Privacy Policy

Last updated: August 25, 2026

1. INTRODUCTION AND SCOPE

This Privacy Policy describes how Telecom Apps LLC, operating under the brand name "Kleos" (“Kleos”, “Company”, “we”, “us”, or “our”), a limited liability company duly organized, validly existing under the laws of the State of California, with its business address at 303 Twin Dolphin Drive, Suite 800, Redwood City, CA United States, collects, uses, discloses, and safeguards personal information in connection with our website at https://kleos.io and our global platform and related services for engaging, onboarding, and managing distributed teams under applicable service agreements (collectively, the “Services” or “Platform”).

‍

Kleos operates a software platform and provides related services that help organizations build and manage global teams – including engaging, onboarding, and paying distributed workers across multiple countries. Because of the nature of the Services, this Privacy Policy addresses several distinct categories of individuals whose personal information we process, each described in more detail below:

‍

Website Visitors – individuals who visit https://kleos.io or interact with our marketing content, without registering for the Services
Client Contacts and Authorized Users – individuals who represent a corporate Client that engages our Services, including Authorized Users who access the Platform on the Client’s behalf
Contractors – individuals or entities engaged through the Platform to provide services on an independent contractor basis. Contractors are data subjects whose own personal information we process for onboarding, payment, and tax purposes
Employed Workers – individuals employed by Kleos, by our Affiliates, or by local employers engaged by us, in each case supporting the services facilitated through the Platform.

‍

Under this Privacy Policy we process personal information as an independent controller for the purposes described in this Policy, including Platform onboarding and administration of the Services and applicable service agreements.

‍

Where we, our Affiliates, or local employers engaged by us employ an Employed Worker in connection with the Services, Kleos processes personal information as an independent data controller for purposes necessary to administer the Services and the relevant employment relationship, including onboarding, employment administration, compliance, payments, tax, and service administration.

‍

Processing on behalf of Clients. This Privacy Policy does not apply to personal information that we process on behalf of a Client as a processor or service provider – for example, information that Clients or their Authorized Users submit to the Platform about their own personnel, customers, or business contacts. Such processing is governed by our agreement with the relevant Client, including the applicable data processing addendum, and by the Client's own privacy notice. If your personal information has been submitted to the Platform by a Client and you have questions or wish to exercise your privacy rights with respect to it, please contact that Client directly; we will refer requests we receive to the relevant Client and support its response in accordance with our agreements.

‍

2. PERSONAL INFORMATION WE COLLECT

The categories of personal information we collect depend on your relationship with us and how you interact with the Services. We may collect personal information directly from you, from the Client with whom you are associated (where applicable), from third parties acting on our behalf, from public sources where permitted by law, and automatically through your use of the Services.

‍

2.1 Website Visitors

If you have questions or concerns about this Privacy Policy or our processing of your personal information, please contact us at support@kleos.io.

When you visit kleos.io, request information, subscribe to updates, or otherwise contact us, we may collect:

‍

your name
email address
company name
job title
the contents of your communications with us
technical information collected automatically as described in Section 2.7.

‍

2.2 Client Contacts and Authorized Users

When a business registers as a Client or when an individual is designated as an Authorized User, we may collect:

‍

company name
company registration number
tax or VAT identification numbers
registered business address
information regarding authorized representatives, directors, and beneficial owners where required for legal or compliance purposes, including, where our KYB/KYC procedures require identity verification of such individuals, the categories of Identity Documentation and Identity Verification Data described in Section 2.3 (such as copies of identity documents, facial images, selfies, and liveness verification data)
bank account and payment information where applicable
Authorized User or company representative name
business email address
telephone number
job title
login credentials and account information
technical information collected automatically as described in Section 2.7
records relating to use of the Services and correspondence with us.

‍

2.3 Contractors

When an individual or entity registers as a Contractor or otherwise uses the Services, we may collect:

‍

General Personal Information: full name; gender; date of birth; nationality and citizenship; country of residence; government identification numbers where required; publicly available information relating to sanctions, Politically Exposed Person (PEP) status, or similar compliance databases where permitted by law.

‍

Identity Documentation: document type (such as passport, national identity card, or residence permit); issuing country; document number; issue and expiry dates; information contained within machine-readable zones or document barcodes; document security features; copies or images of identity documents.

‍

Identity Verification Data: facial photographs; selfie images; videos; liveness verification data and related facial geometry or biometric data generated during identity verification; identity verification results.

