Legal
Privacy policy
Last updated: November 13, 2026
1. Scope
This Privacy Policy explains how KalphaTech d.o.o. (“KalphaTech”, “we”, “us” or “our”) handles personal data when you visit our website, use Exsolidus®, including Alpha and other modules agreed with you, or our direct project and materials-analysis services, communicate with us, or act as a contact for a customer, supplier or other organization.
It covers inquiries, accounts, service delivery, support, professional communications, contracts, invoicing and related administration.
Personal data are information relating to an identified or identifiable individual. Information about an organization falls within this policy where it also identifies an individual, such as a named employee, representative or sole trader.
2. Who is responsible
KalphaTech d.o.o. is the controller of the personal data we process for the purposes described in this policy, except where we act on a customer's instructions as explained in section 6.
KalphaTech d.o.o.
Zelenjak 50
10000 Zagreb, Croatia
OIB: 73948612072
Company registry number (MBS): 081510084
- Privacy inquiries and rights requests: privacy@kalphatech.com
- Data Protection Officer: dpo@kalphatech.com
- General inquiries: info@kalphatech.com
- Website: www.kalphatech.com (opens in a new tab)
3. Information we collect
Depending on how you interact with us, we process:
| Category | Information |
|---|---|
| Contact and professional details | Name, email address, organization name and address, professional role or affiliation, and a telephone number if provided as a contact point. |
| Account and service information | Account identifiers, authentication information, access permissions, and records associated with your use of Exsolidus and requested services. |
| Contract and billing information | Customer or supplier details, billing address, OIB, VAT number or equivalent tax identifier, company registry number, contracts, orders, invoices, payment references and related transaction records. |
| Correspondence and support | Messages, inquiries, project requirements, support requests and information you provide when communicating with us. |
| Submitted material | Personal data included in uploaded files, filenames, annotations, results or other metadata associated with an analysis request. |
| Technical and security information | IP addresses, access and login times, request and error records, and other technical information needed to operate, troubleshoot and protect our services. |
| Preferences and privacy records | Communication preferences, consent records, objections, privacy requests and the information needed to respond to them. |
We identify information that is necessary for a contract, service or legal obligation when we request it. If you do not provide that information, we may be unable to create an account, provide the requested service, issue the required documents or complete a transaction. Telephone numbers are optional unless a particular service requires a telephone contact and we explain that requirement when collecting the number.
Please include only personal data relevant to your inquiry or service request. Scientific submissions should not contain unnecessary personal information.
4. Where information comes from
We receive personal data directly from you when you contact us, create or use an account, request a service, provide billing details or submit material.
We may also receive professional contact information from:
- Your employer, organization or another person arranging services on its behalf.
- Public professional profiles, including LinkedIn.
- Public business and professional registers.
- Conference and event organizers that provide attendee or participant information, such as names, email addresses and organizational affiliations.
We use these sources only for a relevant professional purpose and collect information proportionate to that purpose. A public profile or inclusion on an attendee list does not, by itself, establish consent to marketing.
When we obtain personal data indirectly, we provide the required privacy information, including the source and categories of data, within a reasonable period and no later than one month after obtaining it. If we contact you or disclose the information sooner, we provide it by that first contact or disclosure, unless a lawful exception applies.
5. Purposes and legal bases
The table explains why we process personal data and the legal basis under the General Data Protection Regulation (GDPR).
