Privacy policy

Who controls your data

The controller of the personal data collected on this site and throughout the service is 3XA ECOM LLC, whose registered address is 407 Lincoln Rd STE 708, Miami Beach, FL 33139, United States. KodiakBase is the trade name under which 3XA ECOM LLC provides that service.

For anything to do with your data — exercising your rights included — write to hola@kodiakbase.com. We answer through the same channel, and there is no intermediate form to fill in.

What we collect

Only what is needed to form and maintain your company. We buy no lists, we enrich no profiles from outside sources, and nothing here is collected just in case.

• Identification data: full name, nationality, date of birth and a copy of your passport or national ID. This is what the state of formation and the Registered Agent require in order to register a member of an LLC.
• Your real address and proof of it: your operating address in your country of residence and a recent utility bill that evidences it. This is the piece that holds the Bank-Ready file together.
• Contact data: email address and, if you give it to us, a phone number.
• Company data: the name you choose, the state of formation, each member's interest and the contents of the forms we file on your behalf.
• Billing data: what the payment provider needs in order to charge the fee and issue the invoice. Full card details are handled in their environment and never reach ours.
• Postal mail received at the business address: envelopes are scanned so you can read them, so their contents — which may include data about you or about third parties — pass through the address provider.
• Server logs: IP address, date and time of the request and user agent. The server records these in order to work at all and to spot abuse.

What we use it for

The data above is used to deliver the service you contract and to meet the obligations that come with it. Nothing else.

We do not use it for advertising, we build no commercial profiles, and we take no automated decisions producing legal effects concerning you. The specific purposes are these:

• Forming the company in the state you choose and maintaining the Registered Agent for twelve months.
• Applying for the EIN before the IRS on Form SS-4 and handing you the CP 575 letter.
• Setting up and running the business address, including scanning the mail that arrives there.
• Preparing and submitting the annual filings included in the fee, and warning you of their deadlines.
• Charging the annual fee and issuing the corresponding invoice.
• Answering your questions and keeping a record of what was agreed with you.
• Keeping the service available and protecting it from abusive use.

The legal basis for each use

Every processing operation rests on one of the grounds in Article 6 of Regulation (EU) 2016/679:

Performance of the contract (Art. 6(1)(b))

Forming the company, applying for the EIN, running the business address, submitting the included filings and charging the fee. Without this data the service cannot be delivered.

Legal obligation (Art. 6(1)(c))

Keeping commercial and tax records for the periods applicable law requires, and responding to a request from a competent authority.

Legitimate interest (Art. 6(1)(f))

Keeping the service available, preventing fraud, and retaining the correspondence that evidences what was agreed. You can object at any time by writing to hola@kodiakbase.com.

Consent (Art. 6(1)(a))

Only where you write to us on your own initiative about something outside the contracted service. It can be withdrawn at any time, and withdrawing it does not affect what was processed beforehand.

Who else is involved

Forming a company in the United States is not the work of a single firm. These are the providers involved, what each of them does and what data they receive. All of them act as processors on behalf of 3XA ECOM LLC, and none may use your data for their own purposes.

The list lives here, not in a separate annex: if a provider changes, this page changes.

CorpNet

Files the formation with the state and acts as Registered Agent. Receives your identification data and the company's. United States.

Innbocks

Provides the business address and digitises the postal mail that arrives there. Receives your identification data, the Form 1583 and the contents of the envelopes. United States.

mFax (Phaxio)

Faxes the Form SS-4 to the IRS, which is how an applicant without an SSN requests the EIN. Receives that form, carrying your identification data and the company's. United States.

Stripe

Processes payment of the fee. Receives billing data; full card details are handled in their environment. United States and Ireland.

Hetzner

Hosts the site and KodiakBase's internal systems. Germany, inside the European Union.

Transfers to the United States

Three of those providers — CorpNet, Innbocks and mFax — are in the United States and cannot be anywhere else: the Registered Agent has to be an agent based in the state of formation, the business address has to be a US address, and the Form SS-4 goes to the IRS. Contracting the service necessarily means your identification data leaves the European Economic Area.

For those transfers we rely on the Standard Contractual Clauses approved by the European Commission. Beyond them, the transfer is also necessary for the performance of the contract you yourself request, in the terms of Article 49(1)(b) of the Regulation: there is no way to form a US LLC without sending data to the United States.

If that is not acceptable to you, the consequence is that we cannot provide the service. We would rather write it here than leave it in a line nobody reads.

How long we keep it

For as long as the contractual relationship lasts and, afterwards, blocked for the periods that applicable commercial and tax law requires. Blocked means it stops being used and remains available only to courts, tribunals and competent authorities.

Once those periods expire it is deleted. What the state of formation or the IRS keep on their own side is beyond our reach: the Articles of Organization are a public record and we cannot erase them for you.

Security

KodiakBase's systems are hosted in the European Union, traffic is encrypted in transit, and access to a client's documentation is limited to whoever needs it to handle that file.

We do not promise nothing can ever go wrong, because nobody can promise that. What we do commit to is telling you plainly if a breach affects your data, and notifying the supervisory authority where required.

Your rights

You can exercise the rights granted by Articles 15 to 22 of the Regulation at any time. Write to hola@kodiakbase.com from the address you contracted with; if we cannot identify you with confidence, we will ask for something further before answering.

Exercising them is free, and we answer within one month of receiving the request.

• Access: to know what data of yours we process and to obtain a copy.
• Rectification: to correct data that is inaccurate or incomplete.
• Erasure: to have data deleted once it is no longer needed for the purposes it was collected for.
• Restriction: to have data kept but no longer used while a disagreement is resolved.
• Portability: to receive in machine-readable form the data you gave us, or to have us send it directly to another controller.
• Objection: to object to the processing that rests on legitimate interest.
• Automated decisions: there are none in this service, and the right not to be subject to them remains yours.
• Withdrawal of consent: where processing rests on it, without affecting what was processed before withdrawal.

Complaining to a supervisory authority

If you believe we have handled your data improperly, you can lodge a complaint with a supervisory authority. In Spain that is the Agencia Española de Protección de Datos, at aepd.es; if you live in another Member State, with the authority in your country.

You do not have to write to us first: the complaint is not conditional on any prior step. Even so, writing to hola@kodiakbase.com is usually a good deal faster.

Changes to this policy

If this policy changes, the date in the heading changes with it and the new version is published at this same address.

Where the change is material — a new provider, a new purpose, a different legal basis — we email you before it takes effect. A silent change to a privacy policy is not a change of wording: it is a change of terms.