‍

Contact Information: residential and mailing address; email address; telephone number.

‍

Business and Tax Information: business registration details; registered address; tax identification numbers; tax residency information; tax forms and supporting documentation; information regarding authorized representatives, directors, and beneficial owners where applicable.

‍

Financial Information: bank account information; account holder details; routing, IBAN or SWIFT information; payment card details where required for payment processing.

‍

Technical Information: IP address; browser information; device identifiers and attributes; operating system; session information; session behavior information; timestamps; interaction data; approximate geographic location derived from IP address; login credentials and account information; other information collected automatically as described in Section 2.7.

‍

Communications: correspondence with us; customer support requests; information you voluntarily submit through the Services.

‍

2.4 Employed Workers

Where we, one of our Affiliates, or one of our counterparties engage an Employed Worker in connection with the Services, we may collect the categories of information listed above, together with employment-related information necessary to establish, administer, and terminate the employment relationship, including:

‍

job title
compensation
payroll information
tax withholding information
social security information
benefits information
working time records
attendance records
leave records
immigration and right-to-work documentation, including visa or work permit status
emergency contact information (name, phone number, address, email)
dependent information where required to administer benefits
performance-related information where relevant to the employment relationship
disciplinary records where applicable
background check results where permitted by law
termination and offboarding information.

‍

2.5 Sensitive Personal Information

Where permitted or required by applicable law, we may process the following categories of sensitive personal information:

‍

government-issued identification numbers
passport and identity document information
biometric information, including facial images, liveness verification data, and related facial geometry or biometric data used solely for identity verification
financial account information
citizenship, nationality, immigration, visa, and right-to-work information
health information where necessary to administer employment-related obligations or statutory benefits
racial or ethnic origin where legally required for employment or regulatory reporting
trade union membership where relevant to payroll deductions or employment rights under applicable law.

‍

We process sensitive personal information only where necessary to provide the Services, comply with legal obligations, establish or defend legal claims, prevent fraud, protect the security of our Services, or where otherwise permitted or required by applicable law.

‍

We do not use sensitive personal information to infer characteristics about individuals or for advertising purposes.

‍

2.6 Information We Receive from Others

We may receive personal information from:

‍

Clients who invite Contractors or Employed Workers to the Platform
affiliated companies
payroll, banking, and payment providers
tax, immigration, employment, and social security authorities
publicly available registers, sanctions lists, and other legally accessible databases
fraud prevention, compliance, and identity verification service providers acting on our behalf
other third parties where authorized by law or by the individual concerned.

‍

2.7 Information Collected Automatically

When you access or use the Services, we automatically collect certain information through cookies, log files, pixels, software development kits (SDKs), and similar technologies.

‍

This information may include:

‍

IP address
browser type and version
operating system
device identifiers
pages viewed
features used
referral URLs
date and time of access
session duration
interactions with the Services
diagnostic and crash information
approximate location information derived from your IP address.

‍

For further information about our use of cookies and similar technologies, please see Section 8 (Cookies and Tracking Technologies).

‍

3. HOW WE PROCESS YOUR INFORMATION

We process your information:

‍

To create and administer your Platform account and facilitate authentication
To onboard Clients, Contractors, and Employed Workers, including identity verification, KYC/AML, and sanctions screening
To create, manage, and administer Statements of Work and related documentation
To manage payments, calculate required taxes and social contributions (where applicable), and calculate amounts owed to Contractors and Employed Workers
To administer employment benefits, where applicable
To verify right-to-work and immigration status, and, where applicable, to support visa sponsorship
To communicate with you regarding your account, Services, and applicable Agreements with Kleos
To respond to inquiries and provide customer support
To detect, investigate, and prevent fraud, security incidents, and violations of our Platform Terms and Conditions
To comply with our legal obligations, including tax, social security, labor, immigration, sanctions, and anti-money laundering laws
With your consent, to send you marketing communications, which you may opt out of at any time.

‍

4. LEGAL BASES FOR PROCESSING (EEA AND UK)

If you are located in the EEA or the United Kingdom, we rely on the following legal bases under the GDPR or UK GDPR, as applicable. Where more than one legal basis is listed, the applicable basis depends on the context of the processing and your relationship with us.

