Who handles requests
Sansa Group AB, organization number 559111-9507, operating through its Sansa Vision division operates Kiteframe and handles requests about data for which Sansa Group AB is the controller. Our registered address is Soldathemsgatan 20, 415 28 Göteborg, Sweden. If a customer organization controls the relevant data, we will direct the request to that customer or assist it under our processor obligations.
Rights comparison
| Right | GDPR / EEA and UK-style rights | California CCPA / CPRA rights |
|---|---|---|
| Know and access | Confirm processing, receive a copy, and get purpose, category, recipient, source, retention, and safeguard information. | Know categories, sources, purposes, recipients, and disclosures; request specific pieces of personal information. |
| Correct | Correct inaccurate or incomplete personal data. | Correct inaccurate personal information, subject to verification and permitted exceptions. |
| Delete | Request erasure when a legal ground applies, subject to exceptions such as legal obligations or claims. | Request deletion of personal information collected from you, subject to statutory exceptions. |
| Restrict | Restrict processing in circumstances such as a contested accuracy or pending objection. | No identical general right, but use and disclosure may be limited for qualifying sensitive personal information. |
| Portability | Receive qualifying data in a structured, commonly used, machine-readable format and transmit it where feasible. | Receive specific information in a portable and, where technically feasible, readily usable format. |
| Object or opt out | Object to direct marketing and, in some cases, processing based on legitimate interests. | Opt out of sale or sharing and certain automated decision-making if those practices apply. |
| Automated decisions | Request safeguards for qualifying decisions based solely on automated processing with legal or similarly significant effects. | Receive notices and exercise rights for covered automated decision-making technology as applicable law requires. |
| Non-discrimination | Exercise rights without unlawful retaliation or discrimination. | Exercise CCPA rights without discriminatory treatment prohibited by law. |
Rights vary by location and are subject to legal conditions and exceptions. This matrix is a product notice, not legal advice.
California notice at collection
This section applies when the CCPA applies to Sansa Group AB’s processing. At or before collection, we provide this direct notice describing the categories collected, purposes, retention criteria, and whether information is sold or shared.
| Category | Examples | Purpose | Typical retention | Sold or shared |
|---|---|---|---|---|
| Identifiers | Name, email, account ID, IP address | Accounts, authentication, support, security | Account term plus applicable legal and security periods | No |
| Commercial information | Plan, invoices, usage | Provide service, billing, accounting | Contract term plus applicable accounting period | No |
| Internet activity | Requests, feature events, errors | Operate, secure, and improve the service | Configured log, trace, and security periods | No |
| Professional information | Organization, role, work context | Workspace administration and support | Account term plus applicable support period | No |
| Customer content | Sources, prompts, conversations, attachments | Provide the configured agent service | Customer setting and contract, plus limited backup deletion time | No |
| Sensitive information | Account credentials represented by hashes, tokens, or one-time codes | Authentication and security | Codes expire in minutes; session and security records follow policy | No |
Sources, purposes, and recipients
We collect information directly from users and customers, automatically from use of Kiteframe, and from customer-authorized sources and providers. We use it for the purposes listed above. Recipient categories are infrastructure, security, authentication, communications, customer-selected connector, professional-adviser, and transaction providers described in the privacy policy.
Kiteframe does not use or disclose sensitive personal information for purposes that trigger a right to limit under the current service design. We do not sell personal information or share it for cross-context behavioral advertising. Because those practices do not occur, there is presently no sale/share to opt out of; recognized opt-out preference signals will be honored if an applicable practice is introduced.
Submit a request
- Email support@kiteframe.xyz with “Data Rights Request” in the subject.
- State your relationship to Kiteframe, the account or email involved, your jurisdiction, and the right you want to exercise.
- We may request information reasonably necessary to verify identity and authority. Do not send government ID unless specifically and securely requested.
- GDPR requests are generally handled without undue delay and within one month, with a permitted extension of up to two further months for complex or numerous requests.
- For covered California requests to know, delete, or correct, we confirm receipt within 10 business days and respond within 45 calendar days; a permitted extension can make the total up to 90 days, with notice and reasons.
Authorized agents and complaints
California residents may use an authorized agent where permitted. We may verify the agent’s authority and the consumer’s identity. If a request is denied, the response will explain the reason and any available appeal or complaint route. EEA users may complain to their local supervisory authority or to Sweden’s Authority for Privacy Protection (IMY).