Privacy

Privacy Policy

Last updated: 5 October 2026.

Controller and contact details

The data controller is KISTU LTD, a private limited company registered in England and Wales under company number 16609532. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. For privacy requests, email privacy@kistu.ai.

Data we process

Through the form, we collect name and email address; company, role, industry and other context only where supplied; interest, use case, workflow description, use of MAGIC Italia / TALIA, notes, language, consent choices, source, UTM parameters, technical logs, user agent and a hash of the IP address. Company and role are optional for individual visitors.

Purposes

We use the data to respond to access, preview or assessment requests, prevent abuse and maintain technical logs. Non-essential analytics events are disabled by default and require authorised activation and consent. We send KISTU marketing updates only where separate consent has been given.

Lawful bases

Processing required to respond to a request is based on steps taken at the user’s request before entering into a contract. Security, technical logs and abuse prevention are based on legitimate interests. Marketing communications are based on consent, which may be withdrawn.

Recipients, providers and locations

The form stores requests in the KISTU first-party database. When configured on the live service, Cloudflare Turnstile processes anti-abuse data, the configured SMTP provider sends operational notifications, Brevo receives only contacts who give separate marketing consent, and the signed CRM webhook receives the request for internal follow-up. An optional recipient receives no data when its credential or endpoint is not configured. Cloudflare can process data internationally under its data-protection terms; KISTU does not publish an unverified storage region for the first-party database, SMTP provider or CRM endpoint. Contact privacy@kistu.ai for the current production inventory before submitting sensitive context.

Retention

Request records and technical logs are kept only for handling the request, security, diagnostics and applicable legal obligations. The current landing implementation does not promise an automatic expiry date for lead records. You can request deletion at privacy@kistu.ai; KISTU will erase or restrict the record when no continuing legal basis requires it. Do not submit customer personal data or confidential documents through the initial form.

Your rights

You may request access, rectification, erasure, restriction and data portability, and may withdraw marketing consent. You may also lodge a complaint with the competent supervisory authority.

Right to object

You may object at any time to processing for direct marketing. You may also object to processing based on legitimate interests where the law provides this right.

Automated decisions

Data submitted through the landing site is not used for decisions based solely on automated processing that produce legal or similarly significant effects.