Privacy Policy

Kagan Timur trading as KomodoWorks, Dublin, Ireland, is the controller for website enquiries, account administration and the client relationship described here. Contact info@komodoworks.com for privacy questions or requests.

Where a client supplies personal information for its own project and decides how that information is used, the client's privacy notice also applies. This notice does not replace that notice or the arrangements agreed for the project.

• Email privacy enquiries

A call-back request includes the systems you select, what you would like to improve, your email address or phone number, and your staff-count range and timeline if provided. A request for client portal access is optional and does not create an account.

Applications sent by email include your contact details, CV, introduction and anything else you choose to send. Correspondence includes the messages and attachments you exchange with KomodoWorks. Please do not include sensitive personal information, passwords or payment-card details in an enquiry.

Required form fields are needed to understand and answer the request. Optional fields can be left blank. You can use the published contact channels instead of the form.

The invitation-only portal handles your email address, account and professional profile, password hash, security settings, sign-in sessions and verification records. If you enable a security key or passkey, the portal stores its public credential and related verification information, not your device's fingerprint or face data.

Portal records can include project access and progress, requests, uploaded files and versions, messages and attachments, support tickets, quotations, invoices, payment and refund references, notifications, audit records, and the document version, account and time associated with an agreement acceptance.

Your employer, project contact or an authorised administrator may supply your name, business contact details and project access to invite you. An invitation or first communication points to this notice. Project participants see information shared with their project according to their access; authorised administrators can manage those records. Internal administrative notes are not shared as ordinary client messages.

Publishing a professional profile is optional. Published profiles are shared with clients on assigned projects, not made into an open internet directory. You should upload only information you are authorised to share.

• Portal Terms

Enquiries and applications: to answer you, assess a possible collaboration and prepare proposals. The basis is steps at your request before a contract where you are the prospective contracting party, or legitimate interests in responding to business contacts and evaluating opportunities where you represent an organisation.

Portal and projects: to provide agreed services, manage accounts, communicate, record approvals and administer payments and support. The basis is performance of your contract where applicable, or legitimate interests in administering the business client's contract and its authorised users.

Security and records: to prevent abuse, control access, investigate incidents and establish or defend claims, based on legitimate interests in protecting people, information and the service. Accounting records and responses to lawful authorities are kept where required by legal obligations.

Optional analytics and marketing: consent. Analytics are off until you accept. Portal marketing is a separate, optional choice, off by default, with withdrawal in Settings or through the unsubscribe link. Essential account, security, payment and project emails are not marketing subscriptions.

Personal information is not sold. KomodoWorks does not use advertising pixels, behavioural advertising or decisions producing legal or similarly significant effects based solely on automated processing.

Essential storage supports functions you request, such as remembering your privacy choice and keeping you signed in. You can block storage in your browser, but sign-in may no longer work. Rejecting optional analytics does not prevent enquiries or portal access.

Your analytics choice is saved in this browser's local storage as komodoworks.analytics-choice for up to 180 days. It records the choice, notice version and time, not an advertising identifier. Clearing browser storage removes the choice; if storage is blocked it lasts only for the current page.

Plausible Analytics loads only after you accept. It measures pages, referrers, approximate country, device and browser categories, and the events Call Back Open and Call Back Requested. Analytics events do not include contact details, questionnaire answers, or other form values. Plausible does not use cookies or persistent identifiers; its service processes technical request information to produce aggregate statistics.

Use Cookie preferences in the website footer to change or withdraw your choice as easily as you gave it. Withdrawal reloads the page to stop an already loaded tracker. The portal does not load website analytics.

Portal sign-in uses a first-party session cookie: __Host-kw_portal for clients, or __Host-kw_admin for administrators on their separate host. Client sessions expire after seven days, administrator sessions after eight hours, and a session awaiting a second factor after ten minutes. Signing out ends that session. These cookies are HttpOnly, Secure in production, and SameSite=Strict.

Cloudflare Turnstile checks an enquiry, and each client and administrator sign-in, for automated abuse when the security check is requested. It processes technical device, browser and network information for verification. It is separate from optional analytics. LinkedIn, WhatsApp and external product links are not embedded advertising or social trackers on this website; those services apply their own policies when you visit them.

• Plausible data policy
• Cloudflare privacy information

Information is shared as needed with hosting, database, private file-storage and backup providers; business mailbox and transactional email providers; form-processing and abuse-prevention services; and professional advisers or authorities where necessary. Access is limited to the purpose of the service. Project contacts and assigned participants receive information needed for their work, not unrestricted access to other clients.

The website and portal's primary application hosting, database and private file storage are configured in the EU. This is not a claim that every provider processes all information only in the EU. Email delivery, security, support and payment services may involve processing in the United States or other countries outside the European Economic Area.

Formspree processes enquiry submissions, Cloudflare Turnstile provides the security check for enquiries and portal sign-in, and Plausible provides optional website analytics with visitor data hosted in the EU. Applications emailed to KomodoWorks are handled by the mailbox service, not through Formspree.

Stripe handles payment checkout and transaction processing under its own privacy information. KomodoWorks receives payment status, references and relevant billing records, not your full card details. WhatsApp and LinkedIn handle communications made through their platforms under their own policies.

Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards, such as European Commission Standard Contractual Clauses. Contact info@komodoworks.com for the recipients relevant to your information and details or a copy of the applicable transfer safeguards, with confidential information redacted where necessary.

• Formspree privacy information
• Stripe privacy information
• WhatsApp privacy information
• LinkedIn privacy information

Unsuccessful enquiries are kept for up to 12 months after the enquiry closes, to handle follow-up questions and maintain an accurate record of the discussion, then deleted. Unsuccessful applications are kept for up to 12 months after the application process closes for related follow-up and review, then deleted. A specific legal obligation or dispute may require limited records to be kept longer. This is not permission to reuse applications for unrelated recruitment or marketing.

Active account and project records are kept while needed to deliver the work and administer access. After closure, retention depends on the record's purpose: outstanding support, the applicable agreement and legal-claim periods, or accounting and other statutory duties. Necessary tax and transaction records are generally kept for six years where Irish law requires it, rather than applying that period to all portal content.

Security records are kept only while needed to protect the service and investigate abuse. Expired sessions and verification tokens no longer authorise access. Marketing stops when you withdraw; a limited suppression or consent record may be retained to honour that choice and demonstrate it.

Backup copies are restricted to recovery and expire under the backup schedule rather than being used for normal work. A justified legal hold may delay deletion. Contact us for the retention criteria and schedule relevant to your records. Aggregate analytics reports follow the provider account's retention settings; your browser's choice expires after 180 days.

Depending on the circumstances, you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. Some records must be kept for legal obligations or claims.

Email info@komodoworks.com. Requests are normally free and answered within one month. If a lawful extension is needed because of complexity or number of requests, we will explain it within that month. We may request proportionate information to confirm your identity.

Portal Settings offers a selected account-data export and a deletion-request option after identity verification. That export is not necessarily your complete access-request response. A deletion request is reviewed, not immediate automatic erasure. You can request additional records or exercise your rights by email without having an active portal account.

You can complain to the Irish Data Protection Commission or your competent supervisory authority. You do not have to contact KomodoWorks first.

• Data Protection Commission: your rights

The revision date is shown above. Material changes will be brought to affected users' attention as appropriate. A new optional purpose requiring consent will not be enabled on the basis of an old choice.