Privacy Policy

Last updated: 6 May 2026

This Privacy Policy describes how [KNDY LEGAL ENTITY] ("KNDY", "we", "us", "our") collects, uses, processes, retains, and protects personal data in connection with the bespoke joinery and design services provided through the website at kndyinteriors.com and the private project portal accessed by clients of the studio.

We are committed to handling personal data lawfully, fairly, and transparently. This policy applies to all individuals whose personal data we process, including prospective clients, engaged clients, trade partners, and visitors to our website.

1. Who we are

Data controller: [KNDY LEGAL ENTITY], registered in Switzerland.

Registered address: [REGISTERED ADDRESS].

Contact for privacy matters: info@kndyinteriors.com.

KNDY does not have a Data Protection Officer (DPO). Privacy enquiries are handled directly by the studio principal at the address above.

2. Personal data we collect

The categories of personal data we process depend on the nature of your interaction with us. We may collect:

Contact details: name, email address, telephone number.
Project information: project location, property type, project type (kitchen, wardrobes, wine cellar, full-home joinery), style preferences, drawings or sketches you upload, materials and finishes preferences, hardware preferences, indicative budget, timeline, and any other details you choose to share.
Communications: messages you send to us through the project portal, email, or via our website chat assistant ("Alfred"), including any conversation history retained in your portal for the duration of the project.
Files: images, drawings, PDFs, and other documents you upload to your private project portal.
Booking and scheduling data: calendar availability, meeting confirmations, call recordings (only when explicitly arranged in advance).
Financial information: details required to issue and reconcile quotes, proforma invoices, and final invoices. We do not collect or store payment card numbers; bank transfers are settled via your bank.
Technical data: IP address, device type, browser, pages visited, approximate location (city level), referring URL. Collected via Google Analytics 4 with anonymisation enabled.

3. Why we collect your data

We process personal data for the following purposes:

To deliver the bespoke joinery service you have engaged us for, including responding to enquiries, preparing quotes, designing and producing the agreed work, scheduling delivery and installation, and providing aftercare.
To communicate with you about your project, including transactional emails (welcome, quote ready, proforma, invoice, install scheduled, aftercare), in-portal messaging, and direct correspondence.
To meet our legal and regulatory obligations, including Swiss commercial accounting and tax law (which requires retention of business records for ten years).
To improve our service, on the basis of our legitimate interest in operating and developing the studio. Analytics is anonymised; no individual is profiled.
To prevent abuse of our website (rate limiting, fraud prevention, security logging), on the basis of our legitimate interest in protecting our systems and clients.

4. Legal basis for processing

We rely on the following legal bases under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR):

Performance of a contract (Art. 6(1)(b) GDPR): processing necessary to deliver the services you have engaged us for.
Consent (Art. 6(1)(a) GDPR): where you have explicitly opted in, for example by submitting a project brief through our website, by uploading files, or by accepting cookies for analytics. Consent can be withdrawn at any time.
Legitimate interest (Art. 6(1)(f) GDPR): for analytics, anti-abuse measures, and limited internal record-keeping. We balance these interests against your fundamental rights and freedoms.
Legal obligation (Art. 6(1)(c) GDPR): for retention of accounting and tax records as required by Swiss law.

5. Third-party processors

We rely on the following third-party service providers to operate KNDY. Each is bound by appropriate contractual safeguards (data processing agreements, standard contractual clauses where applicable) and processes personal data only on our instructions and for the purposes described in this policy.

Provider	Purpose	Location
Supabase	Database storage for briefs, messages, files, financial documents.	Frankfurt, Germany (EU).
Vercel	Website and application hosting, content delivery network.	United States. GDPR-compliant (standard contractual clauses).
Resend	Transactional email delivery (welcome, quote, invoice, scheduling).	United States. GDPR-compliant.
Cal.com	Booking and meeting scheduling.	European Union and United States. GDPR-compliant.
Google Analytics 4	Anonymous usage analytics (no marketing or remarketing tracking).	United States. IP anonymisation enabled. Standard contractual clauses.
Google Ads	Advertising and conversion measurement.	United States. Standard contractual clauses.
Anthropic Claude	AI-assisted conversation through our website chat assistant ("Alfred"). Conversations may be processed by Anthropic's API.	United States. Standard contractual clauses. Anthropic does not train models on API data.
Infomaniak	Email hosting for our info@kndyinteriors.com inbox.	Switzerland.

6. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or to comply with legal obligations.

Active project data: retained for the duration of the project and the warranty period (typically the lifetime of installed Blum hardware for the original purchaser, or as otherwise specified in your contract).
Financial records (quotes, proforma invoices, invoices, payment records): retained for ten years from the end of the financial year in which the project completed, in accordance with the Swiss Code of Obligations.
Marketing analytics: retained for fourteen months in Google Analytics 4 (default retention).
Communications and brief content: retained while the project is active and for a reasonable period thereafter for warranty and aftercare. You may request earlier deletion at any time (see Section 8).
After deletion: personal identifiers are wiped from our systems. Anonymised financial records are retained for the legal retention period above.

7. International data transfers

Some of our processors are based outside Switzerland and the European Economic Area, primarily in the United States. Where personal data is transferred outside the EU/EEA or Switzerland, we rely on:

Standard Contractual Clauses approved by the European Commission, as supplemented by the Swiss FDPIC where applicable.
Adequacy decisions where they exist.
Provider participation in recognised certification frameworks where applicable.

You may request a copy of the safeguards in place for any specific transfer by contacting us at the address in Section 1.

8. Your rights

Under Swiss FADP and (where applicable) GDPR, you have the following rights regarding your personal data:

Right of access: obtain a copy of the personal data we hold about you.
Right of rectification: have inaccurate data corrected.
Right of erasure ("right to be forgotten"): request deletion of your personal data, subject to retention obligations described in Section 6.
Right of restriction: ask us to restrict processing in certain circumstances.
Right of data portability: receive your data in a structured, commonly used, machine-readable format.
Right to object: object to processing based on legitimate interest, including direct marketing.
Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint: with a competent supervisory authority (see Section 11).

To exercise any of these rights, write to info@kndyinteriors.com. We will respond within thirty days.

9. Cookies

Our website uses a minimal set of cookies:

Strictly necessary cookies: required for the website and project portal to function (session management, security). These cannot be disabled.
Analytics cookies: Google Analytics 4 with IP anonymisation. Used to understand aggregate traffic patterns. No personally identifying profiles are built.

We do not use marketing or remarketing cookies. We do not embed third-party advertising trackers beyond Google Ads conversion measurement on the post-submission confirmation page.

You can disable analytics cookies in your browser settings or via the Google Analytics opt-out browser add-on.

10. Children

Our services are intended for adults engaging us for residential joinery work. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us so we can delete it.

11. Supervisory authorities and complaints

You have the right to lodge a complaint with a supervisory authority if you believe we have processed your personal data unlawfully.

Switzerland (primary authority): Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (Federal Data Protection and Information Commissioner). edoeb.admin.ch.
European Union: the data protection authority in your country of residence. A list is maintained at edpb.europa.eu.
United Kingdom: Information Commissioner's Office (ICO). ico.org.uk.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The "Last updated" date at the top of this page indicates the most recent version. Material changes will be notified by email to active clients. We encourage you to review this policy periodically.

13. Contact

For any questions about this policy or about how we handle your personal data, write to info@kndyinteriors.com. We aim to respond within five working days.