PRIVACY POLICY

Last Updated: OCTOBER 2026

1. ABOUT THIS POLICY
KADA Management Limited ("KADA", "we", "us", "our") is an Irish-registered business consulting practice based in Moneygall, Co. Offaly, Ireland. We provide remote operations, systems, sales, project management, virtual assistance, social media, email marketing and website support services, and run The Operations Partner programme.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it (including how we use AI tools to support our work), who we share it with, how long we keep it and the rights you have. It applies to visitors to www.kadamanagement.com, prospective clients, clients, programme members and other contacts of KADA.
This policy is provided in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the Irish Data Protection Act 2018, and the UK GDPR where it applies. It should be read with our Terms and Conditions at www.kadamanagement.com/terms-and-conditions.

2. DATA CONTROLLER
KADA Management Limited is the data controller for the personal data described in this policy.
Company: KADA Management Limited
Registered address: Moneygall, Co. Offaly, Ireland
Website: www.kadamanagement.com
Email: admin@kadamanagement.com
We have not appointed a statutory Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy queries are handled directly by the controller at the email above.

3. PERSONAL DATA WE COLLECT
3.1 Website visitors
• Identifiers you submit through forms: name, email address, business name, phone number and message content.
• Technical data: IP address, device identifier, browser type, country, pages visited, referring URL and time on site.
• Marketing preferences: whether you have opted in to our email list, and any preferences you tell us.
3.2 Prospective and existing clients
• Contact and identification data: name, role, business name, email, phone and postal address where relevant.
• Contractual data: proposals, statements of work, invoices and payment records.
• Operational data you share with us to deliver services: business documents, processes, anonymised data sets, login details to systems where you formally authorise us to act on your behalf, and other content you upload, paste or send to us.
• Communications: emails, messages, call notes, and meeting recordings (only with your consent).
3.3 Members of The Operations Partner
In addition to 3.2, when you join The Operations Partner we collect:
• Enrolment and account data: your name, email, billing details and programme access, held in our checkout and course platform.
• Your Baseline Form and Role + Rate Quiz answers: for example your services, revenue, rates, hours worked, number of clients, goals and where your business is now.
• Progress information you share with us, such as updates on your goals and results.
• Evidence of revenue you send us to claim the ROI Guarantee, such as invoices or signed agreements. We ask you to remove or redact your clients' personal details before sending these.
• Messages and content you post in the programme's Slack workspace, and assets you submit for Expert Review.
Your Business Numbers Tracker is a copy saved in your own Google Drive. We only see it if you choose to share it with us.
3.4 Categories we do not knowingly collect
We do not request, and ask clients not to provide, special category data under Article 9 GDPR (such as health, racial or ethnic origin, religious beliefs, biometric or genetic data) or criminal records data under Article 10. We do not see or store your full card details; card payments are handled by our payment processors.

4. LAWFUL BASES FOR PROCESSING
We rely on the following lawful bases under Article 6 GDPR:
• Contract (Art. 6(1)(b)): to take steps before entering a contract (responding to enquiries, sending proposals) and to deliver our services and programmes, including programme emails, calls, Slack support and assessing ROI Guarantee claims.
• Consent (Art. 6(1)(a)): for non-essential cookies, analytics, marketing emails, call recordings, and using your name or results in testimonials. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to keep accounting records as required by the Companies Act 2014 and the Revenue Commissioners (typically 6 years), and to respond to lawful regulatory or law-enforcement requests.
• Legitimate interests (Art. 6(1)(f)): to operate, secure and improve our business and programmes, including limited use of AI tools to support our work (see section 5) and reviewing anonymised, combined programme results. We balance these interests against your rights, and you can object at any time.

