Privacy policy
1. Introduction and Scope
This Privacy Policy (“Policy”) is issued by KnowYourCountry Limited, a company registered at 7 Castle Street, St Helier, Jersey (“KnowYourCountry”, “we”, “us”, or “our”). KnowYourCountry is the data controller responsible for the personal data described in this Policy. KnowYourCountry is registered with the Jersey Office of the Information Commissioner and is subject to the Data Protection (Jersey) Law 2018 (“DPJL 2018”).
This Policy applies to personal data that KnowYourCountry processes as a controller through its public website (www.knowyourcountry.com), its customer platforms, its API, and all related services (collectively, the “Services”). Where we process personal data on behalf of a customer organisation under a data processing agreement with that customer (for example, data that customer submits through the Services or in a support request), we act as that customer’s processor, and that customer’s privacy notice applies.
KnowYourCountry serves customers worldwide, including in the European Economic Area (“EEA”), the United Kingdom, the United States, Canada, Australia, and the Middle East. This Policy meets the requirements of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) as the baseline standard for all personal data processing. It also satisfies the requirements of the DPJL 2018. KnowYourCountry applies the GDPR standard globally, regardless of where an individual is located.
Where additional obligations apply under the data protection laws of other jurisdictions in which we operate or serve customers, we will comply with those obligations to the extent applicable.
By using the Services, you acknowledge that your personal data will be processed in accordance with this Policy. We encourage you to read this Policy carefully and to contact us if you have any questions (see Section 13).
2. Information We Collect
We collect and process the following categories of personal data in connection with our services:
- (a) Account and registration data: name, job title, email address, employer name, role and permissions within our customer platforms, and telephone number.
- (b) Usage and technical data: IP address, browser type, device information, pages visited, access times, and referring URLs, together with the organisation a visit appears to come from (identified from your IP address).
- (c) Subscription and transaction data: subscription details, billing information, and payment history.
- (d) API usage data: API keys, query logs, and usage metrics.
- (e) Communication data: correspondence, support queries, and feedback.
- (f) Cookie and analytics data: as described in Section 11 of this Policy.
We do not ordinarily collect special category data (as defined in Article 9 of the GDPR). Where the processing of sensitive data is required, we will do so only with your explicit consent.
We do not sell personal data or disclose personal data to third parties for their own marketing purposes, except as described in Section 6(e).
3. How We Collect Your Information
We collect personal data through the following methods.
- (a) Directly from you: we collect personal data that you provide to us when you register for an account, subscribe to our services, complete online forms, correspond with us, attend events, or download materials from our websites.
- (b) Automatically: we collect certain data automatically when you access or use the Services. This includes data collected through cookies, server logs, and analytics tools. Further detail on cookies and similar technologies is set out in Section 11.
- (c) From third parties: we may receive personal data about you from third parties, including payment processors and business partners, in connection with the services we provide to you.
Where the provision of personal data is a contractual or statutory requirement, or a requirement necessary to enter into a contract, we will inform you of this at the point of collection and advise you of the consequences of not providing the requested data.
4. Lawful Bases for Processing
The following table sets out the lawful bases on which we process your personal data.
| Purpose | Lawful Basis (GDPR Reference) | Details |
| Providing our services and managing your account | Performance of a contract (Article 6(1)(b)) where you are our customer; otherwise our legitimate interests (Article 6(1)(f)) in providing the services our customer has subscribed to | Processing necessary to deliver the services the customer has subscribed to and to administer user accounts. |
| Processing payments and billing | Performance of a contract (Article 6(1)(b)) | Processing necessary to collect fees and manage subscription payments. |
| Responding to enquiries and support requests | Legitimate interests (Article 6(1)(f)) | Our legitimate interest in responding to communications and providing customer support. |
| Sending service-related communications | Performance of a contract (Article 6(1)(b)) where you are our customer; otherwise our legitimate interests (Article 6(1)(f)) in providing the services our customer has subscribed to | Transactional and operational messages necessary for service delivery. |
| Sending marketing communications | Consent (Article 6(1)(a)) | Marketing emails sent only where you have provided your prior consent. |
| Website analytics and service improvement | Legitimate interests (Article 6(1)(f)) | Our legitimate interest in understanding how our services are used and improving them. |
| Identifying organisations that visit our website, for sales and marketing | Consent (Article 6(1)(a)), given through our cookie banner | We identify visiting organisations only where you have accepted marketing cookies, so that we can contact organisations interested in our services about those services. |
| Ensuring network and information security | Legitimate interests (Article 6(1)(f)) | Our legitimate interest in protecting our systems, data, and users from unauthorised access or misuse. |
| Complying with legal and regulatory obligations | Legal obligation (Article 6(1)(c)) | Processing necessary to meet applicable legal, tax, or regulatory requirements. |
| Establishing, exercising, or defending legal claims | Legitimate interests (Article 6(1)(f)) | Our legitimate interest in protecting our legal rights and interests. |
Where we rely on legitimate interests, we have conducted a balancing test to confirm that our interests are not overridden by your rights and freedoms. You may request details of any balancing test or object to processing based on legitimate interests by contacting us at privacy@knowyourcountry.com.
5. How We Use Your Information
We use the personal data we collect for the following purposes:
- (a) Service delivery: to provide, operate, and maintain the Services, including granting access to content and processing queries.
- (b) Account administration: to create, manage, and authenticate your account, verify your identity, and manage your preferences.
- (c) Billing and payments: to process subscriptions, issue invoices, collect payments, and maintain transaction records.
- (d) Communications: to respond to your enquiries, provide customer support, send service-related notifications, and, where you have consented, or we have a lawful basis, send marketing communications.
- (e) Security and fraud prevention: to monitor for unauthorised access, detect and prevent fraud, and protect the integrity of our systems and services.
- (f) Analytics and performance: to analyse usage patterns, measure service performance, and generate aggregated statistical reports.
- (g) Legal and regulatory compliance: to comply with applicable laws, regulations, and legal processes, and to respond to lawful requests from public authorities.
- (h) Service improvement: to develop, test, and improve our services, content, and user experience based on usage data and feedback.
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
6. Data Sharing and Recipients
We may share your personal data with the following categories of recipients:
- (a) Service providers and processors: third-party providers who perform services on our behalf, including hosting, payment processing, analytics, and customer support. These providers process personal data only on our instructions and are bound by written data processing agreements.
- (b) Professional advisers: lawyers, auditors, accountants, and insurers who provide professional services to KnowYourCountry Limited.
- (c) Regulatory and law enforcement authorities: government bodies, regulators, law enforcement agencies, and courts where disclosure is required by applicable law or regulation, or in response to a lawful request.
- (d) Corporate transaction parties: potential or actual buyers, sellers, advisers, or other parties in connection with a merger, acquisition, reorganisation, or sale of assets. In such circumstances, personal data may be disclosed as part of the due diligence process or transferred as a business asset, subject to appropriate confidentiality obligations.
- (e) Our website and sales tool provider (HubSpot): HubSpot acts as our processor for the contacts and enquiries we manage in it. For visitor data collected through its tracking code on our website, including identifying the organisation behind a visit, HubSpot also uses the data for its own purposes as an independent controller, under its own privacy policy (legal.hubspot.com/privacy-policy). That may include adding it to HubSpot’s commercial dataset, which HubSpot shares with its customers for their sales and marketing.
We do not sell personal data. We do not disclose personal data to third parties for their own marketing purposes, in each case except as described in paragraph (e) above.
Before sharing personal data with any recipient, we conduct appropriate due diligence to satisfy ourselves that the recipient will handle personal data in a manner consistent with this Policy and applicable data protection law. Where required, we enter into written agreements imposing appropriate data protection obligations on the recipient.
7. International Transfers
Personal data we collect may be transferred to, stored in, or processed in countries outside Jersey and the European Economic Area. Some of these countries may not provide the same level of data protection as Jersey or the EEA.
Where we transfer personal data internationally, we ensure that appropriate safeguards are in place as required by the GDPR and the DPJL 2018. These safeguards include:
- (a) Adequacy decisions: transfers to countries or territories that the European Commission or relevant authority has determined provide an adequate level of data protection, including transfers to organisations in the United States that are certified under the EU-US Data Privacy Framework (and its UK Extension).
