This Privacy Policy describes how KNDY GmbH ("KNDY", "we", "us", "our") collects, uses, processes, retains, and protects personal data in connection with the bespoke joinery and design services provided through the website at kndyinteriors.com, the private project portal accessed by clients of the studio, and our social media and advertising channels.
We are committed to handling personal data lawfully, fairly, and transparently. This policy applies to all individuals whose personal data we process, including prospective clients, engaged clients, trade partners, visitors to our website, and people who contact us through social media.
1. Who we are
Data controller: KNDY GmbH, registered in Switzerland (UID CHE-471.279.639).
Registered address: c/o Sarya AG, Chamerstrasse 174, 6300 Zug, Switzerland.
Contact for privacy matters: studio@kndyinteriors.com.
KNDY does not have a Data Protection Officer (DPO). Privacy enquiries are handled directly by the studio principal at the address above.
2. Personal data we collect
The categories of personal data we process depend on the nature of your interaction with us. We may collect:
- Contact details: name, email address, telephone number.
- Project information: project location, property type, project type (kitchen, wardrobes, wine cellar, full-home joinery), style preferences, drawings or sketches you upload, materials and finishes preferences, hardware preferences, indicative budget, timeline, and any other details you choose to share.
- Communications: messages you send to us through the project portal, email, or via our website chat assistant ("Alfred"), including any conversation history retained in your portal for the duration of the project.
- Social media and advertising data: if you contact us through Instagram or Facebook (for example by tapping "Send message" on one of our advertisements), we receive your public profile name and username, the content of your messages, and the answers you give in our automated chat (such as the type of project, the town or city of the home, and your email address if you choose to provide it). We also receive aggregated, non-identifying statistics from Meta about how our advertisements perform.
- Files: images, drawings, PDFs, and other documents you upload to your private project portal.
- Booking and scheduling data: calendar availability, meeting confirmations, call recordings (only when explicitly arranged in advance).
- Financial information: details required to issue and reconcile quotes, proforma invoices, and final invoices. We do not collect or store payment card numbers; bank transfers are settled via your bank.
- Technical data: IP address, device type, browser, pages visited, approximate location (city level), referring URL. Collected via Google Analytics 4 with anonymisation enabled.
3. Why we collect your data
We process personal data for the following purposes:
- To deliver the bespoke joinery service you have engaged us for, including responding to enquiries, preparing quotes, designing and producing the agreed work, scheduling delivery and installation, and providing aftercare.
- To communicate with you about your project, including transactional emails (welcome, quote ready, proforma, invoice, install scheduled, aftercare), in-portal messaging, direct correspondence, and replies to messages you send us on Instagram or Facebook.
- To advertise our services on Meta platforms (Instagram and Facebook) to people in the regions we serve, to measure how those advertisements perform, and — where permitted — to show follow-up advertisements to people who have engaged with our profile, advertisements or messages. You can object to this at any time (see Section 8).
- To meet our legal and regulatory obligations, including Swiss commercial accounting and tax law (which requires retention of business records for ten years).
- To improve our service, on the basis of our legitimate interest in operating and developing the studio. Analytics is anonymised; no individual is profiled.
- To prevent abuse of our website (rate limiting, fraud prevention, security logging), on the basis of our legitimate interest in protecting our systems and clients.
4. Legal basis for processing
We rely on the following legal bases under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR):
- Performance of a contract (Art. 6(1)(b) GDPR): processing necessary to deliver the services you have engaged us for, including responding to your enquiry before a contract is concluded.
- Consent (Art. 6(1)(a) GDPR): where you have explicitly opted in, for example by submitting a project brief through our website, by uploading files, by providing your details in our Instagram automated chat, or by accepting cookies for analytics. Consent can be withdrawn at any time.
- Legitimate interest (Art. 6(1)(f) GDPR): for analytics, anti-abuse measures, advertising our services and measuring advertising performance, and limited internal record-keeping. We balance these interests against your fundamental rights and freedoms.
- Legal obligation (Art. 6(1)(c) GDPR): for retention of accounting and tax records as required by Swiss law.
5. Third-party processors
We rely on the following third-party service providers to operate KNDY. Each is bound by appropriate contractual safeguards (data processing agreements, standard contractual clauses where applicable) and processes personal data only on our instructions and for the purposes described in this policy.
| Provider | Purpose | Location |
|---|
| Supabase |
Database storage for briefs, messages, files, financial documents. |
Frankfurt, Germany (EU). |
| Vercel |
Website and application hosting, content delivery network. |
United States. GDPR-compliant (standard contractual clauses). |
| Resend |
Transactional email delivery (welcome, quote, invoice, scheduling). |
United States. GDPR-compliant. |
| Cal.com |
Booking and meeting scheduling. |
European Union and United States. GDPR-compliant. |
| Google Analytics 4 |
Anonymous usage analytics (no marketing or remarketing tracking). |
United States. IP anonymisation enabled. Standard contractual clauses. |
| Google Ads |
Advertising and conversion measurement. |
United States. Standard contractual clauses. |
| Meta Platforms (Instagram, Facebook, Meta Ads, Meta Business Suite) |
Advertising, advertising measurement, audience building (including audiences based on engagement with our profile, advertisements or messages), and delivery of Instagram/Facebook direct messages and automated chat. Meta Platforms Ireland Ltd acts as an independent or joint controller for parts of this processing; see Meta's Privacy Policy at facebook.com/privacy/policy. |
Ireland (EU) and United States. Standard contractual clauses / EU–US Data Privacy Framework. |
| Anthropic Claude |
AI-assisted conversation through our website chat assistant ("Alfred"). Conversations may be processed by Anthropic's API. |
United States. Standard contractual clauses. Anthropic does not train models on API data. |
| Infomaniak |
Email hosting for our studio@kndyinteriors.com inbox. |
Switzerland. |
6. Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or to comply with legal obligations.
