# Privacy notice · KOKON Control Company · Wave 8 · C7 · 2026-07-13

_This notice describes how KOKON collects, uses, protects, and
allows subjects to control their personal data. It complements
`docs/CONTROLS.md` (technical controls) and `docs/runbook/incident-response.md`
(incident procedure)._

## 1 · Data controller

KOKON Control Company operates the substrate that ingests, analyses,
and audits your case data. Contact points:

- Data Protection Officer (DPO): `dpo@saa-alliance.com`
- Regulator liaison: see `/ui/regulator` "Contact" section

## 2 · What personal data we process

We process only the personal data necessary to run the forensic
and AML case workflows you or your organisation submit to KOKON:

| Category                        | Example                       | Retention               |
| ------------------------------- | ----------------------------- | ----------------------- |
| Identifiers                     | Email, phone, KOKON entity ID | Per class default (365 d for INTERNAL, 730 d for LICENSED_PRIVATE, 2555 d for RESTRICTED_INTERNAL) |
| Transactional metadata          | Amounts, counterparties, dates| Same as above           |
| Audit / access log entries      | Who read what, when            | 7 years (RESTRICTED_INTERNAL) |
| DSR request records             | Subject ID + operation         | Retained as evidence — RESTRICTED_INTERNAL |
| Case run predictions / outcomes | Model verdict + human closure  | Retained on tamper-evident chain |

Everything else — payment card numbers, full statement bodies,
document scans — is stored on the ARIN substrate (separate
control plane) and is NOT persisted in `kokon_control_company`.

## 3 · Legal bases

- **Contract**: processing needed to deliver the case-analysis
  service you or your organisation contracted for.
- **Legitimate interests**: audit integrity + tamper-evident
  logging (regulator baseline).
- **Legal obligation**: AML / KYC recordkeeping where the case
  workflow demands it.
- **Consent**: where explicitly requested (marketing, non-core
  features). Withdrawable at any time.

## 4 · Where your data goes

- **Storage location**: EU (contabo Frankfurt) for the KOKON
  substrate. ARIN Knowledge Brain uses AWS US regions. See
  `docs/CONTROLS.md § Data protection at rest` for encryption
  details.
- **Sub-processors**:
  - Contabo (infra host, EU)
  - AWS via ARIN (US region · KOKON→ARIN gateway is the ONLY sanctioned path)
  - Let's Encrypt (TLS certificates)
- **Transfers outside the EU**: ARIN traffic follows the
  KOKON↔ARIN Wiring Spec. Standard contractual clauses in place
  for the US leg.

## 5 · How we protect it

- **In transit**: TLS 1.2/1.3, HSTS `max-age=31536000`, HTTP/2,
  standard security headers (X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy, Permissions-Policy).
- **At rest** (kokon_control_company): AES-256-GCM app-layer
  encryption for sensitive columns (gov ledger payloads, case
  outcome notes, DSR notes). Wire-prefix `at1:`.
- **Access control**: signed user context + PBAC/ABAC via
  `tool_policy_decision_logs`. Every read decision auditable.
- **Data classification**: 4-tier (PUBLIC / INTERNAL /
  LICENSED_PRIVATE / RESTRICTED_INTERNAL) enforced at SQL layer
  on read paths.
- **Backups**: weekly full backups; monthly restore drills; 8
  weekly snapshots retained (~2 months).
- **Audit**: tamper-evident hash-chained governance ledger
  (`kokon_gov_ledger`) verifiable via `/api/control/audit/gov-verify`.
- **Incident response**: `docs/runbook/incident-response.md`.

## 6 · Your rights

Under GDPR (EEA / UK), CCPA (California), and equivalent regimes:

- **Access / export**: request a full data package via
  `/ui/privacy → Export` or by emailing the DPO.
- **Rectification**: request corrections via the DPO.
- **Erasure ("right to be forgotten")**: `/ui/privacy → Erase`
  or via the DPO. Scrubbed identifiers become `__erased__`;
  audit rows are preserved (as regulator evidence) without
  identifying information.
- **Restriction / objection**: contact the DPO.
- **Portability**: the export package is machine-readable JSON.
- **Withdraw consent**: where consent was the basis, withdrawal
  is immediate; other legal bases may continue to apply.
- **Complain to your regulator**: e.g. ICO (UK), CNIL (FR), your
  national DPA.

Response window: **30 days** from receipt (may extend to 90 for
complex cases; we tell you if we need more time).

Every export and erasure is recorded on the tamper-evident chain
at RESTRICTED_INTERNAL classification so a leaked ledger cannot
reveal that a subject asked.

## 7 · Automated decisions

The KOKON forensic and AML workflows run automated model
predictions (case verdicts) alongside human-in-the-loop review.
No consequential decision (account restriction, refund denial,
regulator escalation) is made purely automatically — a human
operator closes the case with a realised verdict, which is
recorded and audited via Wave 6 · R1-R3.

## 8 · Cookies & tracking

The KOKON UI uses session cookies for authentication only. We
do NOT use tracking cookies, analytics beacons, or third-party
scripts on the operator/regulator surfaces.

## 9 · Retention

See § 2 above. The retention worker (Wave 8 · C3) runs daily and
purges rows past their class retention. Every purge is recorded
on-chain with the counts per class.

## 10 · Changes to this notice

Substantial changes are announced by:

1. Updated version + effective date at the top of this file
2. Notice on `/ui/regulator` under "Contact / notices"
3. Direct email to subjects (where feasible)

Change history is tracked in git (`git log docs/PRIVACY-NOTICE.md`).

## 11 · Contact

- **General**: `dpo@saa-alliance.com`
- **DSR requests**: `/ui/privacy` or the DPO email above
- **Regulator inquiries**: `regulator@saa-alliance.com`
- **Security incidents**: `security@saa-alliance.com` (PGP key
  fingerprint on `/ui/regulator`)

## Effective date

2026-07-13 · v1.0 · initial version accompanying Wave 8 completion.