- (b) Standard Contractual Clauses (SCCs): transfers made under SCCs approved by the European Commission pursuant to Article 46(2)(c) GDPR.
- (c) Binding corporate rules: transfers to organisations that have adopted binding corporate rules approved by a competent supervisory authority under Article 47 GDPR.
- (d) Derogations under Article 49 GDPR: in limited circumstances, transfers based on applicable derogations, including your explicit consent, the performance of a contract, or the establishment, exercise, or defence of legal claims.
Overseas recipients of personal data are likely located in the United Kingdom, the European Economic Area, and the United States.
You may request a copy of the safeguards we have put in place for international transfers of your personal data by contacting us at privacy@knowyourcountry.com.
8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following table sets out our standard retention periods.
| Data Category | Retention Period |
| Account and registration data | Duration of the account relationship plus six years |
| Usage and technical data | Thirteen months from the date of collection |
| Subscription and transaction data | Duration of the subscription plus six years |
| API usage data | Thirteen months from the date of collection |
| Communication data | Six years from the date of the last communication |
| Marketing contact and activity data | Until you unsubscribe or object |
When the applicable retention period expires, we will delete or anonymise the relevant personal data. Where anonymisation is used, we will ensure that the data can no longer be linked to an identifiable individual.
We may retain personal data for longer than the periods stated above where retention is necessary for the establishment, exercise, or defence of legal claims, or where we are required to do so by applicable law or regulation.
9. Your Rights
Under the GDPR and the DPJL 2018, you have the following rights in relation to your personal data:
| Right | Description |
| Right of access | You may request a copy of the personal data we hold about you. |
| Right to rectification | You may request correction of inaccurate or incomplete personal data. |
| Right to erasure | You may request deletion of your personal data where there is no compelling reason for its continued processing. |
| Right to restriction | You may request that we restrict the processing of your personal data in certain circumstances. |
| Right to data portability | You may request that we provide your personal data in a structured, commonly used, machine-readable format. |
| Right to object | You may object to processing based on legitimate interests or direct marketing. |
| Rights related to automated decision-making | You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. |
- (a) Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- (b) We will respond to all valid rights requests within four weeks of receipt. If a request is complex or we receive a large number of requests, we may extend this period and will notify you accordingly.
- (c) If you wish to make a complaint about how we process your personal data, please see Section 13 of this Policy.
- (d) Individuals in jurisdictions outside the EEA and Jersey may have additional or equivalent rights under their local data protection laws. We will honour such rights to the extent required by applicable law.
- (e) To exercise any of your rights, please contact us at privacy@knowyourcountry.com.
10. Data Security
10.1 KnowYourCountry Limited implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures are proportionate to the nature, scope, and risks of the processing activities we undertake.
10.2 Access controls: access to personal data is restricted to authorised personnel on a need-to-know basis. We maintain role-based access controls, require strong authentication credentials, and review access permissions on a regular basis.
10.3 Encryption and transmission security: personal data is encrypted in transit using industry-standard protocols (such as TLS). Where appropriate, data at rest is also encrypted. We apply security measures to the Services to protect data during transmission and storage.
10.4 Incident response: we maintain documented procedures for identifying, reporting, and responding to personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority and, where required, affected individuals in accordance with applicable law.
We regularly review and test our security measures to ensure their continued effectiveness. No method of transmission over the internet or method of electronic storage is completely secure. While we take all reasonable steps to protect your personal data, we cannot guarantee absolute security.
11. Cookies and Email Tracking Technologies
KnowYourCountry uses cookies and similar tracking technologies on its websites. Cookies are small text files placed on your device that allow us to recognise your browser and collect certain information about your use of our services.
We categorise cookies as follows:
| Category | Purpose |
| Strictly Necessary | Required for the operation of our websites. These enable core functionality such as security, session management, and accessibility. They cannot be disabled. |
| Analytics | Used to collect information about how visitors use our websites, including pages visited and traffic sources. This data helps us improve website performance. |
| Functional | Allow our websites to remember choices you make (such as language or region preferences) and provide personalised features. |
| Marketing | Used to track visitors across websites and display relevant advertisements. These cookies may be set by third-party advertising partners. They are also used to identify the organisations that visit our websites and to link visits to contact records, including by third parties that also use the data for their own purposes. |
Non-essential cookies (Analytics, Functional, and Marketing) are placed only after you have provided your consent via our cookie banner. You may change your cookie preferences at any time through the banner.
We use HubSpot’s tracking technology on our website. Once you accept marketing cookies, it records the pages you visit and, if you have identified yourself to us (for example by completing a form or following a link in one of our emails), links that activity to your contact record. It also lets us identify the organisation a visit appears to come from, using your IP address. HubSpot’s cookies are in our Marketing category. HubSpot also uses this data for its own purposes as an independent controller (see Section 6(e)). You can object to HubSpot’s use of it, or ask HubSpot to remove you from its dataset, through the privacy preferences form in HubSpot’s privacy policy (legal.hubspot.com/privacy-policy). HubSpot’s tracking code runs only on our public website (www.knowyourcountry.com) and is not used on our customer platforms. If you do not accept marketing cookies, none of this tracking takes place.
You may also control cookies through your browser settings. Disabling certain cookies may affect the functionality of our websites.
A separate cookie notice, setting out specific cookie details, is available on our websites.
11.1 Email Tracking Technologies
Our marketing emails may contain tracking technologies, including tracking pixels and tracked links. Tracking pixels are small, transparent image files embedded in an email that allow us to detect whether the email has been opened. Tracked links allow us to identify which links within an email have been clicked.
These technologies involve accessing information on your device and are subject to the consent requirements of the ePrivacy Directive (Directive 2002/58/EC) as implemented in the laws of each relevant jurisdiction.
Where applicable law requires consent for the use of email tracking technologies, we will only activate tracking in emails sent to you if you have provided your prior consent. This consent is separate from, and in addition to, any consent you may have given to receive marketing communications from us.
If you have not consented to email tracking, or if you withdraw your consent, we will continue to send you marketing emails (where you have separately consented to receive them) without tracking technologies enabled.
You may withdraw your consent to email tracking at any time by contacting us at privacy@knowyourcountry.com or by using the preference management link included in our marketing emails.
12. Children’s Data, Third-Party Links, and Changes to This Policy
12.1 Children’s Data
KnowYourCountry’s services are directed at business professionals and are not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental or guardian consent, we will take steps to delete that data promptly. If you believe that a child under 16 has provided personal data to us, please contact us at privacy@knowyourcountry.com.
12.2 Third-Party Links
Our websites and services may contain links to third-party websites, applications, or services that are not operated or controlled by KnowYourCountry. This Policy does not apply to any third-party website or service. We are not responsible for the content, privacy practices, or data protection policies of any third-party website or service. We encourage you to review the privacy policy of any third-party website you visit.
12.3 Changes to This Policy
We may update this Policy from time to time to reflect changes in our processing activities, legal requirements, or business operations. Where we make material changes, we will notify you by posting the updated Policy on our website and updating the ‘Last updated’ date at the top of this Policy. Where required by applicable law, we will provide additional notice (for example, by email) or obtain your consent before changes take effect. We encourage you to review this Policy periodically. Your continued use of our services after the updated Policy has been published constitutes your acknowledgement of the changes.
13. Contact Us
If you have any questions about this Policy or wish to exercise any of your rights, please contact us using the details below.
Data Controller: KnowYourCountry Limited, 7 Castle Street, St Helier, Jersey
Privacy Contact: Chief Executive Officer
Privacy Email: privacy@knowyourcountry.com
We aim to respond to all enquiries and rights requests within the timeframe set out in Section 9.
You may also contact the Jersey Office of the Information Commissioner (JOIC) if you have concerns about how we process your personal data or if you are dissatisfied with our response to a request. If you are located in the European Economic Area, you may contact your local supervisory authority. Individuals in other jurisdictions may contact the relevant data protection authority in their country of residence.