Purpose and status
This policy describes the baseline terms under which Kylian processes personal data for customers. It is intended to support security and privacy review. A signed data processing addendum, order form, or service agreement controls the parties’ legal obligations.
Where applicable, the customer acts as controller or business and Kylian acts as processor or service provider. Kylian processes customer personal data only to provide the contracted service and on documented customer instructions, unless law requires otherwise.
Applicable law
This framework is designed to support obligations under applicable data protection laws, including the EU GDPR, UK GDPR, Swiss Federal Act on Data Protection, CCPA and CPRA, and other comprehensive United States state privacy laws. Each law applies only to the extent its requirements cover the relevant processing.
Processing details
- Purpose: provide property operations workflows, communications, coordination, reporting, support, security, and authorized integrations.
- People: customer users, personnel, prospects, residents, vendors, owners, and other contacts whose data is submitted to the service.
- Data: identifiers, contact details, account data, communications, property records, lease and maintenance information, task history, and technical logs.
- Duration: the customer relationship plus the period needed for return, deletion, security, dispute resolution, and legal compliance.
- Sensitive data: not intentionally required unless expressly agreed and protected by appropriate instructions and controls.
Confidentiality and security
People authorized to access customer personal data are subject to confidentiality obligations and access restrictions. Kylian applies safeguards appropriate to risk, which may include least-privilege access, authentication, encrypted transport, protected credentials, tenant and environment separation, monitoring, backups, and secure development practices.
Kylian reviews safeguards as the service and risks change. No control eliminates all risk, and detailed customer-specific commitments are stated in the signed agreement or security materials provided during diligence.
Subprocessors
Kylian may use subprocessors for infrastructure, communications, artificial intelligence processing, monitoring, support, and other service functions. Kylian requires subprocessors that handle customer personal data to protect it under written terms appropriate to their role.
A current service-specific subprocessor list and any notice or objection process are provided during contracting or on request. Customer-connected systems chosen and controlled by the customer are not Kylian subprocessors solely because the customer connects them to the service.
Individual rights and customer assistance
Kylian assists customers with access, correction, deletion, restriction, portability, objection, and similar requests as required by law and the customer agreement. If Kylian receives a request concerning data controlled by a customer, Kylian may direct the requester to that customer.
Security incidents
Kylian maintains a process to assess and respond to suspected security incidents. If Kylian confirms a personal data breach affecting customer personal data, Kylian will notify affected customers without undue delay and provide available information needed for their response, subject to applicable law and contract.
International transfers
When a transfer requires a legal mechanism, Kylian and its subprocessors use an applicable safeguard, such as an adequacy decision, the European Commission Standard Contractual Clauses, or the United Kingdom International Data Transfer Addendum. Specific transfer terms are completed in the applicable data processing addendum.
United States state privacy requirements
Where Kylian acts as a service provider or processor under United States state privacy law, it does not sell or share customer personal data for cross-context behavioral advertising. It retains, uses, and discloses that data only for the contracted business purposes or as otherwise permitted by law.
Return, deletion, and audit information
At the end of service, Kylian returns or deletes customer personal data as required by the applicable agreement, subject to legal retention and normal backup cycles. Retained backup data remains protected and is not restored except for recovery or legal need.
Kylian provides information reasonably necessary for customer diligence and to demonstrate applicable processing commitments. Audit rights, frequency, confidentiality, and costs are governed by the signed agreement.