Kala applies the principles of data minimisation and purpose limitation. We only process the Personal Data necessary to provide the requested Services and do not process Personal Data for purposes incompatible with those described in this Privacy Policy.

3.1 Purpose

Kala processes Personal Data only where necessary to provide the Services, fulfil our contractual obligations, comply with applicable laws, protect the security of the Platform and improve the quality of the Services.

Depending on your interaction with Kala, we may use Personal Data to:

create, manage and secure user accounts;
authenticate users and manage access to the Platform;
provide the Services requested by our Customers;
deliver customer support and respond to enquiries;
process subscriptions, billing and account administration;
communicate with customers regarding the Platform and the Services;
monitor, maintain and improve the security, availability and performance of the Platform;
provide usage analytics and reporting features to authorised Customer administrators;
improve the quality, performance and usability of the Services;
comply with applicable legal, regulatory and contractual obligations.

Where Customer Content contains Personal Data, Kala processes such Personal Data solely on behalf of the Customer and only for the purpose of providing the Services in accordance with the Customer's instructions.

Kala does not sell Personal Data and does not use Customer Content to train its own AI models or general-purpose AI models.

3.2 Legal Basis

Under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Kala processes Personal Data only where a valid legal basis applies.

Depending on the processing activity, Kala relies on one or more of the following legal bases:

Performance of a Contract – where processing is necessary to provide the Services, manage user accounts, administer subscriptions and fulfil our contractual obligations towards our Customers.
Legitimate Interests – where processing is necessary to maintain the security, integrity and performance of the Platform, improve the Services, prevent fraud or abuse, provide customer support and ensure the proper operation of the Platform, provided that such interests are not overridden by your rights and freedoms.
Compliance with Legal Obligations – where processing is necessary to comply with applicable legal or regulatory obligations, including accounting, taxation and other legal requirements.
Consent – where required by applicable law, including for the use of non-essential cookies or marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before such withdrawal.

3.3 AI Processing and Third-Party AI Providers

Kala uses artificial intelligence ("AI") to help Authorised Users access information contained in their organisation's approved Customer Content.

Kala uses AI as a means of accessing Customer Content, not as a substitute for it.

AI is used solely to support the Services requested by the Customer, including information retrieval, content indexing, AI-assisted retrieval and the generation of responses based on Customer Content.

Kala does not make decisions on behalf of the Customer or its employees. Responses generated through AI are intended solely to facilitate access to Customer Content made available through the Platform.

Kala does not use Customer Content to train its own AI models or to improve general-purpose AI models.

Where the provision of the Services requires the use of carefully selected third-party AI providers, Kala ensures that Customer Content is processed solely for the purpose of providing the requested Services and in accordance with the Customer's instructions.

Kala selects third-party AI providers that offer appropriate contractual, technical and organisational safeguards for the protection of Customer Content and Personal Data.

Kala does not use Customer Content for advertising, profiling or any purpose unrelated to the provision of the Services.

While AI assists in retrieving and presenting information, the Customer remains responsible for the accuracy, completeness, legality and maintenance of its Customer Content.