EU, EEA and United Kingdom Privacy Supplement

Special-category and criminal-offence information

A specialized product handling health, biometric identification or other special-category information needs an applicable general lawful basis and an additional condition under the relevant regime. Criminal-offence information has separate restrictions. A broad contractual permission to upload data does not satisfy these requirements.

The ordinary corporate registration and enquiry model does not request those categories. A user's unsolicited sensitive attachment is not permission to reuse it for another purpose. Necessary handling and deletion are assessed proportionately, and future high-risk features require review before launch.

Required information, sources and recipients

The Global Privacy Policy identifies corporate categories and collection sources. The relevant form explains whether information is required for a contract or law, why it is needed and the consequence of not supplying it. A mandatory phone or company field requires an actual necessity assessment, not a fabricated security justification.

Information obtained indirectly is accompanied by the notice required for that source and timing, subject only to an applicable exception. Recipients and actual processing locations are identified through the relevant provider and product disclosures. An organization may administer its own workspace but does not obtain unrelated personal product data through that role.

Transfers outside the EEA or UK

Transfers to India or another country require the applicable legal assessment and mechanism. Depending on the actual destination and recipient, this can involve an applicable adequacy decision or approved contractual safeguards with the necessary risk assessment and supplementary measures. A recipient's participation in a framework must be verified for its actual scope.

EU standard contractual clauses, a UK addendum or an international data transfer agreement are used only when appropriate and actually completed. This Supplement does not itself execute those instruments or claim that KRAVIA holds a certification. Contact privacy@kraviaprivatelimited.com for information or an eligible copy of safeguards, with necessary redactions for protected information.

Rights

Subject to the applicable conditions, you may seek access, rectification, erasure, restriction, portability and objection, and withdraw consent for consent-based processing. You may object to direct marketing; we stop the relevant marketing processing. Restrictions and exceptions must be explained rather than assumed to cancel the whole request.

Data portability does not require transfer of KRAVIA proprietary systems or another person's information. Erasure does not automatically remove records needed under a lawful obligation or for qualifying legal claims. We consider whether recipients must be informed of a correction, deletion or restriction.

Decisions involving automation

For EU processing, the safeguards and restrictions applicable to solely automated decisions with legal or similarly significant effects must be assessed for the actual use. Any applicable exception requires its conditions and safeguards, not merely an acceptance of Terms. Significant decisions involving special-category data require particular care.

UK automated-decision requirements must be assessed under the amended UK framework and relevant guidance. KRAVIA retains its stronger company principle of meaningful oversight, information, correction and review for consequential uses regardless of whether a particular statutory restriction has changed. Corporate AI assistance is not represented as a final hiring, credit or medical decision service.

Request timing and complaints

Submit requests through the public form or privacy@kraviaprivatelimited.com. Identity checks must be proportionate. Under the EU GDPR, the ordinary response period is one month, with a permitted extension of up to two further months for qualifying complexity or volume and notice within the initial month. KRAVIA's 30-day target does not replace that calendar-month calculation. The applicable UK calculation, exceptions and extension provisions are assessed separately.

If we refuse a request or rely on an exception, we explain the reason and available remedies as required. You may complain to an appropriate EEA supervisory authority, including where you habitually reside, work or believe an infringement occurred, or to the UK Information Commissioner's Office for relevant UK matters. You may also seek judicial remedies. Contacting KRAVIA first is encouraged for resolution but does not remove a statutory complaint right.

Children, retention and local requirements

Services likely to be accessed by children require age-appropriate assessment, not only services explicitly marketed to them. Consent thresholds and parental responsibilities depend on the activity and jurisdiction. An institutional contract does not automatically replace every child's or parent's right.

Retention follows the applicable purpose, statutory obligations and disclosed schedule. Conflicting legal demands, including overseas preservation duties, require legal assessment and minimization; they are not resolved by silently retaining everything globally. A product must assess any additional national, employment, communications or sector-specific requirements before targeting a market.

Changes, language and further information

This Supplement is reviewed for legislative, product and provider changes. Required notices, consent and language protections apply despite a general English-controls clause. The global no-sale, no-cross-site-behavioural-advertising and private-content no-general-purpose-training commitments remain part of the KRAVIA baseline.