← kinesthetics.io · Privacy notice · Sub-processors

Privacy Notice

Archez Ltd Trading as Kinesthetics

Effective date	14 June 2026
Last updated	1 November 2026
Version	1.1

1. About this notice

This privacy notice explains how Archez Ltd ("Archez", "we", "us", "our") collects and uses personal data. It applies to our trading brand Kinesthetics and all our products and services, including the Kin Analytics business intelligence platform, the Kinesthetic learning platform, and the marketing websites we operate.

We are the controller of the personal data described in this notice, unless explicitly stated otherwise.

This notice is written in line with the UK GDPR (as amended by the Data (Use and Access) Act 2025), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Who we are

Legal name	Archez Ltd
Registered office	71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Companies House number	17151326
ICO registration	Registered with the Information Commissioner's Office
Data protection contact	The Director
Email	contact@kinesthetics.io

We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR. The Director acts as our designated data protection lead and is the first point of contact for any privacy enquiry or rights request.

3. Who this notice is for

This notice is for two different groups of data subjects, and the sections that follow tell you which parts apply to you.

Group	Who you are	Relevant sections
Group A — Users	You hold a user account with us or you interact with our marketing websites	Sections 4, 5, 7–13
Group B — Subjects of intelligence	Your name appears in our Kin Analytics database because it appears on a public source about a company we have analysed	Sections 6, 7–13

4. Personal data we collect — Group A (Users)

If you are a user of our platform or our marketing websites, we collect:

Data	Source	Purpose	Lawful basis
Name, work email, employer, job title	You, on sign-up or enquiry	Account creation, authentication, support, billing	Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) for prospect enquiries
Login records, IP address, session metadata	Automatically when you use the platform	Security, fraud prevention, service operation	Legitimate interest
Communications you send us	You	Responding to and recording your enquiry	Contract or legitimate interest
Billing details (name, billing address, VAT)	You and our payment processor	Invoicing and payment	Contract; legal obligation (HMRC)
Marketing preferences	You	Sending you operational and (where opted in) marketing messages	Consent for marketing; legitimate interest for service messages

Payment card details are processed entirely by our payment processor and are never held on Archez systems.

We do not knowingly collect personal data of anyone under 18 through our B2B services.

5. Cookies and similar technologies

Our websites use a small number of cookies and similar technologies. We provide a cookie banner the first time you visit, allowing you to accept or reject non-essential cookies. Strictly necessary cookies (authentication, session, security) are used without consent because they are required to deliver a service you have requested, in line with PECR Regulation 6(4).

6. Personal data we process — Group B (Subjects of intelligence)

Kin Analytics produces structured business intelligence on employer organisations. The intelligence is principally about the company, but it incidentally includes personal data about a small number of individuals associated with each company. If your name appears in our database it is because it appears in a public source about your employer, and the rest of this section explains what we hold, where we got it from, and what you can do about it.

6.1 Categories of personal data

Name and professional role of company officers and Persons with Significant Control, as published on the UK companies register.
Name and professional role of individuals listed on a company's own published team, leadership or "about us" pages.
Generic business contact data (main switchboard, info@ / contact@ addresses).
Company facts from accounts filed at Companies House, which may name the company's professional advisers (accountants, auditors, bankers, solicitors). These are firms, not individuals.
Name and role of individuals quoted as company spokespeople in news articles indexed by Google News.

We do not collect or hold: - Personal phone numbers, personal email addresses, home addresses. Where a company's public web page shows a named person's email address or a mobile number, we do not store or display it. We keep only a one-way keyed fingerprint (a hash) of it, so that we can remove duplicates and honour removal requests. The fingerprint cannot be turned back into the address or number; - Dates of birth beyond the partial date published by Companies House; - Photographs; - Any special category data (Article 9 UK GDPR — health, race, religion, political views, sexual orientation, etc.); - Criminal offence data.

6.2 Sources

UK Companies House — the statutory public register operated by HM Government.
The data subject's own employer's public website — only pages that the company itself publishes and that the data subject's role appears on. We read these pages either directly (respecting the site's robots.txt and with a low request rate) or from the Common Crawl public web archive. We keep the facts we extract, not copies of the pages.
Established news publications, accessed via the public Google News index.
Public business directories and contact pages retrieved via AI-assisted research over the public web.

We do not access closed networks, login-gated content, social platforms requiring login, paid contact databases, leaked datasets, or any source we believe to be obtained unlawfully.

6.3 Purpose

We process this personal data for the purpose of providing B2B intelligence to corporate subscribers, who use it to identify and qualify prospective business customers in their sector. We do not sell the personal data, list it, or distribute it outside the platform.