| Purpose | Personal data used | Legal basis |
|---|---|---|
| Respond to inquiries, discuss requirements and prepare proposals | Contact details, professional affiliation, correspondence and project requirements | Contract or steps requested before a contract — Article 6(1)(b) where you are the prospective contracting individual. Legitimate interests — Article 6(1)(f) where you represent an organization: responding to inquiries and arranging professional relationships. |
| Create and administer accounts and provide requested services | Account information, contact details and service-administration records | Contract — Article 6(1)(b) where you are the contracting individual. Legitimate interests — Article 6(1)(f) for organizational users: providing the service purchased or requested by their organization and administering authorized access. Personal data processed solely on a customer's instructions are addressed in section 6. |
| Manage contracts, orders, payments and invoicing | Contact, contract, billing and transaction information | Contract — Article 6(1)(b) for individual contracting parties; legitimate interests — Article 6(1)(f) for organizational representatives, to administer the business relationship; legal obligation — Article 6(1)(c) for accounting, tax and fiscalization requirements. |
| Provide support and resolve service problems | Account details, correspondence, relevant submitted material and technical records | Contract — Article 6(1)(b) for individual customers; legitimate interests — Article 6(1)(f) for organizational users, to resolve requests and maintain a functioning service. Customer-controlled material remains subject to section 6. |
| Maintain service security, investigate incidents and protect legal rights | Relevant account, technical, correspondence and transaction records | Legitimate interests — Article 6(1)(f) in preventing unauthorized access, maintaining reliable services and establishing, exercising or defending legal claims. Legal obligation — Article 6(1)(c) where a specific reporting, preservation or disclosure duty applies. |
| Maintain relevant professional contacts and follow up on business discussions or events | Names, professional contact details, affiliations, source details and relevant correspondence | Legitimate interests — Article 6(1)(f) in developing professional relationships relevant to our services, subject to your interests, reasonable expectations and right to object. Any marketing communication must also meet the rules applicable to its communication channel. |
| Send optional newsletters or promotional updates where offered | Contact details, subscription preferences and consent records | Consent — Article 6(1)(a). You can withdraw consent at any time. |
| Handle privacy requests and demonstrate compliance | Contact and identity-verification information, requests, responses, consent and objection records | Legal obligation — Article 6(1)(c) for data-protection duties. Legitimate interests — Article 6(1)(f) for proportionate evidence needed to establish, exercise or defend legal claims. |
Where we rely on legitimate interests, we assess the necessity of the processing and its effect on your rights and interests. Where we rely on consent, we request it separately and explain how to withdraw it.
Service messages, such as responses to your requests, account notices and information about an ongoing service, are separate from optional promotional communications.
6. Personal data in customer submissions and Exsolidus
We use account and business-contact information to administer Exsolidus and direct project services, communicate about analyses, manage contracts and invoices, provide support and protect the services.
Scientific inputs and results may contain personal data, including names, contact details, filenames, annotations and other metadata. This policy applies to that personal data. Rights to scientific inputs and results are governed by the applicable service agreement; those provisions do not replace data-protection requirements.
Authorized personnel may access relevant material to carry out the requested analysis, investigate a specific service or security issue, complete a necessary service audit, provide support or perform a human scientific review requested by the customer. Access is limited to the task and does not authorize unrelated research or reuse.
Where a customer determines the purposes of processing personal data in submitted material and we process it on the customer's behalf, the customer is the controller and KalphaTech d.o.o. acts as its processor. We process that information under documented instructions and an applicable data-processing agreement, including its provisions on access, security, subprocessors and return or deletion.
The customer is responsible for the lawfulness of its collection and instructions and for informing affected individuals. If a privacy request concerns data we process on a customer's behalf, we assist the customer in responding and direct the request to the appropriate contact where necessary.
We do not use customer submissions, results or associated metadata to train, fine-tune, validate, benchmark or improve models for our general use or for other customers. Aggregating, anonymizing or de-identifying customer material does not create permission for those uses. We do not publish customer submissions or results in public databases.
Where a customer separately commissions an instrument-specific Diffract model, we use the agreed material only to develop, validate and deliver that customer's model and, where expressly agreed, maintain it. A separate signed agreement defines the permitted work, model rights and retention. Processing personal data for that work remains subject to an appropriate legal basis, the necessary information to affected individuals and any applicable customer instructions and data-processing agreement. It does not authorize use for other customers or general model improvement.
Deleting source files does not itself reverse completed training. Retained customer-specific model copies are governed by the separate agreement and applicable personal-data rights.
7. Who receives personal data
We do not sell personal data or provide it to third parties for their own independent marketing.
We disclose personal data where necessary for the purposes in section 5 to:
- Hosting and infrastructure providers, for operating, storing, maintaining and securing our website and services.
- Business communication and collaboration providers, including Google Workspace, for email, correspondence and business administration.
- Technical support providers, where access is needed to maintain services or resolve a specific issue.
- Accounting, invoicing and payment service providers, where needed to process transactions and maintain required records.
- Professional advisers, such as accountants and lawyers, where relevant to their work.
- Courts, regulators and other public authorities, where disclosure is legally required or necessary to establish, exercise or defend legal claims.
Access is limited to information needed for the relevant task. Providers processing personal data on our behalf are subject to data-processing terms and confidentiality obligations. Some recipients, such as banks, professional advisers and public authorities, may act as independent controllers for their own legal duties.
