Privacy policy
How Akili handles personal data about the people we deal with directly: platform users, website visitors and business contacts.
1. Introduction
1.1 This Policy explains how 12Kobo OÜ, trading as Akili (“Akili”, “we”, “us” or “our”), a private limited company registered in Estonia under registry code 17631609, whose registered office is at Tornimäe tn 5, 10145 Tallinn, Estonia, processes Personal Data in the circumstances described in section 3.
1.2 Our correspondence address is Tornimäe tn 5, 10145 Tallinn, Estonia. You can also contact us at privacy@yourakili.com.
1.3 We have appointed Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom, as our representative in the United Kingdom for the purposes of Article 27 UK GDPR. If you are in the United Kingdom, you may contact our representative about any matter relating to our processing of your Personal Data.
1.4 Akili acts as Controller in respect of the processing described in this Policy, except as described in section 14, where we act as Processor on behalf of a Client.
2. Definitions
2.1 In this Policy:
"Client" means an organisation which subscribes to the Platform;
"Platform" means the Akili brand intelligence and reputation analytics platform;
"User" means an individual authorised to access the Platform under a Client subscription;
and "Personal Data", "Controller", "Processor", "processing" and "Data Subject" bear the meanings given to them in Regulation (EU) 2016/679 (the “GDPR”) and, where applicable, the UK GDPR.
3. Scope
3.1 This Policy applies to Akili's processing of Personal Data relating to:
(a) Users;
(b) visitors to our website;
(c) individuals who contact us, request a demonstration of the Platform, or correspond with us in a business capacity.
3.2 This Policy does not apply to:
(a) Personal Data contained in publicly available reviews, ratings and mentions ingested by the Platform, which is addressed in the Reviewer Privacy Policy. Questions or requests about that data may be sent to privacy@yourakili.com;
(b) Personal Data which a Client supplies to Akili, collects through the Platform, or makes available by connecting an account to the Platform, including support ticket exports and responses to surveys operated by a Client. Akili acts as Processor in respect of that data, the Client is the Controller, and the Client’s own privacy notice applies. Section 14 provides further information about connected Google Business Profile accounts.
4. Personal Data we process
4.1 User account data: name, business email address, job role, authentication credentials, basic profile information received from a third-party sign-in provider where you choose to sign in that way, and records of access to and activity within the Platform. Where a Client invites you to the Platform, we receive your name and business email address from that Client.
4.2 Enquiry and correspondence data: name, business contact details, organisation, the content of correspondence, and details of demonstration requests.
4.3 Technical data: IP address, device and browser characteristics, pages viewed, referring URL and timestamps. Our use of cookies and similar technologies is described in the Cookie Policy.
5. Purposes and lawful bases
5.1 We process Personal Data for the following purposes and on the following lawful bases:
| Purpose | Personal Data | Lawful basis |
|---|---|---|
| Providing and administering access to the Platform | User account data | Legitimate interests in providing the Platform to the Client which has authorised the User, and in administering that access |
| Authenticating Users and maintaining the security of the Platform | User account data; technical data | Legitimate interests in securing the Platform and preventing unauthorised access |
| Responding to enquiries and demonstration requests | Enquiry and correspondence data | Legitimate interests in responding to those who contact us |
| Understanding how our website is used, so that we can improve it | Technical data collected through analytics cookies | Consent, given through our cookie banner |
| Maintaining, testing and improving the Platform | Technical data | Legitimate interests in the operation and improvement of our services |
| Complying with legal and regulatory obligations | As applicable | Compliance with a legal obligation |
5.2 Where we rely on legitimate interests, you have the right to object to the processing. Section 11 explains how. Where we rely on consent, you may withdraw it at any time through the cookie settings on our website; withdrawal does not affect processing carried out before you withdrew it.
5.3 We do not currently send marketing communications. If we begin to do so, we will update this Policy and obtain any consent required before sending them.
6. Artificial intelligence
6.1 The analytical outputs of the Platform are generated from the material described in the Reviewer Privacy Policy, from data supplied by Clients, and from accounts which Clients connect to the Platform, and not from Personal Data processed under this Policy.
6.2 We do not use Personal Data processed under this Policy to train or fine-tune any artificial intelligence model, and we do not permit our AI service providers to do so. Clients may find further information about how the Platform uses artificial intelligence in our AI Addendum.
6.3 We do not subject Users or website visitors to decisions based solely on automated processing which produce legal effects concerning them or similarly significantly affect them.
