Privacy Center

Keplor Limited ("Keplor", "we", "our", or "us") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you access or use the Keplor platform, our website (keplor.io), and any associated services (collectively, the "Services").

Keplor is a deal advisory and development platform for renewable project finance. Our Services are designed for institutional investors, fund managers, project developers, sponsors, and other professional participants in the infrastructure and energy sectors.

If you have any questions, you may contact our Privacy Officer at privacy@keplor.io.

For the purposes of the UK GDPR and EU GDPR, the data controller is:

Keplor Limited
20 Eastbourne Terrace
London W2 6LG
United Kingdom
Privacy Officer: privacy@keplor.io

Where Keplor processes personal data on behalf of an enterprise customer, Keplor acts as a data processor, governed by our Data Processing Agreement ("DPA").

3.1 Data You Provide Directly

• Account Registration: Full name, email address, organisation name, and job title or role.
• Profile Information: Telephone number, professional biography, or profile photograph.
• Project and Deal Data: Information relating to infrastructure projects, assets, deals, financial models, and other professional documentation.
• Communications Data: Email communications and meeting transcripts you explicitly authorise via integrations.
• Correspondence: Messages, feedback, support requests, or other communications sent to us.

3.2 Data Collected Automatically

• Usage Analytics: Pages visited, features used, session duration, click patterns, and navigation paths.
• Device and Technical Data: IP address, browser type, operating system, device identifiers, screen resolution, and language preferences.
• Cookies: See our Cookie Policy for full details.
• Log Data: Access times, referring URLs, and error logs.

3.3 Data We Do Not Collect

• Passwords (managed via secure third-party identity providers)
• Payment card numbers or bank account details
• Special category data (unless incidentally contained in uploaded documents)
• Data from children under 18

Service Delivery: Account management, authentication, platform access, data processing, analytical outputs, and collaboration.

Communications: Responding to enquiries, service-related notifications, and marketing communications (with your consent).

Analytics: Understanding usage patterns, improving functionality, developing new features, and monitoring performance.

Security: Detecting fraud and abuse, enforcing our Terms of Service, and complying with applicable laws.

Keplor does not sell, rent, or trade your personal data. We share data only as necessary with carefully selected sub-processors:

We may also share data where required by law, to protect rights and safety, in connection with business transfers, or with your explicit consent.

Your personal data is stored by default in Google Cloud Platform's Europe West 2 region (London, UK). Where we transfer data outside the UK or EEA, we ensure appropriate safeguards including:

• Adequacy Decisions by the UK Secretary of State or European Commission
• UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses
• Supplementary measures including encryption, pseudonymisation, and access controls

Technical Measures:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Row-Level Security ensuring each user can only access authorised data
• Dedicated infrastructure option for Enterprise customers
• Role-based access controls and multi-factor authentication
• Comprehensive audit logs and automated monitoring

Organisational Measures:

• All personnel bound by confidentiality obligations
• Regular security assessments and vulnerability testing
• Incident response plan with 72-hour breach notification

Under the UK GDPR and EU GDPR, you have the following rights:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Request correction of inaccurate data
• Erasure (Art. 17): Request deletion of your data
• Restriction (Art. 18): Request restricted processing
• Data Portability (Art. 20): Receive data in machine-readable format
• Object (Art. 21): Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

To exercise your rights, contact privacy@keplor.io. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Our website and platform use cookies and similar technologies to enhance your experience, analyse usage, and deliver relevant content. For full details, please refer to our Cookie Policy, available in our Legal Center.

You can manage your cookie preferences at any time through the cookie settings link in our footer, or through your browser settings.

Our Services are not directed at individuals under 18. We do not knowingly collect personal data from children. If we become aware of such collection, we will promptly delete the data. Contact our Privacy Officer if you believe a child has provided us with personal data.

California Residents (CCPA/CPRA): You may have additional rights including the right to know, right to delete, and right to opt-out of sale (Keplor does not sell personal information). Contact privacy@keplor.io to exercise your California privacy rights.

EEA Users: You benefit from EU GDPR protections. Exercise your rights as described in Section 10.

US Users: Data is stored by default in the UK. All users receive the data protection rights described in Section 10 regardless of location.

Enterprise customers may require a Data Processing Agreement ("DPA") covering scope, purpose, sub-processor management, data breach notification, audit rights, and data return upon termination. To request a DPA, contact privacy@keplor.io.

We may update this Privacy Policy from time to time. We will notify registered users of material changes at least 30 days before they take effect and post a prominent notice on our website. Your continued use after the effective date constitutes acceptance.

Privacy Officer
Keplor Limited
20 Eastbourne Terrace
London W2 6LG
United Kingdom
Email: privacy@keplor.io