‍

Purpose — Legal basis under Article 6 GDPR / UK GDPR — Additional legal basis for sensitive, special-category, biometric, or criminal-offence data, where applicable

‍

Account administration and Platform authentication
Legal basis: Performance of a contract; legitimate interests in operating and securing the Services
Additional: Not typically applicable

‍

Client, Contractor, and Employed Worker onboarding
Legal basis: Performance of a contract; legitimate interests in administering the Services; legal obligations where verification or recordkeeping is required
Additional: Employment, social security, or social protection law obligations; substantial public interest where applicable; explicit consent where required or appropriate

‍

KYC, AML, sanctions, identity verification, and fraud screening
Legal basis: Legal obligations; legitimate interests in preventing fraud, managing risk, and protecting the Services
Additional: Substantial public interest, legal obligations, and legal claims where applicable; explicit consent where required or appropriate for biometric processing

‍

Contractor and Employed Worker engagement and administration
Legal basis: Performance of a contract; legitimate interests in administering engagements and supporting services to Clients; legal obligations
Additional: Tax, employment, social security, or social protection law obligations; legal claims; substantial public interest where applicable

‍

Payments, payroll, tax withholding, and social contributions
Legal basis: Performance of a contract; legal obligations; legitimate interests in payment administration and financial recordkeeping
Additional: Employment, social security, or social protection law obligations; legal claims; substantial public interest where applicable

‍

Right-to-work, immigration, and visa support
Legal basis: Legal obligations; performance of a contract; legitimate interests in administering lawful engagements
Additional: Employment, social security, or social protection law obligations; substantial public interest; legal claims where applicable

‍

Benefits administration
Legal basis: Performance of a contract; legal obligations; legitimate interests in administering benefits
Additional: Employment, social security, or social protection law obligations; legal claims; explicit consent where required or appropriate; vital interests where applicable

‍

Statement of Work and service administration
Legal basis: Performance of a contract; legitimate interests in providing, managing, and improving the Services
Additional: Not typically applicable, except legal claims or employment/social security obligations where relevant

‍

Communications, customer support, and service notices
Legal basis: Performance of a contract; legitimate interests in responding to requests and administering relationships; consent, where applicable
Additional: Not typically applicable

‍

Security, fraud prevention, troubleshooting, and service integrity
Legal basis: Legitimate interests in protecting the Services, users, Clients, and our business; legal obligations where applicable
Additional: Substantial public interest, legal claims, and legal obligations where applicable

‍

Legal and regulatory compliance
Legal basis: Legal obligations; legitimate interests in demonstrating compliance and cooperating with lawful requests
Additional: Employment, social security, or social protection law obligations; substantial public interest; legal claims; legal obligations where applicable

‍

Marketing communications
Legal basis: Consent where required; legitimate interests where permitted by law
Additional: Not typically applicable

‍

Cookies, analytics, and advertising
Legal basis: Consent for non-essential cookies and similar technologies where required, as described in Section 8; legitimate interests for strictly necessary cookies and service analytics where permitted
Additional: Not typically applicable

‍

Legal claims, dispute resolution, and enforcement of agreements
Legal basis: Legitimate interests in protecting our rights and business; legal obligations where applicable
Additional: Establishment, exercise, or defence of legal claims

‍

Vital interests and emergency situations
Legal basis: Vital interests where necessary to protect someone’s life or physical safety
Additional: Vital interests where the individual is physically or legally incapable of giving consent, and other applicable Article 9 bases where relevant

‍

Where Kleos processes personal information relating to criminal convictions, offences, sanctions screening, background checks, or related security measures, it does so only where authorized by applicable law and subject to any additional safeguards required by GDPR, UK GDPR, or applicable local law.

‍

5. WHEN AND WITH WHOM WE SHARE YOUR INFORMATION

We share personal information only where necessary to provide the Services, comply with applicable law, protect our legitimate interests, or as otherwise described in this Privacy Policy.

‍

Our Processors

We engage third-party service providers that process personal information on our behalf and under our instructions, including providers of cloud infrastructure and hosting; identity verification and compliance screening; payment processing; customer communications and support; analytics and product improvement; document management and electronic signature; and other IT, security, communication, and operational services that assist us in delivering and improving the Services.

‍

A complete and current list of our processors, including their locations, is available in our Trust Center at https://trust.kleos.io/subprocessors. We update that list no later than fifteen (15) days after we engage a new processor or replace an existing one, without amending this Privacy Policy.

‍

Certain service providers may process personal information under their own privacy notices where they act as independent controllers.

