How personal data is used to provide KnownStock.

1 · Controller and contact

Use a verified identity and privacy route.

The data controller is the verified publisher identified on this page. Privacy enquiries and requests to exercise data-protection rights may be sent to the verified privacy email shown below.

2 · Categories of personal data

Collect what the service needs to work.

Account and membership data includes names, email addresses, password-derived authentication material, workspace identity, role, warehouse scope and account status. Operational workspace data includes the item, supplier, customer, document, movement, count, assembly, dispatch, audit and export information entered by authorised users.

Security and service records may include session, request, event, network, browser, device, error and audit information. Subscription references connect a workspace to the corresponding Paddle customer, transaction and entitlement state without storing full card details in KnownStock.

A support request contains the reply email, optional name, optional account email, optional workspace name, selected topic, subject and message. Attachments are not accepted by the public form.

3 · Purposes and lawful bases

Provide, secure and document the service.

Account, workspace and operational data is processed to create and perform the service agreement, authenticate users, apply permissions, maintain inventory history, produce requested reports and exports, provide support and administer subscription rights under Article 6(1)(b) GDPR where applicable.

Limited security, audit and diagnostic data is processed under the controller’s legitimate interests in protecting workspaces, preventing abuse, investigating incidents and maintaining an explainable service under Article 6(1)(f) GDPR. Privacy and deletion requests may also be processed to comply with a legal obligation under Article 6(1)(c) GDPR.

4 · Workspace roles and responsibility

The Customer decides what operational data its team enters.

For account administration and direct service operation, the publisher acts as controller. Where a Customer enters personal data about suppliers, customers, members or other people for its own inventory operations, that Customer determines the business purpose and must establish the appropriate lawful basis and permissions.

KnownStock processes the application record only to provide and secure the workspace. Questions about why a particular Customer entered a person’s data should normally be addressed first to that Customer.

5 · Recipients and service providers

Each provider has a limited operational role.

Personal data is not sold. Contabo GmbH provides VPS hosting, and Google Workspace provides the knownstock.com mailbox and authenticated email delivery. These providers receive data only to the extent needed for their respective services.

Paddle acts as authorised reseller, Merchant of Record and independent controller for buyer checkout, payment, tax, receipt, refund and subscription records. Its own privacy information and retention terms apply to those records.

6 · International transfers

Provider safeguards apply where processing crosses borders.

Google Workspace may process service data outside the European Economic Area. Where safeguards are required, Google applies the mechanisms in its Workspace data-processing terms, including the European Commission Standard Contractual Clauses where applicable. Hosting location and safeguards follow the controller’s agreement with Contabo.

7 · Retention periods

Different records have different operational lives.

Active account and workspace records remain available while needed to provide the service and any published read-only access. Once deletion is confirmed, the account and all active workspace data are permanently removed, except for records that must be retained by law.

Support requests are retained for no longer than two years, and routine security logs for no longer than 14 days, unless a proportionate longer period is required for an identified incident, legal dispute or binding obligation.

Protected backup copies are not edited in place. Daily copies expire after 14 days, weekly copies after 90 days and monthly copies after 370 days. If a backup is restored, completed deletion instructions must be applied before the restored service becomes reachable. Paddle retains its independent payment records under its own obligations and policy.

8 · Data-subject rights

Identity is checked before a private record is disclosed or changed.

Subject to applicable law, a person may request access, rectification, erasure, restriction or portability, and may object to processing. The controller may ask for information reasonably necessary to verify the requester’s identity.

Requests may be sent to the verified privacy contact. A person also has the right to complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.

9 · Required information and automated decisions

Only required fields block a support submission.

A reply email, topic, subject, message and privacy acknowledgement are required for a support request. Name, account email and workspace name are optional, although relevant account context may be needed before support can identify a private workspace.

KnownStock does not make decisions based solely on automated processing that produce legal or similarly significant effects on a person.

10 · Cookies, browser storage and camera

Use optional technology only after the relevant choice or action.

With consent, the public website uses Google Analytics to measure visits and interactions; it does not use advertising or behavioural-profiling cookies. The signed-in application does not use Google Analytics and uses only a necessary secure session cookie and limited browser storage for preferences, drafts and offline resources. Camera permission is requested only after an operator starts barcode scanning.

The Cookie Policy identifies each technology, its purpose, duration and available controls. Paddle technology loads only when the Owner deliberately opens checkout.

11 · Cancellation, export and deletion

Three different actions with different effects.

Before deleting this account, cancel the active subscription from Plan & access. Wait until Paddle confirms cancellation and the paid period has ended. A scheduled cancellation alone does not allow deletion.

Open Settings → My preferences and security → Delete account and data. Type DELETE exactly and choose Request account deletion. This is also available in a read-only workspace. Administrators and Users who are not the Owner cannot request it. Check the Owner’s inbox and spam folder. The link expires in 24 hours. Opening it only displays the confirmation page. Check the workspace reference and Owner’s email, read the warning and choose Delete account and data. Ignore the email if you did not request deletion.

Some records may be retained where required by law. Protected backups expire after 14 days (daily), 90 days (weekly) and 370 days (monthly). Deleted accounts remain inaccessible if a backup is restored. Payment records held by providers such as Paddle are subject to their own legal and retention obligations.

12 · Changes to this information

A new purpose requires a fresh assessment.

Material amendments will be published here with an updated version date. Personal data will not be reused for an incompatible new purpose merely because it was collected for the purposes described above.