Privacy Policy

1. Introduction and Scope

This Policy has been prepared with regard to the Israeli Protection of Privacy Law, 5741-1981 (the "PPL"), and the regulations enacted under it — including the Protection of Privacy Regulations (Data Security), 5777-2017, and the changes introduced by Amendment No. 13 to the PPL — as well as, where applicable to visitors from the European Economic Area ("EEA") or the United Kingdom, the EU General Data Protection Regulation ("GDPR") and the UK GDPR.

This Policy applies to personal information we collect through the Site, and through email, phone, or WhatsApp communications you initiate with us. It does not apply to information we process for clients under separate service agreements, which is governed by those agreements, and it does not apply to third-party websites linked from the Site.

By using the Site or providing us with personal information, you acknowledge this Policy. Where consent is the applicable legal basis, providing your information after being presented with this Policy constitutes your informed consent under the PPL to the processing described here. You are not under any legal obligation to provide us with personal information; doing so depends on your own free will and consent.

2. Who We Are (Controller / Database Owner)

For the purposes of the PPL, Kaligon is the owner and controller of the database(s) in which the personal information described in this Policy is held. For the purposes of the GDPR, Kaligon is the "data controller" of that personal information.

Our privacy contact is Shlomo Hayun (hello@kaligon.com). You can reach us regarding any privacy matter at hello@kaligon.com.

3. Information We Collect

a. Information you provide to us

• Direct communications: the Site carries no contact form. If you contact us by email (hello@kaligon.com), phone, or WhatsApp (+1 (347) 837-7382) — the channel every "Start a project" link on the Site opens — we collect the contact details you use and the content of your communications with us.
• Business relationships: if you explore or enter into a business relationship with us, we may collect additional professional information you provide, such as your role, organization, and project requirements.

b. Information collected automatically

• Server logs: the Site is served from infrastructure Kaligon operates itself. Its web server keeps standard access logs, which record your IP address, the page or file requested, the date and time, the HTTP status, your browser's user-agent string, and the referring URL where your browser sends one. These logs exist to operate and secure the Site.
• No cookies, no analytics, no third-party scripts: the Site sets no cookies, uses no local or session storage, and loads no analytics, advertising, tracking, or other third-party script. There is nothing to opt out of, and no consent banner, because there is no non-essential processing in the browser to consent to. Fonts, images, 3D models and video are served from the Site's own domain.

We do not intentionally collect special categories of personal data (such as health, biometric, or political information) or "information of special sensitivity" as defined under the PPL, and we ask that you do not send such information to us through the channels above.

4. Purposes and Legal Bases for Processing

We process personal information for the following purposes:

• to respond to your inquiries and to communicate with you about our services;
• to evaluate, establish, and manage business relationships, including preparing proposals and negotiating engagements;
• to operate, maintain, and secure the Site, including diagnosing faults and investigating abuse;
• to send you informational communications where permitted by law, and subject to your right to opt out at any time (including under Section 17F of the PPL regarding direct-mailing services);
• to comply with legal obligations applicable to us, and to establish, exercise, or defend legal claims; and
• to prevent fraud, abuse, or security incidents affecting the Site or our systems.

Under the PPL, we process personal information on the basis of your informed consent and for the purposes for which the relevant database is maintained, in accordance with the duty of notification under Section 11 of the PPL: you are not legally required to provide us with information; the information you provide will be used for the purposes listed above; and it may be transferred to the recipients described in Section 6 of this Policy. If you choose not to provide certain information, we may be unable to respond to your inquiry or provide the relevant service.

Where the GDPR or UK GDPR applies, our legal bases are: (a) your consent (Article 6(1)(a)), for example for informational communications; (b) performance of a contract or steps taken at your request prior to entering into a contract (Article 6(1)(b)); (c) compliance with legal obligations (Article 6(1)(c)); and (d) our legitimate interests (Article 6(1)(f)), such as operating and securing the Site and developing our business, where those interests are not overridden by your rights and freedoms.

5. Cookies and Tracking

The Site sets no cookies and runs no analytics. It is a set of static files served from Kaligon's own infrastructure. It does not use cookies, local storage or session storage; it does not load Google Analytics or any other analytics, measurement, advertising or tracking service; and it embeds no third-party script, pixel, tag or social widget. Nothing on the Site profiles you or follows you across other websites.

A previous version of this Site used Google Analytics. It no longer does, and this Policy has been updated to say so rather than to describe processing that does not happen.

The one thing recorded automatically is the web-server access log described in Section 3(b), which is necessary to operate and secure the Site. Outbound links to third-party sites (for example WhatsApp, LinkedIn, Instagram, Facebook, and the websites of projects we have built) are ordinary links: following one takes you to a service with its own privacy practices, described in Section 6 of our Terms.