‍

Other Recipients

Depending on the Services you use and the nature of your relationship with Kleos, we may also disclose personal information to the following categories of recipients, who generally process personal information as independent controllers or in accordance with their own legal obligations:

‍

Clients. Where you use the Services as a Contractor or Employed Worker, we share relevant personal information with the Client that engaged or invited you to the Services (as the case may be) to administer the engagement, facilitate payments, fulfil contractual obligations, and enable the Client to monitor the services provided under the applicable agreement.

‍

Our Affiliates and Counterparties. We may share personal information with our affiliates and counterparties in jurisdictions in which we operate, where necessary to provide the Services and maintain the Platform, administer customer relationships, support business operations, comply with legal obligations, or manage internal administrative functions.

‍

Financial Institutions. We may share personal information with banks, financial institutions, payment networks, and other payment service providers where necessary to process payments, prevent fraud, or comply with financial regulations.

‍

Government Authorities and Regulators. We may disclose personal information to tax authorities, social security institutions, labor authorities, immigration authorities, courts, regulators, law enforcement agencies, and other governmental bodies where required by applicable law.

‍

Professional Advisers. We may disclose personal information to auditors, accountants, lawyers, insurers, consultants, and other professional advisers where necessary to obtain professional advice, establish or defend legal claims, or comply with legal obligations.

‍

Corporate Transactions. Personal information may be disclosed in connection with an actual or proposed merger, acquisition, financing, investment, restructuring, sale of assets, bankruptcy, or similar corporate transaction, subject to appropriate confidentiality obligations.

‍

Legal Requirements and Protection of Rights. We may disclose personal information where we reasonably believe disclosure is necessary to comply with applicable law or legal process, enforce our agreements, detect or prevent fraud or security incidents, or protect the rights, property, or safety of Kleos, our users, Clients, personnel, or others.

‍

We do not sell personal information for monetary consideration. Where applicable U.S. privacy laws classify certain disclosures through cookies or similar technologies as a “sale” or “sharing” of personal information, you may exercise your opt-out rights as described in Section 12.

‍

6. INTERNATIONAL DATA TRANSFERS

We operate internationally through our affiliates, trusted partners, local counterparties, and service providers located in multiple jurisdictions, including the United States, the United Kingdom, the United Arab Emirates, the European Economic Area (“EEA”), and other countries where we conduct business.

‍

Accordingly, your personal information may be transferred to, accessed from, or otherwise processed in countries other than the country in which it was originally collected. Such transfers may occur between Kleos and its affiliates, between Kleos and our processors, or with other recipients described in this Privacy Policy where necessary to provide the Services, maintain and develop the Platform, or comply with applicable legal obligations.

‍

Where personal information originating in the EEA, the United Kingdom, Switzerland, or another jurisdiction with cross-border transfer restrictions is transferred to another country, we implement appropriate safeguards in accordance with applicable law. Depending on the circumstances, these safeguards may include:

‍

adequacy decisions adopted by the European Commission, the UK Government, the Swiss Federal Council, or other competent authorities
the European Commission's Standard Contractual Clauses (SCCs)
the UK International Data Transfer Addendum or International Data Transfer Agreement (IDTA)
contractual commitments requiring recipients to protect personal information in accordance with applicable data protection laws; or
any other lawful transfer mechanism recognized under applicable law.

‍

Where required by applicable law, you may request further information about the safeguards applicable to international transfers of your personal information by contacting us at support@kleos.io.

‍

The jurisdiction-specific provisions in Section 13 supplement this Privacy Policy where required by local law. Unless otherwise stated, the general provisions of this Privacy Policy apply to all processing activities described herein.

‍

7. HOW LONG WE KEEP YOUR INFORMATION

We retain personal information for the period necessary for the purposes described in this Privacy Policy and as required or permitted by applicable law in each relevant jurisdiction, including to provide the Services, administer our relationship with you or the Client, facilitate payments, comply with applicable legal, tax, accounting, employment, immigration, anti-money laundering (“AML”), and regulatory obligations, resolve disputes, enforce our agreements, and establish, exercise, or defend legal claims. In determining retention periods, we consider criteria such as the nature and sensitivity of the information, the purposes for which it was collected, the duration of the relevant account, engagement, employment, or service relationship, applicable limitation periods, security and fraud-prevention needs, and legal or regulatory recordkeeping requirements.

