Privacy Policy

1. Who we are and what this policy covers

Origins Technology Limited, trading as Kaiterra ("Kaiterra", "we", "us", "our"), is a company incorporated in Hong Kong. Our registered address is Flat/Room 603, 6/F, Laws Commercial Plaza, 788 Cheung Sha Wan Road, Cheung Sha Wan, Kowloon, Hong Kong SAR. We make indoor air quality monitors and operate the Kaiterra Data Platform, the Kaiterra API and the Kaiterra mobile applications (together, the "Platform").

This policy explains what personal data we collect, how we use and share it, where we store it, how long we keep it, and the rights you have over it. It covers two different kinds of processing, and the difference matters for your rights.

When Kaiterra is the controller. This policy applies in full to personal data we collect through www.kaiterra.com and other websites that link to it, through our marketing and events, through job applications, and through the accounts we create for users of the Platform. For this data, Kaiterra decides why and how it is processed, and you can exercise the rights in this policy directly with us.

When Kaiterra is the processor. Environmental measurements, device and building metadata and platform usage data collected through Kaiterra devices and the Platform are processed on behalf of the customer that operates the account — usually your employer or your building operator. For that data, the customer is the controller and its own privacy notice governs. Kaiterra processes it under the Kaiterra Data Processing Agreement, available at www.kaiterra.com/legal/data-processing-agreement. If you are an occupant of a customer's building or a user of a customer's account and you wish to exercise your rights over that data, contact that organisation. If you contact us instead, we will pass your request on and tell you that we have.

Environmental measurements — temperature, humidity, CO₂, particulate matter and similar readings — do not, in themselves, identify any person. They become personal data only where a customer chooses to associate them with information about individuals, such as occupant or visitor metadata.

If you do not agree with this policy, please do not use our website or services. Where our processing is based on your consent, you can withdraw it at any time as described in Section 11.

2. Information we collect

2.1 Information you give us

Website, marketing and events. When you complete a web form, request a demonstration, subscribe to our newsletter or system updates, register for or watch a webinar, download resources, respond to an advertisement, apply to become a Kaiterra partner, or contact us, we may collect your name, job title, employer, work email address, phone number, business address, country, industry, company size, number of buildings or sites, the Kaiterra products and capabilities you are interested in, and the content of your message. If you apply to become a partner, we may also collect information about your business, including years in operation, annual sales, services offered, service regions, key customers and how you anticipate working with Kaiterra.

Platform accounts. When a customer creates a Platform account for you, or you register for one, we process your name, work email address, job title, organisation, role and permissions, authentication credentials, notification preferences, and authentication and access logs. We process this account data as an independent controller for the purposes of account administration, security, fraud prevention, billing, support and service communications, as described in Section 2.2 of the Kaiterra Data Processing Agreement.

Support. When you contact support, we collect the content of your request and any information you provide to help us resolve it.

Careers. When you apply for a role with Kaiterra, we collect your CV or résumé, name, email address, phone number, current employer, LinkedIn and other professional profile URLs, portfolio, cover letter and your answers to role-specific questions. Where you choose to provide it and where it is lawful in the relevant jurisdiction, we may also collect diversity information such as gender, race or ethnicity, and veteran status. Recruitment data is processed only for recruitment and, where applicable, equal-opportunity reporting. It is not used for any other purpose and is not combined with data from the Platform.

2.2 Information we collect automatically

We use first- and third-party cookies, web beacons and similar technologies to collect information as you navigate our website and use the Platform. This includes your IP address, browser type, version, language and time zone, browser plug-in types, operating system and device type, the pages you visit and actions you take, the page or search terms that led you to us, and the dates and times of your visits.

We may associate this information with you. We may also use these technologies to collect information about your online activities over time and across third-party websites, including to display Kaiterra advertisements to you elsewhere on the internet and to measure which advertisements you see and click. Your choices about cookies and advertising are set out in Section 6.

2.3 Information from other sources

We may supplement the information we hold with information from public and third-party sources, such as professional networking sites and business information providers — for example, information about the company you work for.

2.4 Social media

We maintain pages on LinkedIn, X (Twitter), YouTube and Facebook and may collect information when you interact with them. Our website may also include buttons, tools or embedded content from other companies. When you view or interact with these, some information from your browser may be sent automatically to that company, whose privacy policy governs its use.

2.5 If you choose not to provide information

You can choose not to provide personal data to us. If you do not, we may be unable to provide the services or information you have requested.

