Privacy Policy
Last updated:
July 9, 2026
1. What is this Privacy Notice about?
KITRO SA (also «we», «us» or «KITRO») collects and processes personal data that concerns you and, where applicable, other individuals («third parties»). We use the word «data» here inter- changeably with «personal data».
In this Privacy Notice, we describe what we do with your data when you use www.kitro.ch, my.kitro.ch, our other websites, applications, dashboard or online services (collectively the «website» or «online services»), obtain products or services from us, interact with us in relation to a contract, communicate with us, apply for a position, interact with us on social networks, or otherwise deal with us.
KITRO provides a food-waste management service that combines on-site IoT devices, AWS-hosted cloud processing, analytics, reporting, dashboard access, support and related operational services. Depending on the context, KITRO may process personal data as a controller or as a processor on behalf of a customer.
This Privacy Notice applies to processing for which KITRO acts as controller. Where KITRO processes personal data on behalf of a customer, for example to provide dashboard access and food-waste analytics to that customer, the customer will generally be the controller and KITRO will process the data under the applicable agreement and data processing agreement. In those cases, the customer is generally responsible for informing its users, employees and other data subjects about the processing.
When appropriate, we may provide additional or just-in-time notices for specific processing activities not described in this Privacy Notice, for example in forms, terms and conditions, consent notices, contracts or product notices.
If you disclose data to us or share data with us about other individuals, such as co-workers, customer contacts or other third parties, we assume that you are authorized to do so and that the relevant data is accurate. Please make sure that these individuals have been informed about this Privacy Notice where required.
This Privacy Notice is intended to be aligned with the EU General Data Protection Regulation («GDPR») and the Swiss Federal Act on Data Protection («FADP»). The application of these and other data protection laws depends on each individual case.
2. Who is the controller for processing your data?
Unless we tell you otherwise in an individual case, the controller for processing under this Privacy Notice is:
KITRO SA
EPFL Innovation Park, Bâtiment C
1015 Lausanne, Switzerland
info@kitro.ch
You may contact us at the above address for data protection concerns and to exercise your rights under Section 11.
We have appointed the following additional positions:
Data Protection Representative in the EU according to article 27 GDPR:
ElevenEleven d.o.o.
Dobri dol 65
10000 Zagreb, Croatia
info@kitro.ch
You may also contact the EU representative for privacy concerns relating to the GDPR.
3. What data do we process?
We process different categories of data depending on your relationship with us. The main categories are the following:
Technical data: When you use our website, dashboard or other online services, we collect technical data such as IP address, browser and device information, operating system, language settings, timestamps, URLs accessed, session identifiers, authentication events, error logs and security logs. We process this data to operate, secure, trouble- shoot and improve our online services. Identifiable technical data is generally retained only as long as necessary for these purposes, usually up to 6 months unless a longer period is needed for security, evidence, legal or contractual reasons. Operational logs may be anonymized and retained for longer periods.
Registration and account data: If you use login areas such as the KITRO dashboard, we process data needed to create, manage and secure your account, such as your name, business email address, phone number, role or position, company affiliation, username, customer or tenant assignment, permissions, authentication identifiers and account status. Customer dashboard accounts are generally maintained for the duration of the customer relationship and are deactivated within 30 days after contract end upon valid customer instruction, unless a different retention obligation applies.
Communication and support data: When you contact us by email, phone, contact form, chat, support ticket, video conference, letter or similar means, we process the data exchanged between you and us, including contact details, message content, attachments and communication metadata. If we record calls or video conferences, for example for training, quality assurance or documentation, we will inform you where required. Business communications and support records may be retained for as long as needed for follow-up, service delivery, evidence, legal or contractual obligations, usually up to 10 years for business records.
Master and business-contact data: We process basic information needed for business relationships, marketing, contracting and administration, such as name, business contact details, role or function, company, business address, billing or shipping address, customer history, preferences, declarations of consent, authorizations and similar information. We may receive this data from you, from the organization you work for, from contractual partners, from public sources or from third-party business-information providers. We generally retain master and business-contact data for up to 10 years from the last relevant interaction or contract end, unless a shorter or longer period applies.
Contract, billing and logistics data: We process data relating to contracts, orders, proposals, service delivery, invoices, payments, shipments, device logistics, customer re- quests, complaints, feedback and similar matters. We generally retain this data for up to 10 years from the last contract activity or contract end, unless a longer period is required for evidence, tax, accounting or legal purposes.