‍

Different categories of records may be retained for different periods depending on these criteria, such as account records, KYC and identity verification records, tax, payroll, and employment records, payment records, support communications, cookie and analytics data. If you cease using the Services or your account is permanently closed, we will retain your personal information only for as long as necessary for the purposes described above and as required or permitted by applicable law.

‍

For Employed Workers’ personal information, retention periods may vary depending on the jurisdiction in which the employment relationship exists, the employing entity, and the applicable employment, payroll, tax, social security, immigration, benefits, corporate, and other legal requirements. We retain employment-related records for the periods required under the laws of the relevant jurisdiction and securely delete or anonymize such information once those legal retention periods have expired, unless a longer retention period is required to establish, exercise, or defend legal claims or otherwise permitted by applicable law.

‍

Where permitted by applicable law, we may retain certain information for longer where necessary to comply with legal or regulatory obligations, prevent fraud, protect the security and integrity of the Services, enforce our agreements, or establish, exercise, or defend legal claims. When personal information is no longer needed for the purposes described in this Privacy Policy and no longer required or permitted to be retained by applicable law, we will securely delete, anonymize, or irreversibly de-identify it in accordance with our retention and disposal procedures.

‍

We may anonymize or irreversibly de-identify personal information so that it can no longer reasonably be associated with an identified or identifiable individual. Once anonymized, we may use that information for analytics, research, product development, service improvement, security, and other lawful business purposes without further notice to you.

‍

8. COOKIES AND OTHER TRACKING TECHNOLOGIES

We use cookies and similar technologies (such as pixels, tags, software development kits (SDKs), and local storage) to operate, secure, and improve our Services. These technologies allow us to recognize your browser or device, remember your preferences, understand how the Services are used, and, where you have given your consent, measure the effectiveness of our marketing activities and provide more relevant advertising.

‍

We use the following categories of cookies:

‍

Essential Cookies. These cookies are necessary for the operation, security, and functionality of the Services. They enable core features such as authentication, security, network management, and user preferences (including cookie consent preferences). Because these cookies are strictly necessary to provide the Services, they cannot be disabled through our cookie preference center.

‍

Analytics Cookies. These cookies help us understand how visitors use our website and Services, including which pages are visited, how users navigate the Services, and whether errors or technical issues occur. We use this information to monitor performance, improve functionality, and enhance the user experience. Analytics cookies are used only with your consent where required by applicable law.

‍

Advertising Cookies. These cookies and similar technologies help us and our advertising partners understand your interests and interactions so that we can measure the effectiveness of our marketing campaigns and, where applicable, display advertisements that are more relevant to you across websites and online services. Advertising cookies are used only with your consent where required by applicable law.

‍

Where required by applicable law, we will obtain your consent before placing or accessing any cookies or similar technologies that are not strictly necessary for the operation of the Services. You may accept or reject optional cookies through our cookie preference center when you first visit our website and may update your preferences at any time by accessing the cookie settings available on our website to disable non-essential cookies. Further details about the specific cookies and similar technologies we use, including their providers and durations, are set out in our Cookie Policy, available at https://kleos.io/cookie-policy.

‍

9. HOW WE KEEP YOUR INFORMATION SAFE

We implement and maintain appropriate technical and organizational security measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the nature of the personal information and the risks associated with its processing.

‍

Our security measures include, among others:

‍

encryption of personal information in transit and, where appropriate, at rest
role-based access controls and the principle of least privilege, ensuring that access to personal information is limited to authorized personnel who require it to perform their responsibilities
identity and access management controls, including authentication measures designed to protect user accounts
logging, monitoring, and security measures designed to detect, investigate, and respond to unauthorized access or other security events
regular security assessments, vulnerability management, and testing of our systems and infrastructure
due diligence and contractual safeguards for third-party service providers that process personal information on our behalf
policies and procedures designed to promote the secure handling of personal information
incident response procedures designed to identify, contain, investigate, and remediate security incidents.

‍

While we take reasonable steps to safeguard personal information, no method of transmission over the Internet or electronic storage is completely secure. Accordingly, we cannot guarantee the absolute security of your personal information.

‍

If we become aware of a security incident affecting your personal information, we will investigate the incident promptly, take appropriate measures to contain and remediate it, and provide any notifications required under applicable law.

‍

10. CHILDREN'S PRIVACY

The Services are not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children under 18 (or the equivalent minimum age under applicable law). If we learn that we have collected personal information from a child without appropriate consent, we will take steps to delete such information.

