Privacy Policy
Last updated 8 June 2026
This policy explains how KOHA HQ Ltd (“KOHA”, “we”, “us”), a company registered in England & Wales, collects, uses and protects personal data. It covers visitors to this website, people who enquire about or buy KOHA, and the recipients of gifts and rewards sent through the platform. We are committed to handling personal data in line with the UK GDPR and the Data Protection Act 2018.
On this page
1Who we are
KOHA HQ Ltd is the data controller for the personal data described in this policy, except where we act as a processor on behalf of our customers (see section 9). You can reach us about privacy at privacy@kohahq.com.
2The data we collect
Website visitors
When you browse this site we may collect limited technical information such as your IP address, browser type, pages viewed and referring source, gathered through our hosting provider and, where you consent, analytics. This helps us keep the site secure and understand how it is used.
Enquiries and demo requests
If you contact us or request a demo, we collect the details you provide, typically your name, work email, company, and the content of your message. We use this to respond and to follow up about KOHA.
Customers and authorised users
If your organisation subscribes to KOHA, we collect account and contact details for your authorised users, along with billing information needed to manage the subscription.
Reward recipients
When a customer sends a gift or reward through KOHA, the platform processes recipient details such as name, email address, and information about the gift and its claim. For most of this data we act as a processor on behalf of the customer who initiated the send.
3How we use it & lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and demo requests | Legitimate interests, and steps to enter a contract |
| Providing, supporting and securing the platform | Performance of a contract |
| Sending service and relationship communications | Legitimate interests |
| Marketing emails to business contacts | Legitimate interests or consent, with an opt-out in every message |
| Analytics and site improvement | Consent, where non-essential cookies are used |
| Meeting legal, tax and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can object to processing based on legitimate interests at any time (see section 8).
4Cookies
This website currently uses only strictly necessary cookies and similar technologies required for it to function and stay secure. These do not require consent. If we introduce analytics or other non-essential cookies, we will ask for your consent first through a cookie banner and update this section to describe them. You can control cookies through your browser settings at any time.
5Who we share it with
We do not sell personal data. We share it only with service providers who process it on our behalf under contract, and where required by law. Our key sub-processors support hosting, the application, authentication, communications and rewards, and may include providers such as our cloud hosting and database providers, authentication provider, CRM, messaging, email delivery, digital-reward and AI providers, and our payment processor. A current list is available on request from privacy@kohahq.com.
6International transfers
Some of our providers are based outside the UK. Where personal data is transferred internationally, we rely on an adequacy decision where one applies, or appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, together with additional measures where needed.
7How long we keep it
We keep personal data only as long as necessary for the purpose it was collected, to provide the Services, and to meet legal, accounting or reporting requirements. Enquiry data is kept for as long as needed to follow up and a reasonable period afterwards. Customer and recipient data is retained for the subscription term and deleted or returned afterwards in line with our agreement, subject to legal retention obligations.
8Your rights
Subject to conditions in the law, you have the right to:
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we process it, including for direct marketing;
- data portability; and
- withdraw consent at any time where we rely on it.
To exercise any of these, email privacy@kohahq.com. If your data was provided to KOHA by a customer who controls it, we may refer your request to that customer.
9Controller & processor roles
We are the controller for data about website visitors, enquiries and our direct customer relationships. For personal data that a customer uploads or generates within the platform, including reward recipient data, the customer is the controller and we act as their processor, handling that data only on their documented instructions under a data processing agreement.
10Security
We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and trusted infrastructure providers. No system is completely secure, but we work to protect your data and to respond promptly to any incident.
11Changes
We may update this policy from time to time. When we make a material change we will update the date above and, where appropriate, notify you. Please check back for the latest version.
12Complaints & contact
For any privacy question or to exercise your rights, contact privacy@kohahq.com, addressed to KOHA HQ Ltd. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, though we would welcome the chance to resolve it first.
KOHA HQ Ltd · Registered in England & Wales · Registered office: 25 Tamarisk Avenue, Reading, RG2 8JB. Company number to follow.