Privacy Policy
1. Introduction
This Privacy Policy explains how K9 Share (“K9 Share”, “we”, “us”) handles personal data in connection with the K9 Share file sharing and document editing service (the “Service”) and this website.
It applies to organisations that subscribe to the Service (“Customers”), to the individuals whom Customers authorise to use it (“Users”, including guests), and to visitors to this website. We process personal data in accordance with the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data, as applicable.
2. Our role: controller and processor
Customer content. Each Customer decides what files, documents and other content it stores in the Service and who may access them. For that content (“Customer Content”) the Customer is the data controller and K9 Share acts as a data processor, processing it only on the Customer’s behalf and in accordance with the Customer’s documented instructions, which are given through the Service and the agreement between us. Questions about how Customer Content is used within an organisation should be directed to that organisation.
Account, technical and security data. For the account data, technical logs and security and audit logs described below, K9 Share determines the purposes and means of processing in so far as is needed to provide, secure and support the Service, and acts as a controller of that data.
Website. For the limited information we receive when you contact us, K9 Share is the controller.
3. Information we collect
We collect and process the following categories of information:
- Account data: name, email address, username, group memberships, role, language preference and authentication settings (including two-factor authentication enrolment) for Users created by the Customer.
- Customer Content: files, documents, folders, comments, versions, shared links, approval and signature records and the text extracted from scanned documents for search, as uploaded or created by Users.
- Technical logs: IP address, browser and device type, request times and error information generated when the Service is used.
- Security and audit logs: records of sign-ins, failed sign-in attempts, sharing activity, administrative actions and malware scan results.
- Enquiries: the details you choose to send us when you email support@elitevad.com, such as your name, organisation and message.
We do not knowingly collect special categories of personal data for our own purposes. Customers are responsible for the content they choose to store in the Service.
4. How and why we use information
We use personal data only for the following purposes:
- to provide, operate and maintain the Service, including authentication, storage, sharing, co-editing, optical character recognition and search of Customer Content;
- to protect the Service and its Users, including antivirus scanning of uploads, blocking executable uploads, detecting and preventing unauthorised access and abuse, and keeping audit logs;
- to provide support and to respond to enquiries and demo requests;
- to administer our relationship with Customers, including account management and notices about the Service; and
- to comply with legal obligations and to establish, exercise or defend legal claims.
We do not use Customer Content to build profiles or for advertising.
5. Legal bases
Where the law requires a legal basis for processing, we rely on one or more of the following:
- Performance of a contract: processing necessary to provide the Service to the Customer under our agreement and to take steps at the request of a prospective Customer before an agreement is made;
- Legitimate interests: processing necessary to keep the Service secure, to prevent fraud and misuse and to maintain reliable operation, where these interests are not overridden by the rights of the individuals concerned;
- Legal obligation: processing necessary to comply with applicable law or a valid order of a competent authority; and
- Consent: where we ask for it and where it is the appropriate basis, which you may withdraw at any time.
For Customer Content, the Customer is responsible for establishing the legal basis for its own processing.
6. No sale of data, no advertising or analytics trackers
We do not sell personal data and we do not share it for advertising. This website and the Service contain no advertising trackers and no third-party analytics. The Service is fully self-hosted and does not rely on third-party services to operate, so personal data is not passed to outside providers for processing.
We disclose personal data only to Users and administrators of the relevant Customer, to our personnel who need access to provide support, and where disclosure is required by law.
8. Retention
We keep personal data only for as long as it is needed for the purposes described in this policy:
- Customer Content is kept for as long as the Customer keeps it in the Service, subject to the retention policies the Customer configures, version history and trash recovery settings. Deleted items may remain recoverable in the trash until they are emptied or expire under the Customer’s settings.
- Account data is kept while the User account exists and is removed when the Customer deletes the account or the agreement ends.
- Technical, security and audit logs are kept for as long as is reasonably necessary for security, troubleshooting and accountability, and are then deleted or anonymised.
- Enquiries are kept for as long as needed to respond and to maintain a record of our dealings.
When an agreement ends, we make Customer Content available to the Customer for export for the period set out in the agreement and then delete it, unless the law requires us to keep it.
9. Security
We apply technical and organisational measures appropriate to the risk. These include:
- antivirus scanning of every upload and blocking of executable uploads;
- two-factor authentication using authenticator apps and security keys;
- a password policy and brute-force protection on sign-in;
- password-protected public links by default, with a default expiry of 30 days;
- sharing with internal users and groups or by public link, and audit logging of activity; and
- hosting in a controlled datacenter in Dubai, UAE, on a self-hosted platform.
No system can be guaranteed to be completely secure. If we become aware of a personal data breach affecting Customer Content, we will notify the Customer without undue delay so that it can meet its own obligations.
10. Your rights
Subject to applicable law, individuals have the right to request access to their personal data, to request correction of inaccurate data, to request deletion, to request restriction of or object to certain processing, to request a portable copy of data they provided, and to withdraw consent where processing is based on consent. They may also lodge a complaint with the competent data protection authority.
If your personal data is within Customer Content, please contact the organisation that provides your account, as it is the controller; we will assist it in responding to your request. For data for which we are the controller, write to support@elitevad.com. We may need to verify your identity before acting on a request, and we will respond within the period required by law.
11. International transfers
The Service is hosted in Dubai, UAE, and Customer Content, account data and logs are stored and processed in the United Arab Emirates. We do not transfer personal data outside the UAE. If this ever changes, we will update this policy and, where required, put in place the safeguards that the law requires before any transfer takes place.
12. Children
The Service is intended for use by organisations and their authorised Users and is not directed at children. We do not knowingly collect personal data from children for our own purposes. If you believe a child has provided personal data to us, please contact us and we will take appropriate steps to delete it.
13. Changes to this policy
We may update this policy from time to time to reflect changes to the Service or to the law. The effective date at the top of this page shows when the policy was last updated. Where a change is material, we will give Customers reasonable notice.
14. Contact
For questions about this policy or about how we handle personal data, contact K9 Share at support@elitevad.com.