‍

11. YOUR PRIVACY RIGHTS (EEA, SWITZERLAND AND UK)

If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, you may have the following rights under applicable data protection laws, subject to certain conditions and exceptions:

‍

Right of access – to obtain confirmation as to whether we process your personal information and to receive a copy of that information.

‍

Right to rectification – to request that inaccurate or incomplete personal information be corrected.

‍

Right to erasure – to request deletion of your personal information where applicable.

‍

Right to restriction of processing – to request that we limit the processing of your personal information in certain circumstances.

‍

Right to data portability – to receive certain personal information in a structured, commonly used, and machine-readable format and, where technically feasible, to have it transmitted to another controller.

‍

Right to object – to object to processing based on our legitimate interests and, at any time, to processing of your personal information for direct marketing purposes.

‍

Right to withdraw consent – where we rely on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

‍

Rights relating to solely automated decision-making – not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you, except where permitted by applicable law or where such decision is necessary for entering into, or performance of, a contract between you and us.

‍

Right to lodge a complaint with the competent supervisory authority in your country of habitual residence, place of work, or where the alleged infringement occurred. Please see a list of EU member states supervisory authorities here, and the UK'’s supervisory authority (ICO) here.

‍

Some of these rights may be limited where we have compelling legitimate grounds for processing, are required to retain information to comply with legal obligations, or another exemption applies under applicable law. For example, for Employed Workers we may be required to retain employment, payroll, tax, social security, immigration, or other statutory records for periods prescribed by applicable law. Where we cannot fully comply with a request, we will explain the legal basis for our decision.

‍

To exercise your rights, please contact us using the details provided in Section 15. We may request additional information to verify your identity before responding to your request. We will respond within the timeframes required by applicable law.

‍

EU and UK Representatives

As we are established in the United States and may process personal information of individuals located in the European Economic Area (“EEA”) and the United Kingdom, we have appointed representatives in those jurisdictions as required under applicable data protection laws.

Our EU representative is:

Aleksei Chistiakov

Calle Unió 118, Floor 1

08800 Vilanova i la Geltrú (Barcelona)

Spain

Email: support@kleos.io

Our UK representative is:

STAPE ONLINE LTD, registered address at Sovereign Gate 18-20 Kew Road, Sovereign Gate, Richmond, England, TW9 2NA, company number 16509558.

ea@kleos.io

‍

You may contact our EU or UK representative regarding matters related to our processing of your personal information. You may also contact us directly using the contact details provided in this Privacy Policy.

‍

12. U.S. STATE PRIVACY RIGHTS

This Section applies to residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and any other U.S. state that adopts a comprehensive privacy law, to the extent such law applies to our processing of your personal information.

f you are a California resident and we process your personal information in connection with your employment, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), may apply to that processing. Accordingly, you may have the rights described in this Section with respect to your employment-related personal information, subject to applicable legal limitations and exceptions, including obligations requiring us to retain certain employment, payroll, tax, benefits, or other records.

‍

Categories of Personal Information We Collect and Business Purposes

Depending on your relationship with us, we may collect the following categories of personal information as defined under applicable U.S. state privacy laws. We collect and use this information for the following business and commercial purposes.

‍

Where required by California law, this Privacy Policy is intended to serve as our notice at collection, including by describing the categories of personal information collected, the purposes for which we collect and use them, the categories of recipients to whom information may be disclosed, and retention practices described in Section 7.

‍

Category of Personal Information — Examples — Business Purposes — Categories of Recipients

‍

Identifiers
Examples: Name, email address, telephone number, postal or residential address, date of birth, account credentials, government-issued identification documents and information, tax identification numbers, and other identifying information
Business purposes: Providing and administering the Services; creating and managing accounts; communicating with users; verifying identity; complying with legal obligations; preventing fraud; maintaining security; customer support; recordkeeping
Recipients: Service providers; Clients; Affiliates; identity verification providers; professional advisers; government authorities where required

‍

Personal information and characteristics
Examples: Nationality, citizenship, residency information, gender, date of birth, and other personal details provided in connection with the Services
Business purposes: Administering contractor and employment relationships; determining eligibility for Services; complying with employment, immigration, tax, and regulatory requirements; maintaining records
Recipients: Clients; Affiliates; service providers; identity verification providers; government authorities; professional advisers

