Privacy Policy

Document information	Details
Document	Kanban Suite Privacy Policy
Document owner	Kanban Suite
Version	2.0
Effective date	6 November 2026
Last updated	6 November 2026
Related documents	Kanban Suite Terms of Use; the Customer Agreement and any data processing terms signed with each Customer

1. Introduction

Kanban Suite (“Kanban”) is a digital business management platform for organizations that operate one or more locations. Kanban Suite also runs the website at https://kanban-suite.com (the “Website”). In this Policy, “we”, “us” and “our” mean Kanban Suite. Kanban Suite is responsible for the personal data processing described in this Policy, in the roles explained in section 3, and can be contacted at [email protected].

This Privacy Policy explains what personal data we collect or process, why we use it, how it is shared and protected, how long we keep it, and the rights people have over it. Terms such as Customer, Customer Agreement, Entity, Store, User, Tenant Admin, Customer Data and Services have the meanings given in our Terms of Use.

Nothing in this Policy is intended to limit any rights you have under applicable law.

2. Who This Policy Covers

This Policy covers the following groups of people:

Group	Who they are
Website visitors	People who browse the Website.
Demo Request applicants	People who request a demonstration through the Website or otherwise contact us about the Services.
Customer representatives	People who deal with us on behalf of a Customer or Prospective Customer, for example for contracts, billing, onboarding or support.
Authorized Users	People whom a Customer invites to use the Services under its Entity.
Individuals in Customer Data	Other people whose information a Customer enters, imports or connects to the Services, such as its employees, cashiers and waiters shown on sales records, and its suppliers’ contacts.

This Policy does not describe how our Customers themselves handle personal data. Each Customer is responsible for its own privacy practices and notices towards its staff and other individuals.

3. Our Role: Controller and Processor

When we act as controller. We decide why and how personal data is processed, and act as a controller (or the equivalent under applicable law), for our own business activities. These include running the Website, handling Demo Requests and enquiries, managing relationships with Customers and their representatives, managing User accounts and sign-in, securing the Services, and meeting our legal obligations.

When we act as processor. When we process Customer Data, including personal data about Users and other individuals that the Customer puts into the Services, we do so on the Customer’s behalf and on its instructions, as a processor or service provider. The Customer is the controller of that data and decides why it is processed.

The exact roles depend on the Services provided and the applicable law. The Customer Agreement, including any data processing terms, may set out further terms for how we process personal data on a Customer’s behalf, and prevails over this Policy on those matters.

4. Information We Collect

A. Website Visitors

• Technical information. When you visit the Website, our website hosting and delivery provider processes technical information such as your IP address, browser type, the pages requested and the time of each request, to deliver the Website and keep it secure.
• Language preference. If you switch language, the Website stores your choice (“ar” or “en”) in a cookie, as described in section 12.
• Statistics. We do not use advertising or cross-site tracking on the Website. If we measure how the Website is used, we use statistics that do not rely on cookies and do not identify individual visitors.

B. Demo Request Applicants

When you request a demo, we collect the details you enter in the form: your name, your organization’s name, city, number of locations, phone number (and whether we may contact you on WhatsApp), email address and any message you add. We also record the language you used and the Website page you sent the form from.

Your request is not stored on the Website. It is sent by email, through an email delivery provider, to our business mailbox, where our team reads it and replies. To protect the form from automated misuse, the Website runs automated checks on each request before accepting it. Any count we keep of requests is anonymous: it records only the page and language, never your answers.

If you contact us by email or phone, we keep the content of the communication and your contact details.

C. Customer Representatives

We collect the names, job titles, business contact details and communications of people who deal with us on behalf of a Customer or Prospective Customer, together with the information needed to prepare and manage the Customer Agreement, such as the organization’s legal name, address and tax details.

D. Authorized Users

Account information.

• Name and email address.
• Phone number and profile photo, only if added.
• The User’s role and permissions, and the Stores the User can access.
• Invitation details (the email address an invitation was sent to and its language).
• Sign-in and security settings, such as the User’s password and two-step sign-in, kept in protected form. Passwords are never stored in readable form.
• Preferences the User chooses, such as language, display settings, notification settings and time zone.

