Privacy Policy

1. Who is responsible for your data

Sodasoft LLC, operating as Kellwick, is the data controller for personal data processed through this website. For any privacy question or request, contact us at hello@kellwick.com or by post at 30 N Gould St, Sheridan, WY 82801, USA.

2. What data we collect

• Inquiry data you submit through the contact form: name, work email, company, website, company size, industry, your current ISO 27001 status, the services you are interested in, and your message.
• Newsletter data: your email address and the page you subscribed from, if you sign up.
• Consent records: your cookie choices, with a timestamp, the policy version, the page, referral/campaign (UTM) parameters, your browser user-agent, and a salted one-way hash of your IP address. We keep this to demonstrate consent, as required by law.
• Technical data generated automatically by our hosting and security providers, such as approximate request metadata used to keep the service available and secure.

We do not intentionally collect special categories of data, and we do not ask for more than we need to respond to you.

3. Why we use it, and our legal bases

Under the GDPR we rely on the following legal bases:

• Responding to your inquiry and providing services - performance of a contract or steps taken at your request (Art. 6(1)(b)), and our legitimate interest in handling business inquiries (Art. 6(1)(f)).
• Sending the newsletter - your consent (Art. 6(1)(a)), which you may withdraw at any time.
• Analytics cookies - your consent (Art. 6(1)(a)).
• Security, bot prevention and keeping the site running - our legitimate interest and, where applicable, compliance with legal obligations (Art. 6(1)(f) and 6(1)(c)).
• Keeping a record of consent - compliance with a legal obligation and our legitimate interest in demonstrating compliance (Art. 6(1)(c) and 6(1)(f)).

4. Cookies and analytics

We use strictly necessary cookies to run the site and keep forms secure, and, only with your consent, privacy-friendly analytics. Details and controls are in our Cookie Policy. You can change or withdraw consent at any time via the “Cookie settings” link in the footer.

5. Who we share data with

We do not sell your personal data. We share it only with service providers (processors) who process it on our instructions to run this site and handle inquiries:

• Vercel - website hosting and privacy-friendly analytics.
• Neon - database hosting for inquiry, newsletter and consent records.
• Resend - sending inquiry notifications and confirmation emails.
• Cloudflare - Turnstile bot protection on our forms.

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

6. International transfers

Our providers are based in, or process data in, the United States and other countries. Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, the EU-US and UK Data Privacy Framework, together with additional measures where needed.

7. How long we keep it

We keep inquiry data for as long as needed to respond and to maintain a reasonable record of our business communications, and then delete or anonymise it. Business-contact details we hold for prospecting (on the basis of legitimate interest) are deleted when they have not been re-verified for 24 months. Newsletter data is kept until you unsubscribe. Consent records are kept for the period we may need to demonstrate consent. Where you object to prospecting, we keep the minimum needed to honour that objection (so we do not contact you again), even after deleting the rest of the record.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data protection authority.

To exercise any right, contact us at hello@kellwick.com. We will respond within the timeframe required by applicable law. We do not sell or “share” personal data for cross-context behavioural advertising.

9. Security

We use reputable providers and apply reasonable technical and organisational measures to protect personal data, including minimisation (for example, hashing IP addresses in the consent log). No method of transmission or storage is completely secure, but we work to protect your data appropriately.

10. Children

This website is intended for business users and is not directed to children. We do not knowingly collect personal data from children.

11. Automated decision-making

We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised. Material changes affecting cookies or consent will trigger a fresh consent request.

13. Contact

Questions or requests can be sent to hello@kellwick.com or to Sodasoft LLC, 30 N Gould St, Sheridan, WY 82801, USA.