‍

Commercial information
Examples: Client details, engagement information, service-related records, transaction history, and information relating to your use of the Services
Business purposes: Providing and improving the Services; managing contractual relationships; processing transactions; customer support; billing and account administration; dispute resolution
Recipients: Clients; Affiliates; service providers; professional advisers; government authorities where necessary

‍

Financial information
Examples: Bank account or card details, payment information, salary, compensation, benefits information, tax information, and payment records
Business purposes: Processing payments; payroll administration; tax and accounting compliance; fraud prevention; financial recordkeeping
Recipients: Payment processors; banks and financial institutions; Clients; Affiliates; service providers; government authorities

‍

Professional or employment-related information
Examples: Job title, role, employment agreements, work location, working hours, compensation information, leave records, performance-related information, immigration and right-to-work documentation, and employment records
Business purposes: Administering employment and contractor engagements; payroll and benefits administration; compliance with employment, tax, immigration, and social security obligations; dispute resolution
Recipients: Clients; Affiliates; payroll partners; government authorities; service providers

‍

Internet or electronic network activity information
Examples: IP address, browser type, device information, operating system, pages viewed, usage activity, timestamps, session information, and interactions with the Services
Business purposes: Operating and securing the Services; troubleshooting; monitoring performance; analytics; improving functionality; detecting and preventing fraud and security incidents
Recipients: Analytics providers; security providers; IT providers; hosting providers; affiliates

‍

Geolocation information
Examples: Approximate location derived from IP address or device information
Business purposes: Security purposes; fraud prevention; service functionality; compliance with applicable laws and requirements
Recipients: Security and verification providers; IT service providers

‍

Audio, electronic, visual, or similar information
Examples: Photographs, facial images, selfies, videos, and other identity verification materials
Business purposes: Identity verification; fraud prevention; security; compliance with KYC and AML obligations
Recipients: Identity verification providers; service providers

‍

Biometric information
Examples: Facial geometry information or liveness verification information used for identity verification purposes
Business purposes: Verifying identity; authenticating identity documents; preventing fraud; maintaining security and complying with legal obligations
Recipients: Identity verification providers; security providers; affiliates

‍

Inferences and compliance information
Examples: Identity verification results, fraud indicators, risk assessments, sanctions screening results, PEP screening results, and compliance-related information
Business purposes: Fraud prevention; security; compliance with legal and regulatory obligations; risk management
Recipients: Identity verification providers; payment processors and banks; payroll providers; Clients; Affiliates; government authorities; service providers

‍

Sensitive personal information
Examples: Government identification numbers, financial account information, citizenship and immigration information, precise geolocation where collected, health information where required for employment purposes, and biometric information used for identity verification
Business purposes: Providing the Services; complying with legal obligations; administering employment relationships; identity verification; fraud prevention; security; exercising or defending legal claims
Recipients: Identity verification providers; payment processors and banks; payroll providers; Clients; Affiliates; government authorities; service providers

‍

We may also use personal information for other purposes permitted under applicable law, including auditing interactions and transactions, detecting and preventing security incidents, maintaining the quality and safety of our Services, conducting internal business operations, and exercising or defending legal rights.

‍

We do not use sensitive personal information for purposes that require a right to limit its use under applicable U.S. privacy laws unless permitted by law or with appropriate consent.

‍

For more information about the specific recipients and processors we rely on, see Section 5 (When and With Whom We Share Your Information).

‍

Your Rights

Depending on where you reside and the extent to which applicable U.S. state privacy laws apply to Kleos and to the relevant processing, you may have certain rights regarding your personal information. These rights may be subject to certain exceptions and limitations under applicable law.

‍

Your rights may include:

‍

Right to know and access – request information about the personal information we have collected about you, including the categories of personal information collected, the categories of sources from which the information was collected, the purposes for collecting and using personal information, the categories of third parties to whom we disclose personal information, and, where required by applicable law, the specific pieces of personal information we have collected about you.

‍

Right to correct – request that we correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes for which we process it.

‍

Right to delete – request deletion of your personal information, subject to certain exceptions permitted by applicable law. For example, we may retain personal information where necessary to provide the Services, complete a transaction, comply with legal obligations, maintain records required by law, detect or prevent security incidents or fraud, exercise or defend legal claims, or otherwise comply with applicable legal requirements.

‍

Right to obtain a copy – request a copy of personal information that we maintain about you in a portable and, where technically feasible, readily usable format, subject to applicable legal limitations.

