Privacy policy
This page describes what personal data KX Estate processes, for which purposes, who it is shared with, and what rights you have as a data subject.
Version 1.0 · effective 2 July 2026
1. Data controller
The controller of personal data is KERNEXIT SRL (IDNO 1026023040248, Chișinău, Republic of Moldova) — the company that builds and provides the KX Estate service. Contact us about personal data at estate@kernex.md.
We process data in accordance with the personal data protection legislation of the Republic of Moldova (Law no. 133/2011 and, from 23 August 2026, Law no. 195/2024, which transposes the GDPR).
2. What data we process
On this website (kxestate.md)
- Demo request form and quiz: name, e-mail, phone, company name, and whatever you include in your request.
- Analytics cookies (Google Analytics and PostHog): anonymised visit statistics — only after your explicit consent in the cookie banner. Without consent, analytics stays off.
In the KX Estate app (estate.kernex.md)
- Account data: name, e-mail, password (stored hashed), interface language, role in the organisation. Here we act as controller.
- Your organisation's data: contacts, tenants, contracts, payments, documents, meter readings and bank transactions your organisation enters into the system. This data belongs to your organisation — we process it on its behalf as a processor under a data processing agreement (DPA) available in the organisation's settings.
3. Purposes and legal bases
- Responding to your request and demoing the product — steps taken at your request before entering a contract.
- Providing the service (account, payment and contract notifications) — performance of a contract.
- Website analytics — your consent (withdrawable at any time).
- Security and abuse prevention — legitimate interest.
- Accounting — legal obligation.
4. Who we share data with
We do not sell personal data. To run the service we use a limited set of providers (sub-processors), each bound by contractual data-protection safeguards:
- OVH (EU, France) — application and database hosting.
- Cloudflare (EU/US) — hosting of this website and CDN.
- Resend (US) — transactional e-mail delivery.
- PostHog (data in the EU) — product and website analytics (with consent).
- Google (Google Analytics 4, US) — website analytics (with consent, IP anonymised).
- Anthropic (US) — AI features (document parsing, assistant); data sent via API is not used to train models.
- Salt Edge (EU/Canada) — bank account connections (open banking), only if your organisation enables bank reconciliation.
- maib (Moldova) — payment processing for subscription billing; card details are entered on the bank's secure page, we store only payment metadata.
Transfers outside the Republic of Moldova and the EU rely on safeguards provided by law (in particular, standard contractual clauses).
5. Retention
Demo-request data is kept for up to 24 months after the last contact. Account data — for as long as the account is active. Organisation data — for the duration of the organisation's subscription; after termination it is deleted or anonymised within a reasonable period, except data we must retain by law (e.g. accounting records).
6. Your rights
You may request access to your data, rectification, erasure, restriction of processing, and portability, object to processing, and withdraw consent. Write to estate@kernex.md — we respond within one month. If you believe your rights have been violated, you may lodge a complaint with the National Center for Personal Data Protection of Moldova (CNPDCP, datepersonale.md).
7. Security
Access to data is role-based, connections are encrypted (TLS), passwords are stored as hashes, and regular backups are made. Each organisation's data is isolated at the database level.
8. Miscellaneous
The service is not directed at persons under 18. When this policy changes, we will publish the new version on this page with its effective date; material changes will be announced by e-mail.