Utell Identity
Privacy Notice
1. Scope and roles
Utell Identity provides identity, authentication, authorization, and related trust services. The organisation that decides why and how personal data is processed for its own service is responsible for identifying the applicable controller or processor role in its agreement with Kitjimanitou Studios Inc. The role allocation may differ by service, tenant, and processing activity.
2. Information that may be processed
Depending on the enabled service, Utell Identity may process account and profile information, authentication and authorization data, role and claim assignments, administrator actions, device and browser metadata, security events, support information, and credential-related metadata. We do not require more information than is reasonably necessary for the configured service and its security controls.
3. Why information may be processed
- to provide identity, access-control, support, and platform-administration functions;
- to protect accounts, investigate suspicious activity, and maintain service security;
- to comply with contractual, legal, regulatory, and audit obligations;
- to maintain system records, diagnose faults, and improve reliability; and
- to respond to verified requests, complaints, and incident reports.
4. Data-protection framework
Utell Identity is designed for use in Barbados and may also support processing that is subject to the General Data Protection Regulation (GDPR). The applicable legal basis, data-controller details, retention period, and international-transfer safeguards must be established for the relevant tenant and processing activity before production use.
The Barbados Data Protection Commission identifies the Data Protection Act, 2019-29 as the framework governing personal-data processing in Barbados. Where GDPR applies, individuals have rights that include access, rectification, erasure, restriction, objection, and, in relevant circumstances, data portability.
5. Retention
Personal data and security records are retained only for the period set by the applicable service configuration, contract, legal obligation, or documented retention schedule. Retention settings must be reviewed before production activation. Where records are no longer required, they should be securely deleted or anonymised in accordance with the applicable process.
6. Security and access
Access to operational functions should be limited to authorised personnel and protected by role-based access control, audit logging, secure authentication, and environment-specific security controls. Administrators must not share accounts, passwords, recovery material, access tokens, or exported personal data.
7. Data-subject and privacy requests
Requests concerning personal data should be submitted through the applicable tenant or service contact. A request may require identity verification before information is disclosed or changed. For platform privacy matters, contact privacy@utell.me.
8. Complaints and regulatory contact
Individuals in Barbados may also contact the Barbados Data Protection Commission. Where GDPR applies, individuals may have the right to lodge a complaint with the relevant supervisory authority.
9. Changes to this notice
We may update this notice when the platform, applicable legal requirements, or processing arrangements change. The current version is published at this address with its revision date.