‍

Right to opt out of sale or sharing of personal information – request to opt out of the sale of personal information or the sharing of personal information for cross-context behavioral advertising, where these concepts apply under applicable law. We do not sell personal information for monetary consideration. Where the use of cookies or similar technologies for analytics or advertising purposes is considered a "sale" or "sharing" under applicable U.S. privacy laws, you may exercise your opt-out rights through our cookie preference center, which can be used to disable non-essential cookies.

‍

Right to opt out of certain targeted advertising and profiling activities – where required by applicable law, you may have the right to opt out of certain processing activities involving targeted advertising or profiling that produces legal or similarly significant effects.

‍

How to Exercise Your Rights

To submit a request or exercise applicable opt-out rights, please contact us using the details provided in Section 15. We honor browser-based opt-out preference signals, such as Global Privacy Control (GPC), as a valid request to opt out of the sale or sharing of personal information for the browser or device that sends the signal, to the extent required by applicable law. We will take reasonable steps to verify your identity before completing your request, which may require you to provide additional information. The verification process will depend on the nature of your request and the sensitivity of the personal information involved.

‍

You may also authorize another person to submit a request on your behalf. Where permitted by applicable law, we may require the authorized agent to provide proof of authorization, and we may require you to verify your identity directly with us.

‍

We will respond to your request within the timeframes required by applicable law. If we are unable to fulfill your request, we will explain the reasons for our decision and any rights you may have to appeal that decision.

‍

We will not discriminate against individuals for exercising any of their privacy rights.

‍

Appeals

If we decline to take action on your privacy request, you may appeal our decision by contacting us at support@kleos.io. We will review your appeal and provide a written response within the timeframe required by applicable law.

‍

If your appeal is denied, you may have the right to contact your state attorney general or other applicable regulatory authority, depending on your jurisdiction.

‍

California Privacy Rights

Under California Civil Code section 1798.83, California residents may request, once per calendar year and free of charge, information about certain categories of personal information that we have disclosed to third parties for those third parties' own direct marketing purposes during the preceding calendar year.

‍

We do not disclose personal information to third parties for their own direct marketing purposes.

‍

Biometric Information Notice for Certain U.S. Residents

If you are a resident of Illinois, Washington, Texas, or another jurisdiction that regulates biometric information, this section provides additional disclosures regarding our collection and use of biometric information. Kleos may collect, control, and process biometric information in connection with identity verification, fraud prevention, security, and compliance activities.

‍

In connection with identity verification, fraud prevention, and compliance activities, we may collect and process biometric information, including facial images, facial geometry information, selfies, videos, liveness verification data, and other information generated during the identity verification process. We use this information solely to verify your identity, authenticate identity documents, prevent fraud, protect the security of the Services, and comply with applicable legal and regulatory obligations.

‍

We maintain a written policy governing the retention and destruction of biometric information as required under the Illinois Biometric Information Privacy Act (“BIPA”). This policy is made available to the public as required by BIPA and establishes our retention schedule and guidelines for permanently destroying biometric identifiers and biometric information. You can review the policy here: https://kleos.io/biometric-information-policy

‍

13. ADDITIONAL JURISDICTION-SPECIFIC PRIVACY RIGHTS

The provisions below address certain countries in which we currently, or may in the future, operate as a business. This list is not exhaustive; for any jurisdiction not listed, the general provisions of this Privacy Policy apply, and we will provide further jurisdiction-specific information upon request.

‍

United Arab Emirates

If you are based in the United Arab Emirates, we process your personal information in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and applicable free-zone regulations. You have the right to request access to, correction of, and, subject to our statutory retention obligations, deletion of your personal information, and to object to certain processing, by contacting us at support@kleos.io.

‍

14. UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time without notifying you, unless otherwise required by law. The “Last updated” date at the top of this Privacy Policy reflects the most recent revision. We encourage you to review this Privacy Policy periodically to stay informed about updates. The revised Privacy Policy will apply after the effective date or “Last updated” date stated at the top of the policy, except where applicable law requires additional notice or another effective date.

‍

15. CONTACT US

If you have questions or concerns about this Privacy Policy or our data practices, or would like to exercise your privacy rights, please contact us at:

Telecom Apps LLC (d/b/a Kleos)

303 Twin Dolphin Drive, Suite 800, Redwood City, CA

United States