Privacy & Data Policy

Last updated: 6 September 2026

1. Who is responsible

Karmiq is operated by ANG Associates (“Karmiq”, “we”, “us”). For questions about this policy or a personal-data request, contact us at karmiq@ang-associates.ch.

When an organisation uses Karmiq to manage its employees, that organisation is normally responsible for deciding why and how its employee data is used. In that relationship, the organisation is the data controller and Karmiq acts on its documented instructions as a service provider/processor.

2. Information we process

Depending on how Karmiq is used, this may include:

• workspace and administrator details, such as name, organisation name, work email and account credentials;
• employee record information entered by a customer, including contact details, department, job title and onboarding status;
• documents uploaded by employees or administrators, and acknowledgements or electronic-signature records;
• service activity, security and audit information, including login events, IP addresses, timestamps and actions taken; and
• sender-connection details needed to deliver employee messages. Mail credentials and OAuth refresh credentials are encrypted before storage.

3. Why we use information

We use information to provide and secure Karmiq, create and administer workspaces, deliver onboarding and signature requests, respond to support requests, prevent misuse, meet legal obligations and improve service reliability. We do not sell personal data or use employee documents for advertising.

4. Legal grounds and customer responsibilities

We process platform-account data to perform our agreement, protect the service and meet applicable legal obligations. Customers are responsible for ensuring they have an appropriate lawful basis, notices and permissions for the employee data they place in Karmiq, including any sensitive information or employment documents.

5. Sharing and international transfers

Access is limited to authorised Karmiq personnel and the customer’s authorised users. We may use carefully selected infrastructure, email-delivery and authentication providers to operate the service, including AWS hosting, a customer-selected email provider and Google where a customer chooses Google Workspace OAuth. These providers may process data in locations outside a customer’s country. We use appropriate contractual, technical and organisational safeguards where required.

6. Security and retention

Karmiq uses HTTPS, role-based access controls, expiring employee links, audit logging and encrypted storage for connected email credentials. No system is completely secure, so customers should use strong passwords, limit user access and notify us promptly of suspected unauthorised use.

We retain personal data for as long as needed to provide the service, meet legal obligations, resolve disputes and enforce agreements. A customer can request deletion or export of its workspace data when ending the service, subject to lawful retention requirements and reasonable backup cycles.

7. Your rights

Subject to applicable law, individuals may have rights to request access, correction, deletion, restriction, objection or portability of their personal data, and to raise a concern with a competent data-protection authority. Employees should normally contact their employer first, because the employer controls their employee record. Karmiq will assist customers with legitimate requests where required.

8. Cookies

Karmiq currently uses an essential, secure session cookie to keep signed-in users authenticated. We do not use advertising cookies or third-party behavioural advertising on the Karmiq website.

9. Changes and contact

We may update this policy as Karmiq develops or legal requirements change. We will publish the updated version here and revise its effective date. Contact karmiq@ang-associates.ch with privacy questions or requests.