Accounts are not created by self sign-up. We create each Customer’s Entity and invite its first Tenant Admin, who then invites the other Users.

Technical and security information. To run and protect the Services, we record:

• Sign-in and device information, such as IP address, browser and device type, including a device cookie used to alert Users when their account is used on a new device.
• An activity log (audit log) of important actions, such as sign-ins, changes and data exports, showing who did what and when. The Customer’s Tenant Admin can view this log.
• Security, error and event logs needed to protect and operate the Services and fix problems.

We do not use analytics, advertising or tracking tools in the Services.

E. Customer Data, Including Individuals in Customer Data

Depending on which parts of the Services the Customer uses, the Customer and its Users may enter, import or connect:

• Entity, company and Store details, such as legal names, addresses, phone numbers, tax numbers and currencies.
• Item catalogs, units of measure, suppliers and their contact details, and prices.
• Inventory levels, stock movements and cost history.
• Product and recipe structures, ingredients, production batches and photos.
• Purchase orders, receiving, returns and transfers between Stores.
• Waste records, stock counts, spot checks and their differences, including photos.
• Sales records from POS systems, including items, discounts, voids, payments, taxes and the cashier and waiter names shown on the bill.
• Approval requests and decisions, notifications and announcements.
• Files uploaded or imported by the Customer.

Some of this information includes personal data about the Customer’s staff, its suppliers’ contacts or other individuals. The Customer is responsible for having the legal basis and permissions needed to enter and use that information in the Services.

F. Integrations and File Imports

Where a Customer connects the Services to its own systems (such as an ERP or POS system, or a connector installed on the Customer’s computer) or imports files, we receive the data those systems or files contain. We process that data as Customer Data, on the Customer’s behalf.

5. How We Use Information and Our Legal Bases

Where the law requires a legal basis for processing personal data, we rely on the bases shown below. The legal bases available, and how they apply, depend on the law of the country concerned.

Purpose	Information used	Legal basis (where required)
Responding to Demo Requests and enquiries, and arranging demonstrations	Demo Request and communication information	Steps taken at your request before entering into a contract; our legitimate interest in responding to business enquiries
Preparing, managing and performing Customer Agreements, including billing	Customer representative information	Performance of a contract; our legitimate interest in managing business relationships
Creating and managing Entities and User accounts, and giving Users access	Account information	Performance of our contract with the Customer; our legitimate interest in providing the Services to the Customer’s Users
Providing the Services, including processing Customer Data to produce reports, dashboards and automated insights	Customer Data	Processing on the Customer’s instructions under the Customer Agreement (the Customer determines its own legal basis)
Sending service messages, such as invitations, password-reset links, new-device alerts, approval requests, notifications, announcements and reports the Customer schedules by email	Account information; Customer Data	Performance of a contract; processing on the Customer’s instructions
Providing support and fixing problems	Account, technical and communication information	Performance of a contract; our legitimate interest in operating a reliable service
Protecting accounts, preventing misuse and detecting unauthorized access, on the Services and the Website	Technical and security information	Our legitimate interest in securing our systems and our Customers’ data; legal obligations where they apply
Remembering the Website language preference	Language cookie	Necessary to provide the feature you asked for; our legitimate interest
Improving the performance and features of the Services	Technical information and operational logs	Our legitimate interest in improving our Services
Meeting legal and regulatory obligations, and establishing or defending legal claims	Any relevant information	Legal obligation; our legitimate interest in protecting our legal rights

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before it.

We do not use Customer Data for purposes unrelated to providing the Services, unless the Customer agrees or the law requires it. We do not sell personal data and do not use it for advertising.

6. Artificial Intelligence and Automated Processing

Automated insights. The Services produce reports, figures and business insights automatically from the Customer’s own data, within the Services. These insights are suggestions to help the Customer’s people make decisions. They do not make decisions about individuals that produce legal or similarly significant effects for them.

Third-party AI services. The Services do not currently send Customer Data or personal data to third-party artificial intelligence services, and we do not use Customer Data to train artificial intelligence models. If we plan to introduce features that do so, we will update this Policy and any affected Customer Agreement before those features process Customer Data.