KITRO service and product data: The KITRO service may process food-waste raw data, food-waste images, weight/event data, device identifiers, timestamps, classification outputs, analytics and aggregated food-waste insights. This data is usually not intended to identify individuals. However, depending on customer site setup and usage, images, free-text fields, support messages or uploaded files may incidentally contain personal data. Food-waste raw data, images, associated weight data, aggregated insights and operational logs may be anonymized and retained for analytics, service improvement, product development and benchmarking. Anonymized data is not personal data if individuals cannot reasonably be re-identified.
Behavioral and preference data: We may process data about how you use our website, dashboard, communications and services, such as pages viewed, clicks, features used, session information, product preferences and communication preferences. For example, Mixpanel may be used for dashboard product analytics and may identify sessions by username or account identifier and track actions such as page changes, clicks and feature usage. We use this data to understand usage, improve our services, support customers and conduct marketing where permitted. We generally delete or anonymize this data when it is no longer needed, usually after no more than 24 months for preference and analytics purposes unless a longer period is justified.
Marketing data: If you subscribe to newsletters, attend events, interact with campaigns or consent to marketing cookies, we process data such as your contact details, communication preferences, consent status, newsletter interactions and event participation. Contacts used only for marketing are generally retained for no more than 2 years from the last meaningful contact unless you remain subscribed, have consented to longer use, or another retention reason applies.
Other data: We may process other data depending on the situation, for example data relating to events, photographs or videos, visitor records, access to our premises, legal proceedings, compliance matters, shareholder or investor relationships, recruitment, or security incidents. The retention period depends on the purpose and applicable legal requirements and is limited to what is necessary.
Much of the data described above is provided to us by you, by the organization you work for, by our customers or contractual partners, or through your use of our website, dashboard and services. You are generally not obliged to provide data to us, but if you wish to use our services, communicate with us, enter into a contract or access restricted systems, certain data is necessary.
As far as it is lawful, we may also collect data from public sources or receive data from other companies, public authorities, contractual partners, service providers, internet analytics providers and other third parties.
4. For what purposes do we process your data?
We process your data for the following purposes:
to communicate with you, respond to inquiries, process requests and manage the exercise of data protection rights;
to prepare, conclude, administer and perform contracts and business relationships;
to provide, operate, maintain, secure and support KITRO products and services, including IoT device operation, food-waste measurement, analytics, dashboard access, reporting, logistics and customer support;
to create and manage user accounts, authenticate users, assign permissions and prevent unauthorized access;
to monitor, troubleshoot, protect and improve our website, dashboard, infrastructure and services;
to analyze usage, improve the product, develop new or improved features, conduct market research and generate statistics and benchmarks, including with anonymized or aggregated data;
to send newsletters, invitations, product updates and other marketing communications where permitted, and to manage customer relationships;
to comply with legal, regulatory, accounting, tax, audit and contractual obligations;
to manage risks, enforce or defend legal claims, prevent misuse, investigate incidents and protect our rights, users, customers and systems;
to organize internal processes, corporate governance, training, quality assurance and administration.
5. On what basis do we process your data?
Where we ask for your consent for certain processing activities, for example for certain marketing communications, non-essential cookies, analytics or processing of sensitive data, you may withdraw your consent at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
Where we do not ask for consent, we generally process personal data because the processing is necessary to initiate or perform a contract with you or the organization you represent, to comply with legal obligations, or to pursue our legitimate interests or those of third parties. Our legitimate interests include service delivery, security, fraud and misuse prevention, documentation, product improvement, marketing of our own products and services, business administration and efficient operation of our company.
Where we process sensitive personal data, we do so only where we have an appropriate legal basis, for example your explicit consent, a legal obligation, the establishment, exercise or defense of legal claims, or another basis permitted by applicable law. We do not intentionally collect sensitive personal data through the KITRO service unless separately agreed or required in a specific context.
6. What applies in case of profiling and automated individual decisions?
We may evaluate technical, behavioral, preference, communication and contract data to understand how our website and services are used, to improve our products, to support customers, to detect misuse or security risks, and to tailor communications and offers. This may include creating usage or customer profiles for analytics, support, marketing or operational planning.
We do not currently make automated individual decisions that have legal effects concerning you or that similarly significantly affect you. If we introduce such processing, we will inform you separately where required.
7. With whom do we share your data?
In relation to our contracts, website, dashboard, services, products, legal obligations, legitimate interests and the other purposes set out in Section 4, we may disclose personal data to the following categories of recipients:
Service providers: We work with service providers in Switzerland and abroad who process data on our behalf, as independent controllers or, in certain cases, as joint controllers. These may include cloud hosting, authentication, analytics, CRM, support, collabo- ration, email, logistics, accounting, payment, legal, marketing and website providers. Key IT and service providers may include AWS, Mixpanel, HubSpot, Atlassian, Google Work- space, Odoo and other content-delivery or technical providers, depending on the processing context.
