European privacy notice
GDPR supplement
Effective date: 21 October 2026
This notice supplements the ikr Privacy Policy where the EU General Data Protection Regulation (GDPR) applies to a particular processing activity. Applicability depends on the relevant establishment, service offering or monitoring activity; it is not determined by nationality alone.
Read this notice together with the Privacy Policy, which describes information categories, sources, recipients, retention criteria and service controls.
1. Controller and contact
Controller: KMJ by Design, operating as ikr
Address: Beit El 24, Tel Aviv, Israel
Privacy enquiries and rights requests: [email protected]
If a data protection officer is appointed, the relevant contact details will be provided. The privacy contact above is not, by itself, a claim that a statutory data protection officer has been appointed.
2. Purposes and legal bases
The legal basis depends on the particular processing and the person whose information is involved.
| Purpose | Basis and scope |
|---|---|
| Answering an individual’s request about a service or taking requested steps before an agreement | Article 6(1)(b), where those steps are genuinely requested by that individual; otherwise an assessed legitimate interest in responding to correspondence |
| Operating an individual’s account and features necessary to supply the service they request | Article 6(1)(b), limited to processing objectively necessary for that agreement |
| Security, abuse prevention, support, diagnosis and proportionate service administration | Article 6(1)(f), where necessary for legitimate interests in protecting and reliably operating the service and where those interests are not overridden by affected individuals’ rights |
| Optional marketing, optional tracking or other consent-based features | Article 6(1)(a) where consent is the selected or required basis; additional electronic-communications rules may also apply |
| Meeting an applicable EU or Member State legal obligation | Article 6(1)(c), where the relevant obligation actually applies; a legal requirement from another country is not automatically this GDPR basis |
| Information about children, other group participants or people who are not party to the user’s agreement | Article 6(1)(f): the legitimate interest of the user, and of ikr, in helping a parent act on communications they have lawfully received, limited to content from sources the user selects, with unselected and private content discarded, originals cleared after a short period, and no use of this information for marketing or profiling. Where a particular feature needs it, the consent of the person concerned (Article 6(1)(a)) is obtained before that processing begins. |
A parent’s agreement with ikr is not automatically a contractual basis for processing another parent’s, teacher’s or child’s information. Selecting a source, possessing a message or agreeing to website terms does not by itself demonstrate the affected person’s consent.
Where consent is used, you may withdraw it through the relevant choice or by contacting us. Withdrawal does not affect processing lawfully carried out before it was withdrawn. A feature that genuinely depends on the withdrawn consent may no longer be available.
Where sensitive information is processed, an applicable Article 9 condition is needed in addition to an Article 6 basis. Routine website use does not require sensitive personal information. A separately described feature must explain any necessary additional condition, such as explicit consent where appropriate.
3. Information obtained from another person or source
Information about you may come from a user who submits a message or document, an enabled group or account, a shared household, or a participating organisation. It may include your name, contact or group identifiers, message content, attachments and contextual information included in those materials.
If you have not provided the information yourself, you can ask us about its source, the relevant processing and your rights without becoming an ikr user. We may need a group name, approximate date or other limited context to locate the information.
Where Article 14 requires information to be provided directly or through another suitable arrangement, a public policy alone does not replace that obligation. Any exception must have a valid legal basis and appropriate safeguards.
4. Recipients and international transfers
The recipient categories are described in Section 7 of the Privacy Policy. They include providers of hosting, AI interpretation, communication and support, and people given access through a shared feature.
Where information is transferred outside the European Economic Area, the transfer must meet the applicable GDPR transfer conditions. The safeguard used depends on the destination and recipient. It may involve an applicable adequacy decision or appropriate contractual safeguards, together with any additional measures needed for that transfer.
The arrangements used for ikr are: Israel’s adequacy decision for the operator; for providers in the United States, their data processing terms incorporating the EU Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework. Request a copy or further information, subject to lawful redactions, from [email protected].
The existence of a privacy policy or a general statement that a supplier is compliant does not itself establish a valid transfer mechanism.
5. Retention
Section 9 of the Privacy Policy explains the criteria used to determine retention and the differences between source content, saved items, shared records, technical records and recoverable copies.
Where a fixed period is not stated, the relevant criteria include the period needed to provide the requested service or handle the interaction, the status of the account or saved item, applicable record-keeping or claims requirements, and whether the purpose can be met with less identifiable information.
A deletion request is assessed under the applicable law. Information is not retained merely because storage is technically possible. If a particular record must remain, we explain the applicable reason where required.
6. Your rights
Subject to the GDPR’s conditions, you may:
- Receive clear information about processing and request access to your personal data.
- Request correction of inaccurate or incomplete information.
- Request erasure where the applicable grounds are met.
- Request restriction of processing in the circumstances provided by law.
- Receive qualifying data you provided in a structured, commonly used, machine-readable format, and request its transmission where technically feasible, where the processing is automated and based on consent or contract.
- Object to processing based on legitimate interests because of your particular situation. We must then assess whether lawful grounds permit the processing to continue.
- Object at any time to processing for direct marketing, including related profiling.
- Withdraw consent where processing relies on it.
- Exercise the protections applicable to qualifying decisions based solely on automated processing that produce legal or similarly significant effects.
To exercise a right, email [email protected]. We may seek proportionate identity or authority verification, while avoiding unnecessary additional data collection and protecting other people’s information.
We respond without undue delay and ordinarily within one month of receiving a request. Where the GDPR permits an extension of up to two further months because of complexity or the number of requests, we explain the extension and reasons within the initial month.
Requests are ordinarily free. We may apply the limited lawful exceptions for manifestly unfounded or excessive requests and will explain the relevant decision and available complaint route.
7. Automated interpretation
ikr uses automated processing to identify, organise, translate and prioritise information. This involves evaluation of submitted or connected content and relevant context. Outputs may affect what is shown or brought to a user’s attention.
The intended role is to assist family coordination and user decisions. It is not intended to make solely automated decisions with legal or similarly significant effects about an individual. If a feature introduces such decision-making, the required information and protections must be addressed before that processing begins.
You can challenge an interpretation or contact us about its effect on information concerning you. Always check original instructions before an important action.
8. Complaints
You may complain to a competent supervisory authority, in particular in the EU/EEA country of your habitual residence, place of work or the alleged infringement. You do not need our permission or a prior complaint to us.
A list of EEA supervisory authorities is available from the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
9. Information and choices
Where information is necessary for a particular service or requested agreement, declining it can prevent that service or request from being completed. Optional choices are identified separately. Acceptance of website terms is not consent to optional processing.
For questions about this notice or a particular processing activity, contact [email protected].