7. Kanban Access to Customer Data

Support visits. To work inside a Customer’s Entity, our support team needs support access turned on by the Customer’s Tenant Admin. The Tenant Admin chooses how long it lasts and whether support may make changes or only view, and can end it at any time. Support visits and the actions taken during them are recorded in the Customer’s audit log under “Kanban Support”, and the Tenant Admins are notified in the Services when support enters.

Administration area. Our administration area cannot open the Customer’s settings or its day-to-day records and figures. It shows the account and service information we need to manage the Customer’s subscription and the set-up we do for it, and, when the Customer’s Services are ending, the copy of its data prepared for it (see section 10).

Servers. Our system administrators can technically access the servers and backups that hold Customer Data. This access is used only to run, secure, repair and restore the Services.

8. Sharing of Information

We do not sell personal data. We share information only in the following cases.

A. Service Providers

We use carefully selected service providers to host our servers (in Germany), send service emails, run our website and domain services, provide security certificates, check that our systems are running, and handle our business email, including demo requests. They process information only on our behalf, only as far as needed to provide their service, and under appropriate contractual terms. Customers can ask us for the current list of providers.

If we keep backup copies, or files prepared for download, with a separate storage provider, we will make sure that provider is bound by the same terms before it holds Customer Data, and include it in the list of providers.

If a User turns on push notifications, the notification is delivered through the push service of that User’s browser or device maker (for example Google, Apple, Mozilla or Microsoft).

B. Integrations Chosen by the Customer

If a Customer connects the Services to its own systems (for example an ERP system, a POS system or a connector installed on the Customer’s computer), the information needed for that connection is exchanged with those systems, and the Services can send records created in Kanban to them. That processing is also governed by the other provider’s terms and privacy policy. Connection keys and passwords for these systems are stored encrypted.

C. Within the Customer’s Entity

Information in an Entity is visible to the Customer’s Users according to the roles and permissions the Customer gives them. For example, a Tenant Admin can view the audit log.

D. Legal Requirements

We may disclose information when required by law, a court order or a lawful request from a competent authority, or where needed to protect legal rights as the law allows.

E. Business Transfers

If our business is merged, acquired, restructured or transferred, information may be transferred to the party concerned, subject to applicable law and to the protections in this Policy and in Customer Agreements.

9. International Data Transfers

The servers that host the Services are located in Germany. Some of our service providers process data in other countries, which may be outside the country where the Customer or the individual is located.

Where applicable law requires safeguards for transferring personal data between countries, such as standard contractual clauses, we will put those safeguards in place with the provider concerned before making a transfer that those rules cover. Customers can contact us for details of the arrangements that apply to their Services.

10. Data Retention and Deletion

We keep information only as long as needed for the purposes in this Policy, to provide the Services, meet contractual and legal obligations, settle disputes and protect legal rights. In general:

• Account information, Customer Data and the audit log are kept for as long as the Customer’s Entity exists, unless the Customer deletes them earlier, and then as described below.
• Temporary files, such as uploaded import files, report files and exports prepared for download, are kept for a short time and then deleted automatically.
• Notifications, ended sign-in sessions and used or expired links are deleted automatically after a set period.
• Security records and server logs, which include IP addresses, are kept for a limited period and then deleted.
• Demo Requests and related emails are kept in our mailbox only as long as needed to respond to you and follow up on your request, then deleted. You can ask us to delete them at any time. If you become a Customer, your contact details are then kept as part of the Customer relationship.

When a Customer’s Services end:

1. The Entity is locked.
2. We can provide the Customer with a readable copy of its business records and files.
3. After the waiting period set out in the Customer Agreement, all of the Customer’s data and files are permanently deleted from the Services.
4. Copies may remain in our encrypted backups until those backups are replaced in the normal backup cycle, and are then deleted.

After deletion, we keep a short record that the Customer’s account existed and was closed (such as its name, code and dates), to protect the Services and meet our legal duties.

Some information may be kept longer where the law requires it or to settle a dispute or protect a legal right.

While their Services are active, Users with the right permissions can export the lists, records and reports on each screen to Excel, CSV or PDF. Customers should export any data they need before their Services end.