3. How we use information

We use personal data to:

• provide the products, services and information you or your organisation have requested, including operating and securing Platform accounts;
• operate, maintain, secure and improve our website and the Platform, and understand how they are used;
• respond to enquiries and provide customer support;
• send service communications, including notices about changes to our services, terms or policies;
• send marketing communications about Kaiterra, our products, new releases, events and offers, where permitted;
• personalise our website, communications and advertising to your interests, and measure the effectiveness of our marketing;
• conduct market research about current and prospective customers;
• process and evaluate job applications;
• perform our contracts and enforce our rights, including our Terms of Service and Terms of Purchase;
• detect, prevent and respond to fraud, abuse and security incidents;
• comply with legal obligations and respond to lawful requests; and
• for any other purpose we describe to you at the point of collection, or with your consent.

We may combine information we collect from you with information from other sources for these purposes.

We do not use personal data to make automated decisions that produce legal or similarly significant effects concerning you.

4. Legal bases for processing (EEA, UK and Switzerland)

Where the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies, we rely on the following legal bases:

• Performance of a contract, or steps at your request before entering into one — to provide Platform accounts, support and services you have requested.
• Legitimate interests, where these are not overridden by your interests or fundamental rights — to operate, secure and improve our services; to market our products to business contacts; to conduct research and analytics; to prevent fraud; and to establish, exercise or defend legal claims.
• Consent — for marketing communications where the law requires consent, for non-essential cookies and similar technologies, and for optional information such as diversity data in recruitment. You can withdraw consent at any time without affecting processing that has already taken place.
• Legal obligation — where we must process personal data to comply with applicable law.

5. How we share information

We do not sell personal data.

We share personal data in the following circumstances:

Service providers and subprocessors. We work with companies that provide services to us or on our behalf, including cloud hosting, customer relationship management and marketing automation, product analytics, advertising networks, video hosting (including Wistia and YouTube), webinar platforms, recruiting software, single sign-on providers, communications tools and technology providers. These companies process personal data only on our instructions and under contractual confidentiality and data protection obligations. A current list of the subprocessors that process Platform data, with their processing locations, is published at www.kaiterra.com/legal/subprocessors.

Affiliates. We may share personal data with our subsidiaries and affiliates for the purposes described in this policy.

Legal requirements and protection of rights. We may disclose personal data when we are required or reasonably believe we are required to do so by law, subpoena, court order or other legal process; to meet lawful requests by public authorities, including national security or law enforcement requirements; or where we believe in good faith that disclosure is necessary to prevent or respond to fraud, to defend our services against attack, or to protect the rights, property or safety of Kaiterra, our customers, our users or others.

Business transfers. If Kaiterra is involved in a merger, acquisition, financing, reorganisation, dissolution or sale or transfer of some or all of its assets, personal data may be transferred as part of that transaction, subject to this policy.

With your consent, or as otherwise described to you at the point of collection.

Aggregated and de-identified information. We may share information that does not identify any individual, such as aggregated statistics about use of our website or the Platform, without restriction. Aggregated or de-identified data derived from Platform data is governed by Section 4.3 of the Kaiterra Terms of Service.

6. Cookies and advertising choices

Our website uses the following categories of cookies and similar technologies:

Required cookies are necessary for the basic functions of the website, including security and page navigation. They cannot be switched off.

Functionality and analytics cookies allow us to remember your preferences, understand how the website is used and improve its performance.

Advertising cookies are set by us and by third-party advertising partners to show you Kaiterra advertisements that are more relevant to you, to limit how often you see an advertisement, and to measure advertising performance. These cookies may collect information about your online activity over time and across websites.

You can accept or decline non-essential cookies through the cookie banner shown when you first visit our website, and change your choice at any time by reopening the cookie preferences from the website footer or through your browser settings; see aboutcookies.org for guidance. To opt out of interest-based advertising from participating networks, visit the Network Advertising Initiative and Digital Advertising Alliance opt-out pages, or, in the EU, Your Online Choices. We treat a Global Privacy Control (GPC) browser signal as a valid request to opt out of targeted advertising and of the "sharing" of personal information as described in Section 11.2.

We do not control third parties' tracking technologies. If you have questions about an advertisement or other targeted content, contact the responsible provider directly.

7. Where your information is stored and transferred

Platform data. Personal data processed through the Platform is hosted on Amazon Web Services infrastructure in Frankfurt, Germany (eu-central-1). This data is stored within the European Economic Area and is not replicated to any other region. Kaiterra personnel located outside the EEA may access this data on a least-privilege basis in order to provide support and operate the service; those accesses are logged and are covered by the transfer mechanisms described below. Where you use AI features of the Platform (Section 10), the relevant queries and data are transmitted to the AI providers named on our subprocessor page, which may be located in the United States, solely to generate the requested output.

Website and marketing data. Information you provide through www.kaiterra.com, including enquiry forms, event registrations, job applications and marketing communications, is processed using service providers located in the United States, including HubSpot, Inc. A current list of subprocessors, with their processing locations, is maintained at www.kaiterra.com/legal/subprocessors.

Kaiterra personnel. Kaiterra has personnel in several countries. Personal data we hold as controller, such as website enquiries and account data, may be accessed by our personnel from those locations for the purposes described in this policy.

Transfer mechanisms. The United States and Hong Kong have not received adequacy decisions under Article 45 of the GDPR. Where we transfer personal data from the EEA, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss adaptations where applicable, and on the supplementary technical and organisational measures described in Schedule 2 of the Kaiterra Data Processing Agreement. Some of our US service providers are also certified under the EU-US Data Privacy Framework and its UK and Swiss extensions. A copy of the relevant clauses is available on request from privacy@kaiterra.com.

8. How long we keep your information

We keep personal data only for as long as necessary for the purposes described in this policy, and then delete or anonymise it. For data we hold as controller, that means: account and user data for as long as you or your organisation have an active account, and deleted on request or when the customer's agreement ends; marketing and enquiry data for as long as you remain subscribed or we have an active relationship with you or your organisation, after which we keep only what is needed to honour your unsubscribe choice; recruitment data for a limited period after the recruitment process concludes, unless you agree to be considered for future roles; and contract, billing and correspondence records for the period required by tax, accounting and limitation laws. Retention and deletion of data we process on behalf of customers, including backups, is governed by the Kaiterra Data Processing Agreement.

Where a longer period is required by law, or to establish, exercise or defend legal claims, we retain the data for that period and no longer.

9. How we protect your information

Personal data is encrypted at rest and in transit using industry-standard protocols. Access to systems holding personal data requires individual authentication with multi-factor authentication, is granted on a least-privilege basis, and is reviewed regularly. Customer data is not stored on employee devices or removable media. We conduct regular vulnerability scanning and independent penetration testing, and we maintain a documented incident response plan. Our full technical and organisational measures are set out in Schedule 2 of the Kaiterra Data Processing Agreement.

The security of your information also depends on you. Where you have a password for any part of our services, keep it confidential and do not share it with anyone.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach affecting your personal data, we will notify you and the relevant supervisory authority where and as required by law.

10. AI features and automated processing

Some features of the Platform use artificial intelligence, including large language models operated by third-party providers listed on our subprocessor page. Where a feature uses AI, it is identified as such at the point of use. Your queries and the relevant environmental and building data are transmitted to the provider solely to generate the requested output. Our agreements with these providers prohibit the use of customer data to train or improve their foundational models.

Kaiterra AI features operate on environmental and building metadata. We do not use them to identify, track or profile named building occupants, to make automated decisions about individuals, or for biometric identification, emotion recognition or inference of health conditions. Customers that do not wish their data to be processed by AI features can contact us at privacy@kaiterra.com to have them disabled for their organisation.

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you within the meaning of Article 22 of the GDPR.

11. Your rights

The rights available to you depend on where you live. This section describes them and how to exercise them. If your request concerns data we process on behalf of a customer (Section 1), we will pass it to that customer and let you know.

11.1 If you are in the EEA, the United Kingdom or Switzerland

You have the right to:

• access the personal data we hold about you and receive certain information about how we process it;
• rectification of inaccurate or incomplete personal data;
• erasure of your personal data in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected;
• restriction of processing in certain circumstances, for example while we verify the accuracy of data you have contested;
• portability — to receive the personal data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible;
• object to processing based on our legitimate interests, on grounds relating to your particular situation, and to object at any time to processing for direct marketing;
• withdraw consent at any time where processing is based on consent, without affecting processing that has already taken place; and
• lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement; in the UK, with the Information Commissioner's Office; and in Switzerland, with the Federal Data Protection and Information Commissioner. A list of EU supervisory authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en. We would appreciate the chance to address your concern first.

To exercise these rights, email privacy@kaiterra.com. We may need to verify your identity before acting on your request. We acknowledge requests within 10 business days and respond within one month, extending by up to two further months for complex or numerous requests and telling you within the first month if we need to. Exercising these rights is free of charge unless a request is manifestly unfounded or excessive.

In some cases our ability to act on a request may be limited by our obligations to process personal data for security, fraud prevention or legal compliance, or because the processing is necessary to deliver services you or your organisation have requested. Where this is the case we will tell you in our response.

11.2 If you are in the United States

This section applies to residents of California, Colorado, Connecticut, Virginia, and other US states with comprehensive privacy laws, and supplements the rest of this policy.

Categories of personal information. In the preceding twelve months we have collected the following categories of personal information, as described in Section 2: identifiers (such as name, email address, phone number and IP address); professional and employment-related information (such as employer and job title); commercial information (such as products and services you have expressed interest in); internet and electronic network activity (such as browsing and interaction data); coarse geolocation inferred from IP address; and inferences drawn from the above for marketing purposes. In recruitment, and only where you choose to provide it, we may collect demographic information that is treated as sensitive personal information. We collect this information from the sources, for the purposes and with the recipients described in Sections 2, 3 and 5.

Sale and sharing. We do not sell personal information, and we have not sold personal information in the preceding twelve months. We use third-party advertising cookies on our website, which may be considered "sharing" of personal information for cross-context behavioural advertising under California law. You can opt out of this at any time by declining advertising cookies in the cookie banner or by reopening the cookie preferences from the website footer, and we honour Global Privacy Control signals as a valid opt-out request. We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under applicable law.

Your rights. Subject to verification, you have the right to know what personal information we have collected about you, including the categories of sources, purposes and recipients; to obtain a copy of it in a portable form; to have it corrected; to have it deleted; and to opt out of the sale or sharing of personal information and of targeted advertising. Where your state law provides for it, you may appeal a decision we make on your request by replying to our response. We will not discriminate against you for exercising any of these rights.

How to exercise them. Email privacy@kaiterra.com. We will confirm receipt within 10 business days and respond within 45 days, extending by a further 45 days where permitted and telling you if we do. An authorised agent may submit a request on your behalf with your written authorisation; we may ask you to verify your identity directly.

Service provider role. Kaiterra acts as a service provider or processor in respect of personal information processed on behalf of its business customers through the Platform. Requests relating to that data should be directed to the customer that controls it.

11.3 If you are in Hong Kong

Under the Personal Data (Privacy) Ordinance you have the right to request access to, and correction of, the personal data we hold about you. We will not use your personal data for direct marketing without your consent, and you may ask us to stop at any time, free of charge, by emailing privacy@kaiterra.com.

11.4 Everywhere else

If you are located elsewhere, we will honour the rights of access, correction, deletion and objection to marketing described above to the extent they are available to you under applicable law. Email privacy@kaiterra.com.

12. Marketing communications

You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing email we send, or by emailing privacy@kaiterra.com with "Unsubscribe" in the subject line. We will continue to send you service communications that are necessary for the operation of your account or services you have requested.

13. Children's privacy

Our website and services are intended for a general and professional audience and are not directed to children. We do not knowingly collect personal information from children under 16 in the European Economic Area and the United Kingdom, or under 13 elsewhere, without verifiable parental consent. The Platform is a business service and is not intended for use by children. If you believe a child has provided us with personal information, email privacy@kaiterra.com and we will delete it.

14. Third-party websites and services

Our website and communications may contain links to websites, applications and services operated by others. This policy does not apply to them, and we are not responsible for their privacy practices. We encourage you to read the privacy policy of any third-party service you use.

15. Changes to this policy

We may update this policy from time to time. The date of the latest revision appears at the top of this page. Where a change materially affects how we process your personal data, we will give at least 30 days' notice before it takes effect, by posting a notice on our website and, where we hold an email address for you as a Platform user, by email. We encourage you to review this policy periodically.

16. Contact us

Origins Technology Limited (trading as Kaiterra), Flat/Room 603, 6/F, Laws Commercial Plaza, 788 Cheung Sha Wan Road, Cheung Sha Wan, Kowloon, Hong Kong SAR, is the controller of the personal data described in this policy.

We have designated a Data Protection Officer. To exercise your rights, or for any question about this policy or how we handle personal data, email privacy@kaiterra.com or write to the Data Protection Officer at the address above.