8. Hosting and international transfers
Our principal service hosting is in the European Union or European Economic Area (EEA). We configure supported Google Workspace services for European data storage.
Regional storage settings cover specified services and data. They do not necessarily cover every support activity, technical record or other processing operation. Providers and their subprocessors may process or access information outside the EEA, including from the United States.
Where personal data are transferred outside the EEA, we use an applicable European Commission adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses. Where required, we assess the destination's legal protections and apply supplementary measures.
You can contact privacy@kalphatech.com for information about the recipients, countries and transfer arrangements relevant to your data, and for a copy of applicable safeguards. Necessary redactions may be made to protect confidential information without preventing you from understanding those safeguards.
9. How long we keep information
We retain personal data for the purpose for which it is needed and delete it when that purpose ends. For records outside customer scientific content, irreversible anonymization may be used where appropriate. An instruction to delete customer scientific content is not satisfied by retaining an anonymized copy. The following periods and criteria apply:
| Record | Retention period or criterion |
|---|---|
| Inquiries that do not lead to a contract | Up to 24 months after the last substantive interaction. Further unsolicited messages from us do not restart this period. |
| Professional contact details obtained without subsequent substantive engagement | Reviewed after 12 months and deleted unless a specific continuing purpose is documented. Deleted within 24 months of collection if there has been no substantive engagement. |
| Ordinary account and profile information | While the account is active, then deleted within 90 days after closure or completion of a legally required data-retrieval process, whichever is later. This ordinary profile period does not delay a valid erasure request or apply to customer scientific content covered by the specific deletion rule below. Records subject to a separate requirement below are retained separately. |
| Support correspondence | Up to 24 months after resolution. Unnecessary attachments are removed earlier. |
| Routine access and security logs | Up to 90 days after creation. Relevant extracts may be preserved for a specific incident or legal claim. |
| Optional newsletter or promotional subscriptions | Until you unsubscribe or withdraw consent. Inactive subscriptions are reviewed at least every 24 months and removed when no longer needed. |
| Evidence of consent and privacy notices | For the period during which we rely on it and up to three years after the last reliance or withdrawal, whichever is later, unless needed for a specific legal claim. |
| Records of marketing objections | A minimal identifier, the objection date and its scope are retained for as long as needed to prevent further contact through an active marketing channel. Necessity is reviewed at least every three years. |
| Contracts and evidence relevant to legal claims | For the relationship and the applicable limitation period, taking account of when a claim arises. Relevant records may be retained longer for ongoing proceedings or a specific legal preservation requirement. |
| Accounting records | For the applicable statutory period. Records supporting entries in the journal, general ledger and subsidiary books are generally retained for at least 11 years, calculated from the last day of the relevant financial year, subject to the statutory exception for qualifying fiscalized electronic invoices. |
| Qualifying fiscalized electronic invoices | Six years from the end of the year of issue where the statutory eInvoice fiscalization procedure has been completed. This rule does not apply to every invoice sent electronically. |
| Personal data in scientific submissions and results | For the requested analysis and agreed availability of results, followed by the agreed retrieval period. Deletion instructions and the end of that period are handled under the specific deadlines below. Where we act as processor, the customer's lawful instructions and data-processing agreement also apply. |
These periods do not delay action on a valid erasure request or another requirement to delete information sooner. Where a record must be retained for a legal obligation or a specific claim, we limit retention to the relevant information and restrict its use accordingly.
Customer scientific data. For deletion purposes, Customer Service Data includes scientific submissions, project content, results and associated content metadata, including copies in support attachments, working files and processing or training-preparation files. The following rule also covers personal data contained in that material.
After receiving a verified deletion instruction from an authorized customer representative, we delete the specified Customer Service Data from active systems without undue delay and no later than two business days. Business days are Monday to Friday, excluding public holidays in Croatia. We request any proportionate information needed to verify or identify the instruction without undue delay.
Remaining copies held by us or on our behalf are permanently deleted from backups within seven calendar days after active-system deletion. Backup copies are restricted to recovery during that interval. If a backup is restored, deletion is reapplied before the affected data return to operational use; restoration does not restart the seven-day period. We confirm the active-deletion date and backup-erasure deadline. These specific deadlines take precedence over longer ordinary periods for the data they cover. We do not retain an anonymized or aggregated substitute to avoid deleting customer scientific content.