11. Data Security

We use organizational and technical measures designed to protect information against unauthorized access, change, disclosure, destruction or loss. These include encrypted connections, protected storage of passwords and other sensitive information, two-step sign-in, keeping each Customer’s data separate from other Customers’ data, role-based access within each Entity, encrypted backups, an audit log of important actions, and monitoring that helps us detect and investigate problems. Access to Customer Data is limited to the people and purposes described in section 7.

If we become aware of a security incident affecting Customer Data, we will investigate it and notify affected Customers where the law or the Customer Agreement requires it.

When a User works offline, a copy of the data the User needs is kept on the device in protected form. It is removed when the User signs out, or when the device next connects after the User’s access has ended. A copy on a lost device that never connects again cannot be erased remotely, so devices must be kept protected.

Customers and Users must also protect their information, including by:

• Giving each User only the permissions their job needs.
• Keeping passwords secret and never sharing accounts.
• Protecting the devices and computers they use for Kanban, including any computer running the connector.
• Removing access for Users who leave or no longer need it.
• Telling us promptly if they suspect unauthorized access or a security incident.

No transmission or storage method is completely secure, so we cannot guarantee that a security incident will never happen.

12. Cookies and Similar Technologies

In the Services. The Services use only cookies that are needed for them to work:

• A sign-in cookie that keeps you signed in.
• A device cookie used for new-device security alerts.
• A short-lived cookie used during Kanban Support visits.

The Services also save your screen preferences (for example a collapsed menu and the last Store you chose) and the names of records you recently opened or marked as favorites in your browser, and, if you use the offline app, an encrypted copy of the data you need offline.

On the Website. The Website stores your language choice in a cookie for up to one year, so it opens in the same language next time. The demo form’s automated checks do not use cookies.

We do not use analytics, advertising or tracking cookies in the Services or on the Website. Because we use only cookies that are strictly necessary or that remember a choice you made, we do not show a cookie consent banner. If we introduce cookies or similar technologies that require consent under applicable law, we will ask for your consent before using them. If you block cookies in your browser, you will not be able to sign in to the Services, and the Website will not remember your language.

13. Your Rights

Subject to applicable law, you may have the right to:

• Ask whether we process your personal data, and get access to a copy of it.
• Ask us to correct inaccurate or incomplete information. Users can change their own name, phone, photo and preferences on their Profile page.
• Ask us to delete your personal data where the law allows. A User’s name stays in the audit log and on the records the User created, because these records must not be changed.
• Ask us to restrict processing where the law allows.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Receive your personal data in a structured, commonly used format, where applicable.
• Withdraw consent where processing is based on consent.
• Complain to a data protection authority, where the law gives you that right.

How to make a request. Send your request to [email protected], with enough detail for us to identify you and the information concerned. We may ask for information to confirm your identity and authority. We will reply within the time required by applicable law and, in any case, aim to reply within 30 days.

When the Customer controls the data. Where your personal data is part of a Customer’s Entity (for example, you are a User or your name appears in a Customer’s records), the Customer is the controller. We may direct your request to that Customer or handle it with the Customer’s approval, and we will help the Customer respond.

Some requests may be refused, fully or in part, where meeting them would conflict with legal or contractual obligations or with the rights of others. If so, we will explain why, where the law allows.

14. Children’s Data

The Website and the Services are business services and are not directed at children. We do not knowingly collect personal data from children. If we learn that a child’s personal data has been collected in breach of applicable law, we will deal with it as the law requires.

15. Third-Party Websites and Services

The Website or the Services may link to, or connect with, other websites and services. We do not control their privacy policies or practices, and we encourage you to read their policies before using them or sharing information with them.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, our service providers, our operations or legal requirements. The updated version will be published on the Website with a new version number and “Last updated” date.

Where the law or a Customer Agreement requires direct notice or new consent, we will follow that process.

17. Contact Us

For questions or requests about privacy and data protection, contact us:

Email: [email protected] Website: https://kanban-suite.com

This Privacy Policy should be read together with the Kanban Suite Terms of Use and any Customer Agreement or data processing terms made with the Customer.