- Active project data: retained for the duration of the project and the warranty period (typically the lifetime of installed Blum hardware for the original purchaser, or as otherwise specified in your contract).
- Financial records (quotes, proforma invoices, invoices, payment records): retained for ten years from the end of the financial year in which the project completed, in accordance with the Swiss Code of Obligations.
- Marketing analytics: retained for fourteen months in Google Analytics 4 (default retention).
- Enquiries and lead data from social media and advertising: if your enquiry does not lead to a project, your messages and any details you gave in our automated chat are deleted from our own systems within twelve months of the last contact. Message history in Instagram/Facebook itself is subject to Meta's retention rules and your own account settings. Advertising audiences on Meta are refreshed automatically and include only people who engaged within the preceding 365 days at most.
- Communications and brief content: retained while the project is active and for a reasonable period thereafter for warranty and aftercare. You may request earlier deletion at any time (see Section 8).
- After deletion: personal identifiers are wiped from our systems. Anonymised financial records are retained for the legal retention period above.
7. International data transfers
Some of our processors are based outside Switzerland and the European Economic Area, primarily in the United States. Where personal data is transferred outside the EU/EEA or Switzerland, we rely on:
- Standard Contractual Clauses approved by the European Commission, as supplemented by the Swiss FDPIC where applicable.
- Adequacy decisions where they exist.
- Provider participation in recognised certification frameworks where applicable.
You may request a copy of the safeguards in place for any specific transfer by contacting us at the address in Section 1.
8. Your rights
Under Swiss FADP and (where applicable) GDPR, you have the following rights regarding your personal data:
- Right of access: obtain a copy of the personal data we hold about you.
- Right of rectification: have inaccurate data corrected.
- Right of erasure ("right to be forgotten"): request deletion of your personal data, subject to retention obligations described in Section 6.
- Right of restriction: ask us to restrict processing in certain circumstances.
- Right of data portability: receive your data in a structured, commonly used, machine-readable format.
- Right to object: object to processing based on legitimate interest, including direct marketing and advertising audiences. To stop receiving our messages on Instagram or Facebook, you can also block or mute our profile at any time.
- Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
- Right to lodge a complaint: with a competent supervisory authority (see Section 12).
To exercise any of these rights, write to studio@kndyinteriors.com. We will respond within thirty days. You can also control how Meta uses your data for advertising in your Instagram and Facebook ad settings.
9. Cookies
Our website uses a minimal set of cookies:
- Strictly necessary cookies: required for the website and project portal to function (session management, security). These cannot be disabled.
- Analytics cookies: Google Analytics 4 with IP anonymisation. Used to understand aggregate traffic patterns. No personally identifying profiles are built.
We do not embed third-party advertising trackers on our website beyond Google Ads conversion measurement on the post-submission confirmation page. Our advertising on Meta platforms is based on your activity within Instagram and Facebook (for example engaging with our profile, advertisements or messages), not on cookies set by our website. Should we add a Meta Pixel or similar advertising tag to our website in future, it will only run with your consent and this policy will be updated first.
You can disable analytics cookies in your browser settings or via the Google Analytics opt-out browser add-on.
10. Social media and messaging
We use Instagram (@kndyinteriors) and Facebook (KNDY Interiors) to present our work and to run advertisements. When you interact with our profile, advertisements or messages, Meta processes your data under its own privacy policy, over which we have no control.
If you send us a direct message, or tap "Send message" on one of our advertisements, an automated chat may greet you by your first name and ask a few short questions (what you are planning, the town or city of the home, and your email address). Answering is voluntary; each question can be skipped. Your answers and messages are visible to the studio team in Meta Business Suite and are used only to respond to your enquiry and prepare a proposal. We do not sell or share this data with anyone other than the processors listed in Section 5.
A private lookbook access code shared in the chat is for your personal use and does not involve any additional data collection beyond a visit to our website (see Section 9).
11. Children
Our services are intended for adults engaging us for residential joinery work. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us so we can delete it.
12. Supervisory authorities and complaints
You have the right to lodge a complaint with a supervisory authority if you believe we have processed your personal data unlawfully.
- Switzerland (primary authority): Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (Federal Data Protection and Information Commissioner). edoeb.admin.ch.
- European Union: the data protection authority in your country of residence. A list is maintained at edpb.europa.eu.
- United Kingdom: Information Commissioner's Office (ICO). ico.org.uk.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The "Last updated" date at the top of this page indicates the most recent version. Material changes will be notified by email to active clients. We encourage you to review this policy periodically.
14. Contact
For any questions about this policy or about how we handle your personal data, write to studio@kndyinteriors.com. We aim to respond within five working days.