Privacy policy
This page describes what personal data KX Estate processes, for which purposes, who it is shared with, and what rights you have as a data subject.
Version 1.1 · effective 23 August 2026 (version 1.0 — from 2 July 2026)
1. Data controller
The controller of personal data is KERNEXIT SRL (IDNO 1026023040248, Chișinău, Republic of Moldova) — the company that builds and provides the KX Estate service. Contact us about personal data at privacy@kernex.md.
We process data in accordance with Law no. 195/2024 of the Republic of Moldova on personal data protection (in force since 23 August 2026; it replaced Law no. 133/2011 and transposes the GDPR) and, for cookies, Law no. 284/2004 on electronic commerce.
2. What data we process
On this website (kxestate.md)
- Demo request form and quiz: name, e-mail, phone, company name, and whatever you include in your request. Together with the request we record your consent (the ticked checkbox): the version of this policy, the time, your IP address and browser — so we can demonstrate it if needed.
- Analytics cookies (Google Analytics and PostHog): anonymised visit statistics — only after your explicit consent in the cookie banner. Without consent, the analytics scripts are not loaded at all (see section 9).
In the KX Estate app (cp.kxestate.md)
- Account data: name, e-mail, password (stored hashed), interface language, role in the organisation. Here we act as controller.
- Your organisation's data: contacts, tenants, contracts, payments, documents, meter readings and bank transactions your organisation enters into the system. This data belongs to your organisation — we process it on its behalf as a processor under a data processing agreement (DPA) available in the organisation's settings.
3. Purposes and legal bases
- Responding to your request and demoing the product — steps taken at your request before entering a contract.
- Providing the service (account, payment and contract notifications) — performance of a contract.
- Website analytics — your consent (withdrawable at any time).
- Security and abuse prevention — legitimate interest.
- Accounting — legal obligation.
4. Who we share data with
We do not sell personal data. To run the service we use a limited set of providers (sub-processors), each bound by contractual data-protection safeguards:
- OVH (EU, France) — application and database hosting.
- Cloudflare (EU/US) — hosting of this website and CDN.
- Resend (US) — transactional e-mail delivery.
- PostHog (data in the EU) — product and website analytics (with consent).
- Google (Google Analytics 4, US) — website analytics (with consent, IP anonymised).
- Anthropic (US) — AI features (document parsing, assistant); data sent via API is not used to train models.
- Salt Edge (EU/Canada) — bank account connections (open banking), only if your organisation enables bank reconciliation.
- maib (Moldova) — payment processing for subscription billing; card details are entered on the bank's secure page, we store only payment metadata.
Transfers outside the Republic of Moldova and the EU rely on safeguards provided by law (in particular, standard contractual clauses).
5. Retention
Demo-request data is kept for up to 24 months after the last contact. Account data — for as long as the account is active. Organisation data — for the duration of the organisation's subscription; after termination it is deleted or anonymised within a reasonable period, except data we must retain by law (e.g. accounting records).
6. Your rights
You may request access to your data, rectification, erasure, restriction of processing, and portability, object to processing, and withdraw consent. Write to privacy@kernex.md — we respond within one month. Consent to analytics cookies can be withdrawn in one click: "Cookie settings" in the site footer (see section 9). If you believe your rights have been violated, you may lodge a complaint with the National Center for Personal Data Protection of Moldova (CNPDCP, datepersonale.md).
7. Security
Access to data is role-based, connections are encrypted (TLS), passwords are stored as hashes, and regular backups are made. Each organisation's data is isolated at the database level.
8. Miscellaneous
The service is not directed at persons under 18. We make no decisions based solely on automated processing that would have legal effects on you. Providing data in the request form is voluntary, but without a contact we cannot reply. When this policy changes, we will publish the new version on this page with its effective date; material changes will be announced by e-mail.
9. Cookies and settings
kxestate.md uses only two categories of storage technologies. Nothing beyond the necessary ones is loaded before you make a choice in the banner.
- Necessary (always active): the record of your banner choice —
kx_consentin your browser's localStorage (the choice, the policy version, the date); kept for 12 months, after which we ask again. - Analytics (only with consent): Google Analytics 4 (cookies
_ga,_ga_*, up to 2 years) and PostHog (cookies and localStorageph_*, up to 1 year) — anonymised statistics of visits and events on the site. Until you consent, these services' scripts are not loaded and no data is sent to them.
There are no advertising or marketing cookies on this site. You can change or withdraw your choice at any time — withdrawal does not affect the lawfulness of processing before it: