Personal Data and General Confidentiality Agreement

PRIVACY POLICY AND GENERAL CONFIDENTIALITY AGREEMENT

KWEB LTD – Unit G02, Eurocity, Europort Avenue, Gibraltar GX11 1AA – Trade Reg. No: 12-60-86

1. Premise and Scope of Application

This policy describes how personal data of users using the services provided by KWEB LTD, with registered office in Gibraltar, as Data Controller, are processed.

KWEB LTD places the utmost importance on the protection of privacy and personal data of its clients. The processing of data is carried out in full compliance with the Gibraltar General Data Protection Regulation (Gibraltar GDPR), the Data Protection Act 2004 and all other applicable regulations in the territory of Gibraltar concerning the protection of personal data.

This policy applies to all clients, users and visitors of the website kweb.com and related services offered by KWEB LTD.

2. Data Controller and Contact Information

The Data Controller is KWEB LTD, with registered office at:

Unit G02, Eurocity, Europort Avenue, Gibraltar GX11 1AA

Trade Reg. No: 12-60-86

For any questions regarding the processing of personal data or to exercise your rights, you may contact KWEB LTD via email at: info@kweb.com

3. Legal Basis for Processing

The processing of personal data by KWEB LTD is based on the following legal bases, in accordance with the Gibraltar GDPR:

a) Performance of a contract (Article 6, paragraph 1, letter b of the Gibraltar GDPR)

Data are processed for the management of the contractual relationship, including the provision of hosting services, domain registration, payment management and customer support.

b) Compliance with legal obligations (Article 6, paragraph 1, letter c of the Gibraltar GDPR)

Data are processed to comply with obligations under the law of Gibraltar, including tax, accounting and regulatory obligations.

c) Legitimate interest (Article 6, paragraph 1, letter f of the Gibraltar GDPR)

Data are processed to ensure the security of services, prevent fraud and abuse, improve the quality of services and protect the rights of KWEB LTD.

d) Explicit consent of the data subject (Article 6, paragraph 1, letter a of the Gibraltar GDPR)

For marketing purposes, sending newsletters and commercial communications, the user must provide explicit, free and informed consent, which may be withdrawn at any time.

4. Types of Data Processed

KWEB LTD processes the following categories of personal data:

Personal and contact data:

- First name, last name or company name;

- Address of residence or registered office;

- Tax code, VAT number or tax identification number;

- Email address;

- Billing and payment data (including information relating to credit cards, bank accounts, etc.).

Technical and browsing data:

- IP address;

- Browser type and operating system used;

- Data relating to browsing on the kweb.com website (pages visited, time spent, etc.);

- Cookies and tracking technologies.

Service-related data:

- Registered domain names;

- Content published on hosted websites;

- Server and service access logs;

- History of communications with the support service.

Special categories of data (Article 9 of the Gibraltar GDPR):

KWEB LTD does not collect or process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or sex life, unless specific explicit consent is given in writing.

5. Purposes of Processing

Personal data provided by users are processed for the following purposes:

a) Contract performance and service management

- Registration, activation and management of the hosting service and domain names;

- Management of payments, invoicing and collection of fees;

- Communications relating to the service, including notifications of deadlines, renewals, contractual changes and amendments to general conditions;

- Technical, administrative assistance and customer support;

- Management of domain transfer, modification or cancellation requests.

b) Compliance with legal and regulatory obligations

- Compliance with obligations under Gibraltar law, including tax, accounting and anti-money laundering provisions;

- Management of requests from competent authorities, including Registration Authorities (such as NIC.it, Nominet, etc.) and judicial authorities;

- Compliance with obligations under the Gibraltar Data Protection Act 2004 and the Gibraltar GDPR.

c) Security and prevention of fraud and abuse

- Monitoring of service usage to prevent fraudulent activities, cyberattacks, spamming, violations of contractual terms and misuse of services;

- Management of any data security breaches (data breach) and notification to competent authorities and data subjects, as required by the Gibraltar GDPR.

d) Marketing purposes (with explicit consent)

- Sending commercial communications, newsletters, promotions and informational material relating to KWEB LTD services;

- Surveys and market research aimed at improving the quality of services offered;

- Profiling for marketing purposes, limited to data collected with the user's consent.

Consent for marketing purposes may be withdrawn at any time by written communication to KWEB LTD at info@kweb.com or by clicking on the unsubscribe link present in each commercial communication.

e) Management of relationships with suppliers and commercial partners

- Communication of data to third-party suppliers who collaborate with KWEB LTD for the provision of services (e.g. Registration Authorities, payment service providers, data centres, etc.), limited to data strictly necessary for the performance of the service.

6. Processing Methods and Data Retention

The processing of personal data is carried out using both IT and paper tools, according to organisational methods and procedures strictly related to the purposes indicated above.

KWEB LTD adopts adequate technical and organisational security measures to ensure a level of security proportionate to the risk, in accordance with the Gibraltar GDPR, in order to protect data from unauthorised access, loss, destruction, alteration or accidental or unlawful disclosure.

Personal data are retained for the time strictly necessary to achieve the purposes for which they were collected. In particular:

- Contractual and administrative data: for the entire duration of the contractual relationship and, subsequently, for the limitation period of contractual obligations and tax obligations (normally 10 years from the termination of the relationship, in accordance with Gibraltar tax law);

- Browsing data and system logs: for a period not exceeding 12 months, unless necessary for the investigation of crimes or contractual violations;

- Data for marketing purposes: until revocation of consent by the data subject.

After the retention periods have elapsed, the data will be permanently deleted or anonymised.

7. Rights of the Data Subject

In accordance with the Gibraltar GDPR, the user (data subject) has the right to exercise the following rights at any time:

a) Right of access (Article 15 of the Gibraltar GDPR)

The user has the right to obtain from KWEB LTD confirmation as to whether or not personal data concerning him/her are being processed and, where that is the case, access to the personal data and information relating to the processing (purposes, categories of data, recipients, retention period, etc.).

b) Right to rectification (Article 16 of the Gibraltar GDPR)

The user has the right to obtain from KWEB LTD the rectification of inaccurate personal data concerning him/her, as well as the completion of incomplete data, by providing a supplementary statement.

c) Right to erasure (right to be forgotten) (Article 17 of the Gibraltar GDPR)

The user has the right to obtain from KWEB LTD the erasure of personal data concerning him/her without undue delay, in the cases provided for by the Gibraltar GDPR, for example when the data are no longer necessary for the purposes for which they were collected, when consent has been withdrawn and there is no other legal basis, or when the data have been unlawfully processed.

d) Right to restriction of processing (Article 18 of the Gibraltar GDPR)

The user has the right to obtain from KWEB LTD restriction of processing in the cases provided for by the Gibraltar GDPR, for example when contesting the accuracy of the personal data or when the processing is unlawful and the user opposes erasure.

e) Right to data portability (Article 20 of the Gibraltar GDPR)

The user has the right to receive the personal data concerning him/her in a structured, commonly used and machine-readable format, as well as the right to transmit those data to another controller, where technically feasible.

f) Right to object (Article 21 of the Gibraltar GDPR)

The user has the right to object at any time to the processing of personal data concerning him/her, on grounds relating to his/her particular situation. In the event of objection, KWEB LTD will refrain from processing the data unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the user.

g) Right to withdraw consent

The user has the right to withdraw his/her consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Withdrawal may be communicated to KWEB LTD via email at info@kweb.com.

To exercise their rights, the user may send a written request to KWEB LTD via email at info@kweb.com. KWEB LTD will respond to the request within one month of receipt, subject to an extension of up to two further months in cases of complexity or a high number of requests, duly notifying the user.

Requests are generally free of charge, except in the case of manifestly unfounded, excessive or repetitive requests, for which KWEB LTD may charge a reasonable administration fee or refuse to act on the request.

8. Disclosure and Transfer of Data

The user's personal data may be disclosed to:

- Employees and collaborators of KWEB LTD, specifically authorised and trained in data processing;

- Technical suppliers and partners who collaborate with KWEB LTD for the provision of services, such as:

- Registration Authorities (e.g. NIC.it, Nominet, ICANN, etc.) for domain name registration and management;

- Payment service providers and banking institutions for the management of financial transactions;

- Data centre and hosting service providers for the management of the technological infrastructure;

- Technical assistance and customer support service providers;

- Marketing and communication service providers (limited to data for which consent has been given).

- Public and judicial authorities of Gibraltar and other countries, when required by law or regulatory obligation;

- Legal, tax and accounting advisors for the management of regulatory obligations and disputes.

Personal data may be transferred outside Gibraltar, including to European Union countries and third countries, exclusively for the purposes indicated above and in compliance with the Gibraltar GDPR provisions on international data transfers.

In particular, transfers to third countries that do not provide an adequate level of protection will only be carried out if appropriate safeguards are in place, such as standard contractual clauses approved by the competent authorities, or if one of the derogations provided for by the Gibraltar GDPR applies (e.g. explicit consent of the data subject, necessity for the performance of a contract, etc.).

The user may request information on transfers made and safeguards adopted by contacting KWEB LTD at info@kweb.com.

9. Data Security and Data Breach Notification

KWEB LTD adopts adequate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with the Gibraltar GDPR, in order to protect personal data from:

- Accidental or unlawful destruction, loss, alteration or disclosure;

- Unauthorised access or unauthorised processing;

- Improper use or breach of confidentiality.

In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, KWEB LTD will notify the breach to the competent supervisory authority within 72 hours of becoming aware of it, unless the breach does not pose a risk to the rights and freedoms of data subjects.

If the breach poses a high risk to the rights and freedoms of data subjects, KWEB LTD will also inform the data subjects without undue delay, describing the nature of the breach and the measures taken to remedy it.

10. Cookies and Tracking Technologies

The KWEB LTD website uses cookies and tracking technologies to ensure the proper functioning of the site, improve the browsing experience, analyse traffic and, with the user's consent, provide personalised content and targeted advertising.

For more information on the use of cookies, please refer to the Cookie Policy of KWEB LTD available on the website kweb.com.

11. Changes to the Policy

KWEB LTD reserves the right to make changes to this policy at any time, in order to adapt it to any regulatory, technological or organisational changes. Changes will be published on the website kweb.com and, where substantial, will be communicated to data subjects via email.

Users are encouraged to periodically review this policy to stay informed about how their personal data are processed.

12. Consent to the Processing of Personal Data

The client acknowledges that, in accordance with the Gibraltar GDPR, the registration of the domain name involves the inclusion of the client's personal data in a publicly accessible register, managed by the competent Registration Authorities. The client therefore warrants that the personal data provided to KWEB LTD for the full performance of the contract are correct, up-to-date and truthful.

The user expressly consents to the processing of his/her personal data by KWEB LTD for the purposes and in the manner described in this policy.

13. General Confidentiality Agreement (NDA – Non-Disclosure Agreement)

The following provisions constitute the General Confidentiality Agreement between KWEB LTD and the Client, aimed at protecting confidential information exchanged during the contractual relationship.

13.1 Definition of Confidential Information

For the purposes of this agreement, "Confidential Information" means all information, regardless of form (written, oral, electronic, graphic, etc.), that one Party ("Disclosing Party") communicates to the other Party ("Receiving Party") in connection with the contractual relationship, including, by way of example and not limitation:

- Personal data of clients and users;

- Technical information relating to the infrastructure, systems, software and network architectures of KWEB LTD;

- Financial, tax and accounting data;

- Commercial strategies, marketing plans and information relating to clients, suppliers and commercial partners;

- Passwords, access credentials, encryption keys and security codes;

- Any other information that, by its nature or the circumstances of the communication, should reasonably be considered confidential.

The following do not constitute Confidential Information:

- Information that is or becomes publicly available, other than through a breach of this agreement;

- Information that was already in the possession of the Receiving Party prior to disclosure by the Disclosing Party, as documented by written evidence;

- Information received from third parties lawfully in possession of such information, without any obligation of confidentiality;

- Information independently developed by the Receiving Party without using the Disclosing Party's Confidential Information.

13.2 Confidentiality Obligations

The Receiving Party undertakes to:

- Treat the Confidential Information with the utmost confidentiality, using the same degree of care it employs for its own confidential information, but in any case no less than a reasonable degree of care;

- Not disclose, communicate or transmit the Confidential Information to third parties, except as strictly necessary for the performance of the contract and limited to employees, collaborators, advisors and suppliers who have a legitimate interest in knowing it and who are bound by a similar obligation of confidentiality;

- Use the Confidential Information exclusively for the purposes set out in the contract and not for any other purpose, without the prior written consent of the Disclosing Party;

- Adopt all necessary technical and organisational measures to protect the Confidential Information from unauthorised access, loss, destruction, alteration or disclosure;

- Not copy, reproduce, record or archive the Confidential Information except to the extent strictly necessary for the performance of the contract.

13.3 Mandatory Disclosure by Law

If the Receiving Party is required by law, by a judicial authority or by a regulatory authority to disclose Confidential Information, it shall:

- Give prompt written notice to the Disclosing Party, if legally permitted, to allow it to object to the disclosure or to seek a protective order;

- Limit disclosure to what is strictly required by the legal obligation;

- Request the third-party recipient to treat the Confidential Information as confidential.

13.4 Duration of the Confidentiality Obligation

The confidentiality obligation under this agreement shall commence on the date of disclosure of the Confidential Information and shall continue for the entire duration of the contractual relationship and for a period of 5 (five) years from the termination of the contract, for any reason whatsoever.

The confidentiality provisions shall remain in force even after termination of the contract, for the entire period indicated above.

13.5 Return or Deletion of Confidential Information

Upon termination of the contractual relationship, or upon written request of the Disclosing Party, the Receiving Party undertakes to:

- Immediately return to the Disclosing Party all documents, computer media and any other material containing Confidential Information;

- Delete or destroy all copies, backups and reproductions of the Confidential Information present in its systems and archives, certifying in writing that the deletion/destruction has been carried out;

- Retain only the copies strictly necessary to comply with legal or tax retention obligations, remaining in any case bound by the confidentiality obligation for such copies.

13.6 Breach of the Confidentiality Agreement

In the event of a breach of the confidentiality obligations under this agreement, the Disclosing Party shall have the right to:

- Claim compensation for all damages suffered, including direct, indirect, consequential damages and loss of business opportunities;

- Seek injunctive or interim relief to prevent further breaches;

- Terminate the contract for material breach, in accordance with the general terms and conditions;

- Claim compensation for further damage, without prejudice to the provisions of the general terms and conditions.

The Parties acknowledge that a breach of the confidentiality obligation may cause irreparable harm to the Disclosing Party, for which monetary compensation alone may not be sufficient. The Disclosing Party shall therefore be entitled to obtain injunctive or interim relief in addition to any other remedy available at law.

13.7 Intellectual Property

The Confidential Information remains the exclusive property of the Disclosing Party. No provision of this agreement grants the Receiving Party any right, title or interest in the Confidential Information, nor does it constitute a licence or authorisation to use it for purposes other than those provided for in the contract.

13.8 Survival

The provisions of this Confidentiality Agreement shall survive the termination of the contract for any reason and shall remain in force for the period indicated in section 13.4.

14. Acceptance and Signature

The client, by signing the contract and accepting these terms, declares to:

- Have read this privacy policy and confidentiality agreement;

- Understand the purposes and methods of processing their personal data;

- Fully accept the provisions of this policy;

- Give their consent to the processing of personal data for the purposes set out herein;

- Recognise and accept that their personal data will be included in publicly accessible registers (Registration Authorities), as necessary for domain name registration;

- Recognise and accept that KWEB LTD may transfer data to third-party suppliers, competent authorities and other recipients, as described in this policy, for the performance of the contract and compliance with legal obligations.

15. Competent Court and Applicable Law

This privacy policy and confidentiality agreement are governed by the law of Gibraltar.

Any dispute relating to this policy, the confidentiality agreement or the processing of personal data shall be subject to the exclusive jurisdiction of the Courts of Gibraltar.

16. Contact Information

For any questions, requests for clarification or to exercise your rights regarding the protection of personal data, you may contact KWEB LTD via email at:

info@kweb.com

KWEB LTD

Unit G02, Eurocity, Europort Avenue

Gibraltar GX11 1AA

Trade Reg. No: 12-60-86

Last updated: 4 August 2026