Customers and contractual partners: If you work for one of our customers or contractual partners, we may disclose data relating to your role, account, support requests, service usage or communication with us to that organization where this is necessary for the contract, support, administration, security or compliance. Customers may also receive service data, reports and analytics generated through their use of the KITRO service.
Authorities, courts and public bodies: We may disclose personal data to agencies, courts and other authorities in Switzerland or abroad if we are legally obliged or entitled to do so, or if disclosure is necessary to protect our interests or the interests of others.
Professional advisors and other recipients: We may disclose data to lawyers, auditors, insurers, banks, investors, business partners, event partners, media, associations or other persons where necessary for the purposes described in this Privacy Notice.
Where third parties process data as independent controllers, their own privacy notices and practices apply. Where they process data on our behalf, we require appropriate contractual and technical safeguards as required by applicable law.
We may also enable certain third parties to collect data directly through our website or social media pages, for example analytics, marketing, embedded-content or social-media providers. Where we do not control such processing, those providers are responsible for their own processing.
8. Is your personal data disclosed abroad?
As explained in Section 7, recipients of personal data may be located outside Switzerland and the European Economic Area, in particular in the United States and other countries where our service providers or their subprocessors operate.
Where data is transferred to a country that does not have an adequate level of data protection according to the competent Swiss or EU authorities, we use appropriate safeguards, such as the European Commission Standard Contractual Clauses with Swiss adaptations where required, recognized adequacy decisions, Data Privacy Framework certifications for certified U.S. recipients where applicable, binding corporate rules or other legally recognized safeguards. In some cases, we may rely on statutory exceptions, for example where you have consented, where disclosure is necessary for contract performance, legal proceedings or overriding public interests, or where you have made the data generally available and have not objected.
Please note that data exchanged via the internet may be routed through third countries even if the sender and recipient are in the same country.
9. How long do we process your data?
We process personal data for as long as necessary for the relevant processing purposes, for legal retention periods, for legitimate documentation and evidence interests, or where storage is technically required. If there are no contrary legal or contractual obligations, we delete or anonymize personal data once the relevant retention period has expired.
Typical retention periods are described in Section 3. In particular, business and contract records are generally retained for up to 10 years; identifiable website technical data is generally retained for up to 6 months; dashboard accounts are generally deactivated within 30 days after the end of the relevant customer contract upon valid customer instruction; personal contact data in CRM, support and operational tools may be deleted within 30 days upon valid request after contract end unless retention is required; and marketing-only contacts are generally retained for no more than 2 years from the last meaningful contact unless another basis applies.
Food-waste raw data, food-waste images, associated weight/event data, aggregated food- waste data and logs may be anonymized and retained for analytics, benchmarking, service improvement and product development. Once data has been anonymized so that individuals cannot reasonably be re-identified, it is no longer treated as personal data.
Backups are retained according to our backup cycles and may not be immediately overwritten when data is deleted from production systems. We restrict access to backups and delete or overwrite backup data according to the applicable backup cycle.
10. How do we protect your data?
We take appropriate technical and organizational measures to maintain the security, confidentiality, integrity and availability of personal data and to protect it against unauthorized or unlawful processing, accidental loss, alteration, unauthorized disclosure or access.
For the KITRO service, measures include AWS-hosted infrastructure in the eu-central-1 region for the main solution, TLS encryption for web and API traffic, encryption at rest for RDS and S3 resources using AWS-managed keys, logical customer separation at application level, role-based access control, least-privilege access, logging and monitoring, backup mechanisms, incident response processes, subprocessor management and internal confidentiality obligations. More details may be provided in KITRO’s Technical and Organisational Measures document where applicable.
No method of transmission or storage is completely secure. We therefore continuously review and adapt our measures based on the nature of the data, processing risks, available technology and contractual or legal requirements.
11. What are your rights?
Applicable data protection laws grant you the right to object to the processing of your data in some circumstances, in particular for direct marketing purposes, for profiling carried out for direct marketing purposes and for other legitimate interests in processing.
Depending on the applicable data protection law and the specific circumstances, you may have the following rights in relation to our processing of your personal data:
the right to request information about whether and what personal data we process about you;
the right to have inaccurate or incomplete data corrected;
the right to request deletion of personal data;
the right to request restriction of processing;
the right to object to processing, in particular for direct marketing and, where applicable, profiling for direct marketing;
the right to receive certain personal data in a commonly used electronic format or to request its transfer to another controller;
the right to withdraw consent where processing is based on consent;
the right to receive further information that is helpful for the exercise of these rights.
If you wish to exercise these rights in relation to processing for which KITRO is the controller, please contact us using the details in Section 2. To prevent misuse, we may need to verify your identity.