5. OUR USE OF AI TOOLS
KADA uses OpenAI ChatGPT and Anthropic Claude to help us draft documents, summarise notes, structure plans, analyse non-sensitive business information, and otherwise improve the quality and speed of our work. Google Gemini and Microsoft Copilot are available to us as part of our Google Workspace and Microsoft 365 subscriptions but are not actively used in client delivery at this time. We treat AI as a productivity tool, not as a decision-maker.
5.1 What we do
• We use AI tools under business or paid plans where the provider contractually commits not to use our inputs to train its public models.
• We minimise the personal data we share with AI tools. Where personal data is involved, we use the smallest amount needed and prefer anonymised or pseudonymised content.
• We review AI outputs before they are sent to clients or used in deliverables. A person at KADA is always responsible for the final work.
• We use AI to help with tasks such as drafting emails and documents, summarising meetings and notes, building templates, analysing publicly available data, and helping with code or formulas.
5.2 What we do not do
• We do not put client special category data, financial account credentials, payment card data or other sensitive personal data into AI tools.
• We do not use AI to make decisions that produce legal or similarly significant effects about you, including decisions on ROI Guarantee claims. There is no solely automated decision-making within the meaning of Article 22 GDPR.
• We do not sell your data to AI providers or anyone else.
5.3 Your choice
If you would prefer that we do not use AI tools in your engagement, tell us in writing and we will agree alternative arrangements where reasonably possible.

6. HOW WE USE YOUR DATA
• To respond to enquiries and provide quotes or proposals.
• To deliver the services and programmes you have purchased, including calls, Slack support, Expert Reviews and access to The KADA Vault.
• To track your progress through The Operations Partner and assess ROI Guarantee claims.
• To send invoices, take payments and manage payment plans.
• To send programme emails about your enrolment, calls, payments and account while you are a member.
• To send marketing emails through MailerLite where you have opted in. Every marketing email has a one-click unsubscribe.
• To operate, secure and improve our website, programmes and internal systems.
• To comply with our legal, tax and accounting obligations.

7. WHO WE SHARE YOUR DATA WITH
We do not sell your personal data. We share it only with third parties that help us run KADA. These processors act on our instructions under written agreements that include the safeguards required by Article 28 GDPR. Our main processors are:
• Showit (website host): hosting kadamanagement.com. United States (EU-US Data Privacy Framework).
• ThriveCart: checkout, payment plans and course platform for our programmes. United States (Standard Contractual Clauses).
• Stripe: payment processing. EU and United States (EU-US Data Privacy Framework and Standard Contractual Clauses).
• Google (Workspace, Forms, Analytics, Search Console): email, file storage, forms such as the Baseline Form and Role + Rate Quiz, and website analytics. EU and United States (EU-US Data Privacy Framework).
• Zoom: video calls. United States (EU-US Data Privacy Framework).
• TidyCal: call booking. United States (Standard Contractual Clauses).
• MailerLite: email marketing list and campaigns. EU and United States (Standard Contractual Clauses and EU-US Data Privacy Framework).
• HubSpot: CRM and pipeline management. EU and United States (Standard Contractual Clauses and EU-US Data Privacy Framework).
• Slack (Salesforce): client messaging and the programme community. United States (EU-US Data Privacy Framework).
• Notion, Asana, ClickUp: project and task management. United States (Standard Contractual Clauses and EU-US Data Privacy Framework).
• OpenAI (ChatGPT) and Anthropic (Claude): AI assistance for drafting, summarising and analysis. United States (Standard Contractual Clauses and EU-US Data Privacy Framework, no model training on inputs under business plans).
• Google Gemini and Microsoft Copilot: available within our Google Workspace and Microsoft 365 subscriptions; not actively used by KADA at present. EU and United States (EU-US Data Privacy Framework).
This list may change from time to time, and the current version is the one that applies.
Other members of The Operations Partner can see what you post in shared programme spaces, such as group calls and Slack channels. They agree to keep it confidential under our Terms and Conditions.
We may also disclose personal data where we are legally required to (for example to the Revenue Commissioners, the courts or An Garda Síochána), or to professional advisers bound by confidentiality.

8. INTERNATIONAL TRANSFERS
KADA is based in Ireland and prefers EU/EEA-hosted services where practical. However, several of the tools we rely on are run by US-headquartered providers, so some personal data is transferred outside the EEA, mainly to the United States.
Where this happens, we rely on one or more of the following safeguards under Chapter V GDPR:
• the European Commission adequacy decision for the EU-US Data Privacy Framework, where the receiving organisation is certified under it
• Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed following our transfer assessment
• your explicit consent, where appropriate and after you have been told of the risks
You can ask for a copy of the safeguards in place for a specific transfer by emailing admin@kadamanagement.com.

