Last updated 14 October 2026
Kiltr is operated by MSQ Limited, a company registered in England & Wales under number 17163737, with its registered office at Unit 9, Belbins Business Park, Cupernham Lane, Romsey, Hampshire, England, SO51 7JF ("Kiltr", "we", "us"). Kiltr has operations in the United Kingdom and Australia.
For the personal data described in this policy, Kiltr is the data controller. For data held inside the Kiltr platform on behalf of an agency or advisory firm that licenses it, that firm is the controller and Kiltr is a processor acting on its instructions under a data processing agreement. Section 2 explains the difference.
This policy covers personal data we collect through this website, kiltr.co, and through our dealings with prospective and current customers, partners and enquirers. It also explains, in outline, how personal data is handled inside the Kiltr platform at app.kiltr.co.
If you answered a Benchmark questionnaire because an agency invited you, that agency decides why and how your answers are used. It is the controller of that data, and its own privacy notice applies alongside the notice shown to you when you took part. Kiltr processes those answers only on the agency's instructions. To exercise your rights over that data, contact the agency in the first instance. If you contact us instead, we will pass your request to them and help them respond.
Contact form. Your name, work email address, agency or organisation, role, phone number if you give it, what you are looking for, and your message.
Correspondence. Anything you send us by email or through the platform, and our replies.
Insight Sessions and meetings. Notes we take, and any recording where we have told you in advance and you have agreed.
Platform accounts. If your organisation licenses Kiltr, your name, work email, role and the credentials used to sign in. Kiltr uses passkeys and email links rather than passwords.
Server logs. Our hosting provider records the IP address, browser type, pages requested and time of each request, for security and to keep the site running.
Form protection. When you submit the contact form we record the time the form was opened and a hidden field that only automated software fills in, to keep spam out. We also record your IP address with the submission.
Emails we send. Our email provider records whether a message was delivered, and may record whether it was opened or a link clicked.
Website analytics, if you agree. With your consent, Google Analytics records how you use this website: the pages you visit, how you arrived, your approximate location, and your device and browser. Nothing is collected until you choose Accept.
We do not run advertising trackers, and our analytics are not used for advertising or to follow you across other websites.
Under the UK GDPR and the EU GDPR we need a lawful basis for each use. These are ours.
What we do | Lawful basis |
|---|---|
Reply to your enquiry, arrange an Insight Session, and follow up on it | Legitimate interests: responding to a request you made |
Send you a confirmation that we received your message | Legitimate interests |
Set up and run your organisation's licence and platform accounts | Performance of a contract, or steps you asked us to take before entering one |
Keep the site and platform secure, prevent abuse and spam | Legitimate interests: security |
Send you news about Kiltr, if you have asked for it | Consent, which you can withdraw at any time using the link in every message or by emailing us |
Understand how visitors use this website, so we can improve it | Consent, which you can withdraw at any time with Cookie settings at the foot of every page |
Keep records we are required to keep, and respond to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that our use is proportionate and what you would reasonably expect. You can object at any time; see section 9. We do not use your personal data for automated decision-making that has a legal or similarly significant effect on you.
We do not sell personal data. We share it only with the providers we need to run Kiltr, each bound by contract to process it only on our instructions:
Blutui, which hosts this website.
DigitalOcean, which hosts the Kiltr platform and the service that handles contact form submissions, in London and Amsterdam.
Twilio SendGrid, which delivers the emails we send.
Google Workspace, which runs our email and document storage.
Google Analytics, which measures how this website is used, only if you agree.
GitHub, which stores the website's source code. No personal data is held there.
We may also share personal data with professional advisers, with a buyer or successor if Kiltr is sold or reorganised, and with authorities where the law requires it.
The Kiltr platform and its backups are hosted in the United Kingdom and the Netherlands. The United Kingdom and the European Economic Area each recognise the other as providing adequate protection, so data can move between them without further safeguards.
Kiltr has staff in Australia, and some of our providers operate outside the United Kingdom and the EEA. Where personal data from the United Kingdom or the EEA is accessed from or transferred to a country without an adequacy decision, we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for a copy of the relevant safeguard using the details in section 13.
If you accept analytics, Google may process that data in the United States. Google is certified under the EU-US Data Privacy Framework and its UK Extension, which the EU and the UK recognise as providing adequate protection.
For individuals in Australia, we handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988.
Enquiries and Insight Session records: up to 24 months after our last contact with you, unless your organisation becomes a customer.
Customer and account records: for the life of the licence, then up to 7 years for records we must keep for tax, accounting or legal reasons.
Server and security logs: up to 90 days.
Website analytics: Google Analytics keeps event-level data for 14 months, after which only aggregated reports remain. Its cookies last up to 2 years, or until you withdraw consent.
Email delivery records: as long as our email provider retains them, currently up to 30 days for event data.
Data inside the platform on behalf of a customer is retained for as long as that customer instructs, and deleted or returned when the licence ends, in line with the data processing agreement.
Kiltr uses encryption in transit on every connection, encrypted backups, passwordless sign-in with passkeys, access limited to the people who need it, and logging of administrative access. No system is perfectly secure. If a breach affects your personal data and is likely to put your rights at risk, we will tell you and the relevant regulator within the timeframes the law requires.
If you are in the United Kingdom or the EEA you have the right to:
ask for a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data erased, where there is no good reason for us to keep it;
restrict how we use it, in certain circumstances;
object to our use of it where we rely on legitimate interests, and to direct marketing at any time;
receive the data you gave us in a portable format;
withdraw consent, where consent is the basis we rely on.
To use any of these rights, email hello@kiltr.co. We will reply within one month, and we may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office in the United Kingdom at ico.org.uk, to the supervisory authority in your EEA country, or to the Office of the Australian Information Commissioner at oaic.gov.au. We would rather hear from you first so we can put things right.
This website asks before setting any analytics cookies. If you choose Accept, Google Analytics sets two cookies, _ga and _ga_QD3P0N20NV, which tell one browser from another and last up to 2 years. If you choose No thanks, none are set. You can change your mind at any time with Cookie settings at the foot of every page, which also removes the analytics cookies.
The site also stores three small items in your browser that are strictly necessary for it to work as you left it. None of them identifies you or is sent to us:
your cookie choice, so we do not ask again on every page;
whether you have dismissed the announcement bar at the top of the page;
the animation state of the page, so it does not replay unnecessarily.
We set no advertising cookies. The Kiltr platform at app.kiltr.co sets a session cookie when you sign in, which is necessary to keep you signed in. You can clear all of these through your browser settings.
Kiltr is a business service. We do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us and we will delete it.
We will post any change here with a new date at the top. If a change materially affects how we use your data, we will tell customers directly.
MSQ Limited
Unit 9, Belbins Business Park, Cupernham Lane, Romsey, Hampshire, England, SO51 7JF
Email: hello@kiltr.co