KiwiCloud Privacy Policy

KiwiCloud PTE. LTD. (“KiwiCloud” , “we” , “us” or “our”) is committed to protecting the privacy and security of the data generated and managed by the KiwiCloud UEM platform (the “Services”). This Privacy Policy explains (1) what data we collect, (2) how we use, store, and share it, and (3) the rights and choices available to you. This policy applies only to device-generated data processed through the Services and does not cover any personal data collected outside the Services or by third-party sites.

1. Data we collect
  • Device Metadata
  • Unique identifiers (e.g., serial number, MAC address, IMEI)
  • Device model, OS version, patch level
  • Operational status (online/offline), battery level, storage usage
  • Configuration & App Data
  • Installed application details (name, version)
  • Security and compliance configuration logs
  • Remote command history (e.g., reboot, lock, wipe)
  • Performance & Analytics
  • Resource utilization (CPU, memory)
  • Network traffic and connectivity logs
  • Aggregated metrics for dashboards and reports

Note: We do not collect personal user data (e.g., names, email addresses, personal documents, GPS location).

2. How we use your data

We process device data for the following legitimate business purposes:

    • Service Delivery & Improvement
    • Monitor device health and diagnose issues
    • Develop new features and optimize performance
    • Security & Compliance
    • Enforce your organization’s security policies
    • Detect and respond to threats
    • Reporting & Analytics
    • Populate real-time and historical dashboards
    • Generate usage trends and operational insights
    • Legal & Regulatory Requirements
    • Fulfill contractual and legal obligations
3. Legal basis & regulatory compliance

EU GDPR

Lawful Basis: Art. 6(1)(f) – processing is necessary for our legitimate interests in providing and improving device-management services, balanced against your rights.

Data Subject Rights: Access, rectification, erasure, and restriction of processing. Contact us (see Section 13) to exercise your rights.

California CCPA/CPRA

Our processing of device data typically falls outside the definition of “personal information” under CCPA, but if you believe any data we hold is subject to CCPA, please contact us.

4. Data storage & retention

Storage Locations: Secure cloud servers in multiple global regions. All in-transit and at-rest data are encrypted.

Retention Period: By default, we retain device data for 24 months. Customers may request extensions for compliance or audit purposes.

Deletion: After the retention period, data are permanently deleted. You may also request immediate deletion via your admin console or by contacting us.

5. Data security measures

Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest.

Access Controls: Role-based access (RBAC) and strong password policies.

Account Protection: Support for multi-factor authentication (2FA) and single sign-on (SSO).

Monitoring & Audit: Real-time security event detection and comprehensive logging.

6. Third-party service providers

We may engage trusted subprocessors (e.g., cloud hosting, security audit firms) to perform services on our behalf. They are contractually bound to use device data only to provide those services and to maintain equivalent privacy and security standards.

We may disclose device data if required by law, regulation, or valid legal process (e.g., court order, government request).

7. Your rights & choices

Access & Correction: Administrators can view and correct device data via the UEM console.

Deletion Requests: Submit deletion or export requests through your admin console or by emailing us.

Policy Withdrawal: If you object to our processing, you may stop using the Services; upon request, we will delete all device data (unless retention is legally required).

8. Children's privacy

Our Services are not directed to children under 13. We do not knowingly collect personal data from minors. If you believe we have collected such data, please contact us for removal.

9. Cookies & similar technologies

Our web console may use cookies or local storage for session management, security, and performance. These technologies are not used to track you across third-party sites. You may disable them via your browser settings, but some functionality may be impacted.

10. International data transfers

Where device data is transferred outside Singapore (e.g., to EU or US data centers), we rely on appropriate safeguards such as Standard Contractual Clauses under GDPR to ensure lawful cross-border transfers.

11. Updates to this policy

We may update this Privacy Policy periodically. We will post the revised version at https://kiwi.cloud/privacy with a new “Effective Date”. For material changes, we will also provide notice via the platform or email.

12. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your device data, please contact: contact@kiwi.cloud