6.4 Lawful basis

The lawful basis for processing under section 6 is legitimate interest (Article 6(1)(f) UK GDPR). We have completed a Legitimate Interest Assessment which is available, redacted where necessary, on request.

6.5 Retention

Personal data of subjects of intelligence is retained for no longer than 24 months from the date of the most recent scan that included it. After 24 months, the record is either refreshed from source or deleted. See our Data Retention Policy.

6.6 Your rights — quick path

If your name appears in our database and you want it removed, restricted, or corrected, email contact@kinesthetics.io with the company you are associated with. We will action a valid request within 14 days and in any case within the statutory one-month period. Full rights are described in section 9.

7. How we share personal data

We share personal data only with the following categories of recipient, under appropriate contracts:

Sub-processors that provide infrastructure to us (hosting, database, AI research, email). Each is bound by Article 28 data processing terms. The current sub-processor list is published separately and is updated when it changes.
Subscribers to our platform, who receive intelligence containing the categories of data described in section 6, under the terms of our Acceptable Use Policy. Subscribers act as independent controllers in respect of the personal data once it is in their hands.
Regulators, law enforcement and government agencies where we are required to disclose by law.
Professional advisers (legal, accounting, insurance) under a duty of confidentiality, when necessary.
A successor entity in the event of a corporate transaction (merger, sale, restructure), subject to equivalent privacy protections.

We do not sell personal data, license it to data brokers, or use it for behavioural advertising.

8. International transfers

Our primary database is hosted on Archez-controlled servers in the United Kingdom. Some earlier records were held with Supabase (UK region, eu-west-2). Some sub-processors (notably AI research providers and CDN providers) are based in the United States and may process personal data there.

Where personal data is transferred outside the UK, we rely on one or more of the following legal mechanisms:

A UK adequacy decision (where the destination country has one);
The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum;
Other recognised transfer mechanisms under the UK GDPR / DUAA 2025 framework.

A copy of the relevant transfer mechanism is available on request.

9. Your rights

You have the following rights under UK data protection law:

The right to be informed — satisfied by this notice.
The right of access to a copy of your personal data (Article 15).
The right to rectification of inaccurate or incomplete data (Article 16).
The right to erasure ("right to be forgotten") in the circumstances set out in Article 17.
The right to restriction of processing in the circumstances set out in Article 18.
The right to data portability for data we hold under contract or consent (Article 20).
The right to object to processing based on legitimate interest (Article 21). Where you object, we will stop processing unless we can demonstrate compelling legitimate grounds which override your interests.
The right not to be subject to a solely automated decision that produces legal or similarly significant effects on you (Article 22). We do not currently make any such decisions.
The right to complain to us, by emailing contact@kinesthetics.io. We aim to resolve any complaint within one calendar month.
The right to complain to the Information Commissioner's Office — ico.org.uk, telephone 0303 123 1113. You may complain to the ICO at any time, but we would appreciate the chance to address your concern first.

To exercise any of these rights, email contact@kinesthetics.io. We will respond within one month of receipt; this period may be extended by up to two further months for complex or numerous requests, in which case we will tell you within the first month.

We do not charge a fee for handling rights requests, except where the request is manifestly unfounded or excessive, or where it is repetitive, in which case a reasonable administrative fee may apply or we may refuse the request.

10. Security

We protect personal data with proportionate technical and organisational measures including:

Encryption in transit (TLS 1.2 or higher); encryption at rest is being rolled out across our servers;
Role-based access controls in our database, with private network access only;
Least-privilege access for all personnel and sub-processors;
Audit logging of system access;
Regular review of sub-processor security posture;
A documented breach response procedure.

In the event of a personal data breach likely to result in a risk to data subjects' rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware, and we will notify affected data subjects without undue delay if the risk is high.

11. Automated decision-making and AI

We use large language models and other automated tools to assist in researching public information about companies. These tools do not produce decisions that have legal or similarly significant effects on individuals. The intelligence we publish concerns the corporate entity, and the named individuals are listed alongside it as a matter of factual record drawn from public sources.

We do not use personal data of subjects of intelligence to train any model.

12. Changes to this notice

We may update this notice from time to time. The version and effective date at the top of this notice will always indicate the current version. Material changes will be communicated by email (for Group A) or by a prominent notice on our website (for Group B), and the previous versions are retained for reference.

13. Contact

Email	contact@kinesthetics.io
Post	The Director, Archez Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
ICO registration	Registered with the Information Commissioner's Office
Companies House	17151326

Archez Ltd · company 17151326 · Registered with the ICO · contact@kinesthetics.io