If your request concerns processing that KITRO carries out on behalf of a customer as processor, we may forward your request to the relevant customer or ask you to contact that customer directly, unless applicable law requires otherwise.
Please note that these rights are subject to conditions, exceptions and restrictions under applicable data protection law, for example to protect third parties, trade secrets, legal obligations or legitimate retention interests. We will inform you where applicable.
If you do not agree with the way we handle your rights or with our data protection practices, please contact us first. You may also lodge a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In the EEA or United Kingdom, you may contact the competent data protection authority in your country.
You can find a list of authorities in the EEA here: https://edpb.europa.eu/about-edpb/board/members_en
You can reach the UK supervisory authority here: https://ico.org.uk/global/contact-us/
You can reach the Swiss supervisory authority here: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html
12. Do we use online tracking and online advertising techniques?
We use cookies and similar technologies on our website, dashboard and online services. These technologies allow us and third parties engaged by us to recognize your browser or device, provide required functionality, secure sessions, remember settings, analyze usage and, where permitted, personalize content or advertising.
Depending on the purpose and legal requirements, we may ask for your consent before non-essential cookies or similar technologies are used. You can withdraw consent or change preferences through the cookie settings where available. You can also configure your browser to block or delete cookies, although some parts of the website or dashboard may then not work properly.
We distinguish the following categories of cookies and similar technologies:
Necessary cookies and technologies: These are required for basic functionality, security, login sessions, forms, consent preferences, load balancing and similar technical purposes. They are usually session cookies or have a limited expiration period.
Performance and analytics cookies: These help us understand how our website and services are used, measure performance, identify errors, improve features and generate statistics. We may use analytics tools such as Google Analytics, HubSpot analytics and Mixpanel, depending on the context.
Marketing cookies and pixels: Where enabled and permitted, we may use marketing tools to measure campaigns, display relevant advertising, build audiences and reduce irrelevant advertising. This may include tools from Google, LinkedIn, Meta or similar providers, depending on our current marketing setup and your consent.
Embedded content and third-party services: We may integrate content or services from third parties, such as videos, maps, social media content, translation tools, forms, chat or content-delivery networks. These providers may receive technical data and process it as independent controllers or processors depending on the service.
The current providers may vary over time and by website or service. Depending on configuration, they may include Google Analytics, Google Tag Manager, Google Ads, HubSpot, LinkedIn Services, Meta services, Webflow, Weglot, Mixpanel, AWS CloudFront and jsDelivr. More detailed information may be provided in our cookie banner or cookie settings where available.
Google Analytics: Where used, Google Analytics helps us understand how visitors use our website. We configure analytics tools to limit data collection where feasible, for example through IP truncation or similar privacy settings, and use them subject to consent where required. Google may process data in the United States or other countries according to its own terms and privacy information.
Dashboard analytics: For product analytics in the KITRO dashboard, we may use tools such as Mixpanel to record session and usage information, including username or account identifier, pages viewed, clicks, feature usage and standard session metadata. We use this information to improve the dashboard, support users, troubleshoot issues and understand product usage.
13. What data do we process on our social network pages?
We may operate pages, profiles or channels on social networks and other third-party platforms. When you interact with us through these platforms, for example by visiting our page, commenting, sharing content or sending messages, we may receive and process data about you as described in Section 3.
The platform operators also process data for their own purposes, such as providing the platform, analytics, marketing, market research and personalization. They generally act as independent controllers for their own processing. We usually receive only aggregated statistics for page insights, but may see public profile information and interactions depending on your settings and the platform.
We process social network data for communication, marketing, community management, market research and improvement of our services. The legal basis is described in Section 5.
We currently use or may use the following platforms:
Facebook: www.facebook.com/KITROFoodWaste/. The platform is operated for European users by Meta Platforms Ireland Limited, Dublin, Ireland. Meta’s privacy information applies to its processing.
LinkedIn: https://www.linkedin.com/company/kitro/. The platform is operated for European users by LinkedIn Ireland Unlimited Company, Dublin, Ireland. LinkedIn’s privacy information applies to its processing.
Instagram: www.instagram.com/kitro_foodwaste/. The platform is operated for European users by Meta Platforms Ireland Limited, Dublin, Ireland. Meta’s and Instagram’s privacy information applies to their processing.
YouTube: https://www.youtube.com/@kitro412. The platform is operated by Google Ireland Limited, Dublin, Ireland, for European users. Google’s and YouTube’s privacy information applies to their processing.
14. Can we update this Privacy Notice?
This Privacy Notice is not part of a contract with you. We may change it at any time. The version published on our website is the current version.
Last updated: July 9, 2026