KODYO SRL ("Kodyo", "we") attaches particular importance to the protection of your personal data. This policy explains, transparently, which data we collect when you visit kodyo.ai (the "Site"), talk to our assistant Kody, contact us or use our services, why we collect it and what your rights are.
It is drawn up in accordance with Regulation (EU) 2016/679 (the "GDPR") and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
#1. Data controller
KODYO SRL
Courbevoie 13, 1348 Ottignies-Louvain-la-Neuve, Belgium
Company number: 1028.900.081
Contact for any question about your data: hello@kodyo.studio
Requests relating to personal data are handled directly by the company's management.
#2. Which data we collect, and why
#2.1. Browsing the Site (audience measurement)
We measure the Site's audience with an analytics tool that we host ourselves. It sets no cookies and builds no individual profile: it records aggregated statistics (page views, country, device and browser type, traffic source) from which no visitor can be identified. The IP address is not stored.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — understanding how the Site is used in order to improve it, without intruding on your privacy. This measurement does not require your consent under Belgian electronic communications law, which is why the Site displays no cookie banner.
#2.2. Contact and appointment forms
When you fill in the contact form, request an appointment or leave your details in a conversation with Kody, we collect: first name, last name, e-mail address and, depending on the form, phone number, company name and the content of your message.
This data is stored in our database and notified to us by e-mail, so that we can reply to you and, where relevant, prepare an appointment or a proposal.
Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f)) for the B2B commercial follow-up of the resulting relationship.
#2.3. Conversations with the Kody assistant
Kody is an AI-based conversational assistant: you are talking to an automated system, not to a member of the team. It is presented as such in the interface.
To answer you, the content of your messages (and the history of the current conversation) is transmitted to a language-model provider, established outside the European Union, which processes the messages solely to generate the reply and does not use them to train its models.
We keep a copy of each conversation (the visitor's messages and Kody's replies, with no identifier other than a random conversation number) in order to understand what visitors are looking for and to improve the assistant. We invite you not to share sensitive data with Kody (health, financial data, etc.) — it does not need it to help you.
To limit abuse, the number of replies per day is capped per visitor, based on a pseudonymised version of your IP address, never the address in clear.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — providing the assistant service you request, improving it and protecting it against abuse.
#2.4. Newsletter
If you subscribe to our newsletter via the footer, your e-mail address is transmitted to us by e-mail, together with the consent box you ticked. You can unsubscribe at any time by writing to hello@kodyo.studio or via the link in each mailing.
Legal basis: consent (Art. 6(1)(a) GDPR).
#2.5. Data of clients and their users
When Kodyo designs and operates an assistant or a solution for a client, the data processed by that solution (for example the conversations of visitors to a client's website) is processed on behalf of that client, who is the data controller. Kodyo then acts as a processor under a data processing agreement concluded with the client. This policy does not cover that processing: please refer to the privacy policy of the client concerned.
The contact details of our professional clients and prospects (name, position, professional contact details, history of exchanges) are processed for the management of the commercial and contractual relationship, on the basis of the performance of the contract (Art. 6(1)(b)) and our legitimate interest (Art. 6(1)(f)), then retained in accordance with our legal obligations (Art. 6(1)(c)).
#3. Cookies and local storage
The Site uses no tracking, advertising or analytics cookies. Only mechanisms strictly necessary for its operation are used:
| Mechanism | Purpose | Duration |
|---|---|---|
| Display preference (browser local storage) | Remembering your light / dark choice | Until you delete it |
| Kody conversation number | Linking the messages of one conversation | Duration of the conversation |
These mechanisms do not identify you and are not shared with any third party. No consent is therefore required.
#4. Recipients and processors
Your data is never sold. It is accessible to the members of the Kodyo team who need it in the course of their duties, and to the following categories of providers, which act on our instructions and are bound by contract to confidentiality and security:
| Category of provider | Role |
|---|---|
| Cloud hosting | Hosting of the Site and storage of forms and conversations |
| Language-model providers | Generating the Kody assistant's replies |
| E-mail delivery service | Form notifications and newsletter delivery |
| Web font provider | Loading a font when the Site is displayed (technical transmission of the IP address) |
The detailed list of our processors is available on request at hello@kodyo.studio. We may also disclose your data to the competent authorities where required by law.
#5. Transfers outside the European Union
Some of these providers process data outside the European Economic Area, in particular in the United States. These transfers rely on the safeguards provided for by the GDPR: an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or standard contractual clauses adopted by the European Commission. You can obtain a copy by writing to us.
#6. Retention periods
| Data | Period |
|---|---|
| Contact and appointment forms, details left with Kody | 3 years from submission |
| Conversations with Kody | 6 months from each message |
| Daily assistant counters (hashed IP) | 2 days |
| Audience statistics | Aggregated, non-identifying data — no limit |
| Newsletter e-mail address | Until you unsubscribe |
| Clients' contractual and billing data | Term of the contract + 10 years (accounting and tax obligations) |
At the end of these periods, the data is deleted or anonymised.
#7. Security
We implement appropriate technical and organisational measures to protect your data: encryption of exchanges, restricted access to data and provider accounts, protection against automated submissions. As no system is infallible, we would inform you, and the Data Protection Authority where applicable, of any data breach likely to result in a risk to your rights.
#8. Your rights
Under the GDPR, you have the following rights:
- Access (Art. 15): to know whether we process data about you and to obtain a copy;
- Rectification (Art. 16): to have inaccurate or incomplete data corrected;
- Erasure (Art. 17): to request the deletion of your data, under the conditions provided by law;
- Restriction (Art. 18): to request the suspension of a processing operation in certain cases;
- Portability (Art. 20): to receive your data in a structured, commonly used format;
- Objection (Art. 21): to object at any time to processing based on our legitimate interest, including prospecting;
- Withdrawal of consent (Art. 7(3)): to withdraw consent you have given, without affecting the lawfulness of prior processing.
To exercise these rights, write to hello@kodyo.studio or by post to KODYO SRL, Courbevoie 13, 1348 Ottignies-Louvain-la-Neuve. We reply within one month, extendable by two months for complex requests (we would inform you). We may ask you for proof of identity where necessary to verify that the request comes from you.
If you consider that your rights are not respected, you may lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (APD/GBA)
Rue de la Presse 35, 1000 Brussels
+32 (0)2 274 48 00 — contact@apd-gba.be
www.dataprotectionauthority.be
#9. Minors
The Site and our services are intended for professionals. We do not knowingly collect data about persons under 16.
#10. Changes
We may amend this policy to reflect changes in our services, our providers or the regulations. The version in force is the one published on the Site, with its update date. In the event of a substantial change, we will signal it visibly on the Site.