned. Proportionate identity verification may be necessary if there is doubt. You can also complain to the competent data protection authority, including the CNIL in France.
This policy will be updated if the processing changes. An effective date will be shown when the reviewed version is published.