Privacy Policy
Updated: 26 September 2026
Controller and contact
Ko-ala is provided by РИСАЙКЪЛ БИМ ЕООД (RISAYKAL BIM EOOD), registration number 205318891, 35 Nishava Street, apartment 1, Krasno selo district, Sofia 1680, Bulgaria. Contact: info@ko-ala.io. The company is controller for accounts, support, security and subscriptions. For personal information in project documents uploaded on behalf of a studio’s clients, the studio determines the purposes; processing on its behalf and the parties’ roles must be addressed in the applicable data processing agreement.
Information processed
Account and sign-in details (name, email, identifier and sign-in method); studio and team details; invited colleagues’ and investors’ emails; projects and property addresses, files, budgets and invoices; comments, approvals, versions and deletion requests; subscription, order and payment information; technical session, IP address and request data. Social sign-in supplies information you authorise through Wix and the chosen provider. A designer may initially supply an invitee’s details.
Purposes and legal bases
Accounts, projects, sharing, approvals and subscriptions are provided to perform a contract or take requested pre-contractual steps (GDPR Article 6(1)(b)). Applicable accounting and other statutory duties rely on Article 6(1)(c). Service protection, abuse prevention, support and legal claims rely on legitimate interests under Article 6(1)(f), balanced against your rights. Remembering language relies on consent under Article 6(1)(a). Cookie consent is not consent to marketing emails.
Recipients and international processing
Project access follows roles and sharing permissions. The owner manages projects; authorised colleagues review, comment and update assigned tasks; investors see content shared with them. Wix provides hosting, authentication, storage and subscription infrastructure. Payments use the provider identified at checkout. Professional advisers and competent authorities may receive information where necessary and lawfully justified. Wix and its providers may process data outside the EEA; Wix describes adequacy decisions and, where applicable, standard contractual clauses and additional safeguards. Contact us for information about applicable safeguards; see the Wix links below.
Retention and deletion
Account and active-project information is kept as needed to provide the service. On closure or an erasure request, we assess continuing contracts, other participants’ rights, statutory retention and legal claims; other data is subject to deletion or anonymisation. Cancelling a subscription does not itself erase an account or project. Removing a file from the interface does not necessarily immediately erase all records or backups. Contact us for a full erasure request. Cookie lifetimes are listed separately.
Your rights
Subject to GDPR conditions, you may request access and a copy, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Consent can be withdrawn at any time without affecting prior lawful processing. Email info@ko-ala.io; proportionate identity verification may be required. We normally respond within one month and explain any legally permitted extension. You may complain to Bulgaria’s Commission for Personal Data Protection or the supervisory authority for your habitual residence, workplace or alleged infringement.
Other information
Required account and payment data is needed for the corresponding service. No solely automated decisions producing legal or similarly significant effects are implemented. The service is intended for adults. Do not upload unnecessary sensitive information. We update this policy when processing changes and seek fresh consent where required.