Privacy policy

1. Who is responsible

The service is presented under the name KSoft.TECH in fizične osebe. For questions about responsibility for processing and for all privacy requests, use the privacy contact options below. This notice covers kHelpdesk customer correspondence and our contact forms, including those branded Amprex; it does not cover unrelated services or the internal agent login.

2. Information we process

When you contact us, we process your email address, any name you provide, subject, message content and subsequent correspondence. Email may also contain attachments, sender and reply addresses, routing headers, message identifiers and timestamps. The contact forms do not accept attachments. Agents may add internal notes, assignment and status information needed to handle the enquiry.

Our systems also process technical security and delivery information, such as IP addresses, browser/device and request information, timestamps, delivery events, verification results and identifiers used to prevent duplicate submissions. Information may come from you, your email provider, someone corresponding about the same matter, or our authorised agents. Please provide only information relevant to your enquiry. Do not send passwords, authentication secrets or unnecessary sensitive personal data.

3. Why we use it and the legal bases

We use the information to receive, investigate and answer enquiries, provide support, manage correspondence and maintain necessary case history. Where the enquiry concerns performing a contract with you or steps you request before a contract, the basis is Article 6(1)(b) GDPR. For general correspondence, continuity of support and proportionate fraud, abuse and security protection, we rely on Article 6(1)(f): our legitimate interests in responding to people and operating secure, reliable services, balanced against their rights.

Where a particular legal obligation requires processing, including handling applicable data-protection rights, we rely on Article 6(1)(c) and the applicable obligation. Establishing, exercising or defending legal claims may justify necessary, limited retention. These purposes do not permit keeping all information forever.

Submitting a message is not blanket consent to personal-data processing or marketing. The privacy notice explains processing; it is not a consent form. If a separate optional activity requires consent, it must be requested separately and can be withdrawn without affecting earlier lawful processing. Special-category data and information about offences require an additional applicable legal condition; merely sending such information is not explicit consent.

4. Required and optional information

A reply email address and a meaningful message are necessary to handle an online enquiry. A subject is required where the form requests one; your name is optional. There is no general statutory duty to use our forms. Without sufficient contact or enquiry information, we may be unable to reply or resolve the matter. You may use the privacy contact options below instead of the form to exercise your rights.

5. Sokol, browser storage and automated protection

The form uses our Sokol security and CAPTCHA service to assess abusive requests and verify submissions. It processes technical request and browser/device signals, your IP address and challenge/verification data. The helpdesk sends the verification payload and source IP to Sokol, not the name, email address or message body you enter.

The helpdesk contact page does not add advertising or analytics tracking. Necessary security mechanisms may use browser storage and technical identifiers. A website embedding our form may separately use its own cookies or analytics and must explain them in its own notice.

Automated checks can challenge, rate-limit or reject a submission. They do not decide the merits of your support request or your statutory rights. If a check prevents contact, use the alternative privacy email below; a person can review the issue.

6. Who can receive information and where it is processed

Authorised support agents and administrators can access information necessary for handling enquiries and running the service. An inbox name does not by itself restrict access to a separate department. Agent email alerts contain brief ticket metadata and an internal link, rather than copies of customer message bodies or attachments.

Our own infrastructure and infrastructure supplied by Hetzner, Telekom Slovenije and Bunnyway d.o.o. (Bunny CDN) support hosting, connectivity, delivery of static assets and backups. Providers receive only the data relevant to the services they supply, under the applicable contractual and data-protection arrangements. Public authorities or professional advisers may receive necessary information where there is a lawful obligation or a specific justified need. We do not sell enquiry data or use it for advertising.

The infrastructure we control for this service is configured for processing within the EU/EEA; we do not intentionally route that processing outside it. Your chosen email provider and the website embedding a form operate separately and may have their own processing locations and notices. Replying to your supplied email address necessarily involves your email service. A future change involving transfers outside the EU/EEA requires advance transparency and a lawful transfer mechanism.

7. Retention: helpdesk and Postal are separate

Helpdesk ticket messages, attachments, internal notes, case details and retained inbound-payload copies have no fixed automatic deletion period. They can remain for the long term while needed to handle the matter, provide continuing support, meet a specific legal obligation or deal with identifiable legal claims. Closing a ticket does not itself delete it.

Continued need must be reviewed at least annually and when a matter no longer requires retention. Irrelevant or no-longer-needed personal data must be deleted or irreversibly anonymised unless a specific lawful exception applies. There is no unconditional entitlement to retain identifiable messages indefinitely. You may request deletion; applicable legal requirements and justified claims may limit that right.

Separately, Postal is configured to delete its raw email data after 90 days and its email metadata after one year. These limits apply to Postal copies, not to tickets, messages, attachments or encrypted inbound receipts already stored in kHelpdesk. The one-year Postal limit is not a retention limit for all helpdesk metadata.

Protected backups may contain earlier copies until their backup generation expires or is overwritten. They are used for recovery, not ordinary access. Valid deletion and restriction decisions must be reapplied after a restore. Backup retention and technical/security-log periods must be controlled separately; they are not extended merely by keeping a ticket.

8. Your rights and how to request them

Subject to the GDPR conditions, you can request access, correction, erasure or restriction, object to processing based on legitimate interests, and obtain portable data where processing is automated and based on consent or a contract. You can withdraw any separate consent. These rights are not waived by submitting a message or accepting the terms.

Use the privacy contact options below and describe your request. We may ask for proportionate information to confirm identity where there is reasonable doubt; do not send identity documents unless requested. We normally respond within one month. Where the GDPR permits an extension for complexity or the number of requests, we explain it within that month. Requests are generally free; any lawful refusal or charge must be explained.

You may complain to a competent supervisory authority, particularly in the EU Member State of your habitual residence, workplace or the alleged infringement, and seek judicial remedies. In Slovenia, the supervisory authority is the Informacijski pooblaščenec. The official EU/EEA authority directory is linked below.

9. Security and changes

We use access controls, authenticated agent access, encrypted transport, protected storage, sanitised message display and other proportionate safeguards. No email or online service can guarantee absolute security. We will handle personal-data incidents as required by applicable law.

The version shown identifies this notice. Material changes will be explained before materially different processing begins where required. A new notice does not retrospectively create consent or override your rights.