7. Disclosure and sub-processors
7.1 We disclose Personal Data to:
(a) service providers who process Personal Data on our behalf, including providers of hosting, infrastructure, authentication, communications and analytics;
(b) our professional advisers, under a duty of confidentiality;
(c) regulators, law enforcement or other authorities where we are required to do so by law;
(d) a purchaser or prospective purchaser in connection with a corporate transaction, subject to appropriate confidentiality obligations.
7.2 The service providers referred to at clause 7.1(a) are listed in our Sub-processor Register, published at yourakili.com/legal/subprocessors.
7.3 We do not sell Personal Data.
8. International transfers
8.1 The Platform is hosted in the United Kingdom, which benefits from an adequacy decision of the European Commission.
8.2 Some of our service providers may process Personal Data elsewhere, including in the United States. Where they do, we rely on an adequacy decision (including, for certified recipients, the EU–U.S. Data Privacy Framework) or the European Commission’s Standard Contractual Clauses, and for UK Personal Data on the UK Extension to the Data Privacy Framework, the International Data Transfer Agreement or the UK Addendum.
9. Retention
9.1 We retain Personal Data for no longer than is necessary for the purposes for which it is processed.
9.2 In particular:
(a) User account data is retained while the User’s account remains active. When a Client’s subscription ends, access to the Platform is revoked, and we retain basic account details (name, business email address and job role) for up to 12 months so that the account can be reactivated if the Client renews. After that period the account data is deleted. Records of access to and activity within the Platform are deleted at the same time. You may ask us to delete your account data at any time, and a Client may ask us to delete the accounts of all of its Users when its subscription ends.
(b) Enquiry and correspondence data is retained for up to 24 months from our last contact with you, after which it is deleted unless we have an ongoing business relationship with you or your organisation. Where correspondence forms part of a contract with a Client, it is retained for as long as that contract is in force and for up to six years afterwards, to establish, exercise or defend legal claims. You may ask us to delete enquiry data at any time.
(c) Technical data and logs used for security, audit and troubleshooting purposes are retained for up to 12 months and then deleted, unless they are needed for longer to investigate a specific security incident.
(d) Website analytics data is retained in our analytics tool for up to 24 months and then deleted automatically.
10. Security
10.1 We implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
10.2 These measures include encryption of data in transit and at rest, role-based access controls, separation of each Client's data from that of other Clients, restriction of access to authorised personnel, monitoring and logging, and regular backups.
11. Your rights
11.1 You have the right to request access to the Personal Data we hold about you; to request its rectification or erasure; to request restriction of processing; to object to processing carried out on the basis of legitimate interests; and, where applicable, to request portability.
11.2 Requests should be sent to privacy@yourakili.com. We may ask you to verify your identity before responding. If you are in the United Kingdom, you may also submit requests through our UK representative (see clause 1.3).
11.3 We will respond within one month of receipt, which may be extended by up to two further months where a request is complex. We will tell you if an extension applies and why.
12. Complaints
12.1 Complaints about our handling of Personal Data may be made to privacy@yourakili.com and will be handled in accordance with our Data Protection Complaints Procedure.
12.2 You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data protection authority in the EU country where you live or work. If you are in the United Kingdom, you may complain to the Information Commissioner (ico.org.uk). You may also seek a judicial remedy. None of these rights depends on first complaining to us.
13. Cookies
13.1 Our use of cookies and similar technologies is described in the Cookie Policy.
14. Connected Google Business Profile accounts
14.1 A Client may connect its Google Business Profile account to the Platform. The connection is made by an authorised User through Google's own sign-in and consent screen. It may be withdrawn at any time, in the Platform or in the settings of the Google account, after which we no longer access the account.
14.2 Where an account is connected, we:
(a) read the business locations listed in the account;
(b) read the reviews published about those locations, including the rating, text, date and the reviewer's display name; and
(c) post replies to those reviews, where a User chooses to send one.
14.3 When a Client connects its Google Business Profile account, we process the data described in clause 14.2 as Processor on behalf of that Client, under our Data Processing Agreement with the Client. The Client is the Controller of that data and its own privacy notice applies to it.
14.4 We use information obtained through a connected account only to provide the Platform to the Client which connected it: to show and analyse its reviews, to match them to its locations, to publish the replies it sends, and to personalise features of the Platform for that Client. We do not use that information for advertising, we do not sell it, we do not use it to develop, improve or train generalised artificial intelligence or machine learning models, and we do not combine it with data used for any other Client. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
14.5 When a connection is withdrawn or the Client’s subscription ends, we stop accessing the connected account and delete the information obtained through it from our live systems without undue delay, in accordance with our Data Processing Agreement with the Client.
15. Changes to this Policy
15.1 We may amend this Policy. The version and review date are stated at the head of this document.