9. HOW LONG WE KEEP YOUR DATA
• Website enquiry messages: up to 24 months from last contact, then deleted unless they form part of a client file.
• Client and programme records (contracts, deliverables, working files, Baseline Form and Role + Rate Quiz answers, ROI Guarantee evidence): for the length of the engagement or programme and for 6 years after it ends, to meet accounting and limitation-period obligations.
• Accounting and tax records: 6 years (Companies Act 2014, Taxes Consolidation Act 1997).
• Programme platform account: kept while you have access to The KADA Vault. You can ask us to close it at any time.
• Slack messages and posts: kept for the life of the programme workspace. You can ask us to remove your account and posts at any time.
• Marketing list data (MailerLite): until you unsubscribe or are inactive for 24 consecutive months.
• Call recordings (where you have consented): up to 12 months, then deleted.
• Website analytics: standard provider retention periods (typically 14 to 26 months).
When the retention period ends, we delete or anonymise the data.

10. HOW WE PROTECT YOUR DATA
• Multi-factor authentication on business email, cloud storage, password manager and key software tools.
• Encrypted storage and TLS encryption in transit.
• Access on a need-to-know basis. KADA is a small business, and access is limited to the controller and any contractors who have signed confidentiality terms.
• Regular software and device updates and reputable endpoint protection.
• Written processor and confidentiality agreements where we engage third parties.
No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours, and tell you without undue delay where required under Articles 33-34 GDPR.

11. COOKIES AND SIMILAR TECHNOLOGIES
Our website uses a small number of cookies and similar technologies. Strictly necessary cookies are set without consent. Non-essential cookies, including analytics, are set only after you accept them through our cookie banner. You can change or withdraw your consent at any time through the cookie settings on the site or your browser controls.
• Strictly necessary: allow the site, checkout and course platform to work (for example session and security cookies).
• Analytics: Google Analytics, to understand how the site is used. Aggregated and pseudonymised where possible.
• Preferences: remember choices such as cookie consent.
Disabling cookies in your browser may affect how the site works.

12. YOUR RIGHTS
Under the GDPR you have the following rights. We will respond to a valid request within one month, which may be extended by a further two months for complex requests.
• Right of access (Art. 15): a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): deletion in specified circumstances.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): your data in a structured, machine-readable format.
• Right to object (Art. 21): including to processing based on legitimate interests, and to direct marketing at any time.
• Right to withdraw consent at any time where processing is based on consent (Art. 7).
• Right not to be subject to a decision based solely on automated processing (Art. 22). As noted above, we do not carry out such processing.
To exercise any right, email admin@kadamanagement.com with "Data request" in the subject line. We may need to verify your identity before responding.
If you are unhappy with how we handle your data, you have the right to complain to the supervisory authority. In Ireland this is:
Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Tel: +353 (0)761 104 800. Web: www.dataprotection.ie.
UK residents may complain to the Information Commissioner's Office (ico.org.uk).

13. CHILDREN
Our website, services and programmes are for businesses and adults aged 18 and over. We do not knowingly collect personal data from children under 16, which is the age of digital consent in Ireland under section 31 of the Data Protection Act 2018. If you believe a child has given us personal data, please contact admin@kadamanagement.com and we will delete it.

14. CHANGES TO THIS POLICY
We may update this policy from time to time. The current version is always available at www.kadamanagement.com/privacy-policy, with the "Last Updated" date at the top. We will tell clients, programme members and active marketing subscribers about material changes by email.

15. CONTACT
Questions, requests and complaints about this policy or your personal data:
Email: admin@kadamanagement.com
Post: KADA Management Limited, Moneygall, Co. Offaly, Ireland


© 2026 KADA Management Limited. All rights reserved.

T&Cs

Privacy Policy

Designed by Holistic-Designs

© 2026 KADA Management