6. How We Share Information (Recipients and Processors)

We do not sell personal information. We share personal information only as described below:

• Infrastructure: the Site runs on servers Kaligon operates itself, rather than on a third-party website host. Access to those servers is limited to personnel who need it.
• Communications providers: correspondence you send us reaches us through the provider of the channel you chose — your own email provider and ours, your telephone carrier, or WhatsApp (operated by Meta Platforms) if you use the WhatsApp link. Those providers process your message under their own terms and privacy policies, which we do not control.
• Service providers: where we use third-party providers that process personal information on our behalf and under our instructions (acting as "holders" of database data under the PPL and as "processors" under the GDPR), they are bound by contractual obligations regarding confidentiality and data security and may process information only for the purposes we specify.
• Professional advisers: we may share information with our lawyers, accountants, auditors, and insurers where reasonably necessary, subject to confidentiality obligations.
• Legal requirements: we may disclose information where required by law, regulation, court order, or a competent authority, or where reasonably necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Kaligon, our users, or others.
• Corporate transactions: if Kaligon is involved in a merger, acquisition, reorganization, or sale of some or all of its assets, personal information may be transferred as part of that transaction, subject to this Policy or to equivalent protections.

7. International Data Transfers

We are based in Israel, and personal information we collect is processed in Israel. Where you contact us through a communications provider based elsewhere — for example WhatsApp — your message is processed by that provider in the countries where it operates, which may include the United States.

Transfers of personal data from Israel to other countries are made in accordance with the PPL and the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001, including by transferring data to countries that provide an adequate level of protection or subject to appropriate contractual safeguards and the data subject's consent where required.

For visitors from the EEA or the UK: the European Commission has recognized the State of Israel as providing an adequate level of data protection, so transfers of your personal data to us in Israel may be made on the basis of that adequacy decision. Where personal data is transferred onward from Israel or the EEA to countries without an adequacy decision (such as the United States), we rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework (where the recipient is certified) or standard contractual clauses approved by the European Commission.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, and afterwards as required or permitted by applicable law. In determining retention periods, we consider the nature and sensitivity of the information, the purposes for which we process it, applicable limitation periods for legal claims, and legal, accounting, and reporting requirements.

As a general guideline, correspondence with you is retained for as long as needed to handle your inquiry and any resulting business relationship, and for a reasonable period thereafter for record-keeping and the establishment or defense of legal claims. Web-server access logs are retained for a short period for security and diagnostic purposes and then rotated out. When personal information is no longer needed, we delete it or anonymize it.

9. Your Rights

Under Israeli law

Subject to the conditions and exceptions set out in the PPL and its regulations (as amended, including by Amendment No. 13), you have the right to:

• Access: review information about you held in our databases (Section 13 of the PPL);
• Correction and deletion: request that information about you which is incorrect, incomplete, unclear, or not up to date be corrected or deleted (Section 14 of the PPL);
• Direct mailing: demand in writing that information about you be deleted from a database used for direct-mailing or direct-mailing services, and that you not receive such approaches (Section 17F of the PPL); and
• lodge a complaint with the Israeli Privacy Protection Authority if you believe your rights under the PPL have been infringed.

Under the GDPR / UK GDPR (EEA and UK visitors)

Where the GDPR or UK GDPR applies, you also have the right to: request access to and a copy of your personal data; request rectification of inaccurate data; request erasure of your data ("right to be forgotten"); request restriction of processing; object to processing based on legitimate interests or for direct marketing; receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability); withdraw consent at any time where processing is based on consent (without affecting the lawfulness of processing before withdrawal); and lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of the alleged infringement.

To exercise any of these rights, please contact us at hello@kaligon.com with the subject line "Privacy Request". We may need to verify your identity before acting on your request, and we will respond within the timeframes required by applicable law. Exercising these rights is free of charge, except where applicable law permits a reasonable fee.

10. Data Security

We implement technical, physical, and organizational security measures designed to protect personal information against loss, theft, and unauthorized access, use, disclosure, alteration, or destruction, consistent with the Protection of Privacy Regulations (Data Security), 5777-2017, and industry practice. These measures include access controls, encryption of data in transit (the Site is served over HTTPS only), and limiting access to personal information to personnel and providers who need it for the purposes described in this Policy.

However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will act in accordance with our obligations under applicable law, including notification duties toward the Privacy Protection Authority and affected data subjects where required.

11. Children's Privacy

The Site is intended for a general business audience and is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe that a child has provided us with personal information without appropriate consent, please contact us at hello@kaligon.com and we will take reasonable steps to delete that information.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, in the Site, or in applicable law. The updated Policy will be posted on this page with a revised "Last updated" date. Where required by applicable law — for example, for material changes affecting the purposes of processing — we will provide additional notice or seek renewed consent. We encourage you to review this page periodically.

13. Contact Us

If you have any questions, concerns, or requests regarding this Policy or our handling of personal information, please contact:

• Kaligon Ltd., Eli Horovitz 4, 1st floor, Rehovot, Israel 7608811
• Privacy contact: Shlomo Hayun (hello@kaligon.com)
• Email: hello@kaligon.com
• Phone / WhatsApp: +1 (347) 837-7382
• Website: https://kaligon.com