When an agreed data-retrieval period ends, the same two-business-day active-deletion deadline applies, followed by the seven-day backup limit. Applicable statutory switching and customer instructions remain respected. Particular Customer Service Data are retained beyond deletion deadlines only where an applicable legal requirement requires preservation, with access and use restricted to that requirement.
Separate invoices, tax records, contract records, deletion records and minimum evidence for a specific legal claim follow their own applicable retention periods. For those other records, residual backups expire within a further 90 days after deletion from active systems, with restricted recovery use and deletion reapplied after restoration. Any shorter legal or applicable contractual requirement takes precedence. Retaining those administrative records does not authorize continued use of deleted scientific content.
For customer-controlled installations, the customer manages its own copies and backups. The rules above continue to apply to copies held by KalphaTech or its providers, including support copies. Retention and deletion of commissioned customer-specific model artifacts are expressly addressed in the separate signed agreement. Source and training files, including preparation copies, remain subject to the customer-data deletion deadlines. This distinction does not limit applicable personal-data rights.
10. Your rights
Under the GDPR, you have the following rights, subject to the conditions that apply to each:
- Access: obtain confirmation of whether we process your personal data, information about the processing and a copy of the data.
- Rectification: have inaccurate information corrected and incomplete information completed.
- Erasure: have personal data deleted where the legal conditions are met. Some information may need to be retained for a legal obligation or legal claims.
- Restriction: limit processing in circumstances such as a dispute about accuracy or a pending objection.
- Portability: receive personal data you provided in a structured, commonly used, machine-readable format where processing is automated and based on your consent or a contract with you, and have it transferred directly to another controller where technically feasible.
- Objection: object, on grounds relating to your situation, to processing based on legitimate interests. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims.
- Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
- Automated decisions: not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, except where permitted by law. Where applicable, you can request human intervention, express your view and contest the decision.
You may object to direct marketing at any time, including any profiling related to that marketing. We will stop using your personal data for those purposes. You do not need to give a reason.
Send requests to privacy@kalphatech.com or dpo@kalphatech.com. You may also write to our postal address in section 2. To unsubscribe or withdraw consent, use the control provided with the communication or service, or contact either address. Withdrawal will be as easy as giving consent.
We respond without undue delay and within one month of receiving your request. If an extension is necessary because of the complexity or number of requests, we may extend this by up to two further months and will explain the reasons within the first month.
If we have reasonable doubts about your identity, we may request proportionate additional information to verify it. Requests are normally free of charge. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it as permitted by law, and explain our decision.
You may complain to the Croatian Personal Data Protection Agency (AZOP) at azop.hr (opens in a new tab), or to another competent supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. You do not have to contact us before doing so. You also have the right to seek a judicial remedy.
11. Cookies and similar technologies
We do not use cookies for advertising or tracking you across other websites.
Any cookies or similar device-storage technologies used to provide a function you request are limited to what is necessary for that function, such as authentication or service security. We provide information about such technologies with the relevant service.
Before introducing optional analytics or other technologies requiring consent, we will explain their purposes, providers and duration, update the relevant information and obtain consent before activation. You will be able to refuse them and withdraw consent through an accessible settings control. Continuing to browse or use the service does not constitute consent.
Personal data may still be processed without cookies, including account information, correspondence and technical records described in this policy.
12. Security
We apply technical and organizational measures appropriate to the personal data, the processing and the risks to individuals. These measures are designed to protect against accidental or unlawful loss, alteration, disclosure and access.
Access is limited to authorized people and service providers who need the information for their work. We review protections as our services and the associated risks change.
If a personal-data breach occurs, we assess it and notify the competent authority and affected individuals where required by law.
To report suspected unauthorized access or another incident involving personal data, contact privacy@kalphatech.com or dpo@kalphatech.com.
13. Changes to this policy
We update this policy when our processing practices or applicable requirements change. The date at the top identifies the latest version.
We will draw attention to material changes through a prominent service notice or direct communication, as appropriate. Before using personal data for a new purpose, we will provide the required information and obtain consent where that is the applicable legal basis.
This policy explains our processing practices. Your continued use of the website or Exsolidus does not constitute consent to processing that requires your consent.
14. Contact
For questions about this policy or the handling of your personal data:
KalphaTech d.o.o.
Zelenjak 50
10000 Zagreb, Croatia
Privacy: privacy@kalphatech.com
Data Protection Officer: dpo@kalphatech.com