Home » What Kubernetes Really Costs: A Guide to Kubernetes Cost Optimization and Avoiding Cloud Bill Shock

What Kubernetes Really Costs: A Guide to Kubernetes Cost Optimization and Avoiding Cloud Bill Shock

Kubernetes is a foundational technology in modern DevOps. Its flexibility, scalability, and vendor-neutral open-source model have made it the go-to standard for container orchestration. Organizations benefit from faster deployments, resilient systems, and improved resource efficiency. Yet despite these advantages, FinOps Managers and DevOps teams often struggle with unexpectedly high cloud bills.

The idea that Kubernetes is “free” stems from its open-source nature. While there’s no licensing fee, running Kubernetes in production involves substantial infrastructure and operational costs. Teams moving from simpler platforms like AWS ECS or Elastic Beanstalk often underestimate how much more expensive Kubernetes can be, and fail to plan accordingly.

This blog post explores the real cost of Kubernetes in production. We’ll uncover hidden expenses tied to control plane pricing, overprovisioned worker nodes, security and monitoring tools, and especially the DevOps effort needed to manage it all. We’ll also walk through a case study of a costly ECS-to-EKS migration that highlights the price of complexity without cost controls.

At Naviteq, we believe Kubernetes demands cost-aware design and ongoing financial visibility. Our experts help organizations implement proactive optimization strategies, integrated from the first design sprint and reinforced through regular FinOps reviews.

Kubernetes is open source, but not free

Open-source software like Kubernetes carries no licensing fee, but the cost of running it at scale is far from zero. Production-grade environments introduce layered expenses that add up quickly.

Control plane charges

Most organizations opt for managed Kubernetes services like Amazon EKS, Google GKE, or Azure AKS, rather than self-managing control planes. This decision makes operational sense as Kubernetes control plane upgrades are notoriously complex and risky but it comes with a recurring fee. EKS, for instance, charges approximately $70 per month per cluster for the managed control plane, regardless of workload size.

While $70 monthly might seem not that high, it adds up across environments. A typical enterprise setup with development, staging, and production clusters across multiple regions can easily reach $500-1000 monthly just for control planes before running a single workload.

Worker node pricing (CPU, RAM)

Worker nodes represent the largest cost component, typically accounting for 40% of total Kubernetes spending. These are the virtual machines where your applications actually run, and their sizing directly impacts your cloud bill.

The challenge lies in resource allocation. Unlike traditional VM deployments where you might run one application per instance, Kubernetes encourages dense packing of workloads. However, this efficiency gain is often negated by over-provisioning at the individual container level. Developers, lacking production performance data, tend to request generous CPU and memory allocations “just to be safe.” Without careful capacity planning and right-sizing of nodes, teams often default to larger, more expensive instances than their workloads actually require, leading to significant resource underutilization and wasted expenditure.

A common pattern we observe: web applications requesting 4 vCPUs and 16GB RAM when they actually utilize less than 1 vCPU and 4GB under normal load. THis resource allocation across dozens of microservices leads to significantly more infrastructure than necessary.

Hidden costs from security, observability, DNS

Beyond the core infrastructure, a production-ready Kubernetes cluster needs several crucial add-ons, each with its own cost implications:

      • Security: Implementing robust security measures involves tools for network policies, vulnerability scanning, intrusion detection, and secrets management. Many of these are third-party solutions or managed services with associated pricing.

      • Observability: Gaining insights into your cluster’s health and performance requires comprehensive monitoring, logging, and tracing solutions. Tools like Prometheus, Grafana, ELK stack, or cloud-native alternatives like CloudWatch Logs and Metrics or Azure Monitor incur costs based on data ingestion, retention, and processing. External DNS services, crucial for making your applications accessible, also add to the bill.

      • Networking: While Kubernetes provides its own internal networking, integrating with external services often requires load balancers, ingress controllers, and potentially network policies that can lead to additional charges based on usage and the number of resources.

    DevOps operational overhead (~35%)

    The most underestimated cost of running Kubernetes is the operational overhead. Managing a Kubernetes cluster is significantly more complex than managing traditional VMs or simpler container platforms. It requires specialized skills and a considerable time investment from your DevOps team. This includes tasks such as:

        • Cluster setup and configuration

        • Node provisioning and scaling

        • Applying security patches and upgrades

        • Monitoring cluster health and performance

        • Troubleshooting issues and incidents

        • Managing networking and storage configurations

        • Implementing and maintaining CI/CD pipelines

        • Cost optimization efforts

      One of the most underestimated costs is human capital. Our analysis shows that approximately 35% of total Kubernetes spending relates to operational overhead i.e the DevOps time required for cluster management, patching, upgrades, incident response, and ongoing optimization.

      This operational burden is particularly more in the first year after migration as teams need time to develop expertise and establish best practices. Often it’s a good idea for organizations to hire specialized experts in this field like that from Naviteq who can guide through this process smoothly.

      Real-world case study: ECS to EKS migration doubled costs

      To illustrate the potential for unexpected cost escalation, let’s examine a real-world scenario involving a client who migrated their containerized application from AWS Elastic Container Service (ECS) to Amazon EKS. This company needed to migrate from Amazon ECS to EKS to meet AWS Marketplace requirements for Helm-packaged applications.

      Client motivation: AWS Marketplace compliance

      The primary driver for the migration was the client’s need to list their application on the AWS Marketplace, which required their software to be packaged and deployable using Helm charts, a capability not natively supported by ECS at the time.

      Shift to microservices increased infra load

      As part of the migration to Kubernetes, the client also transitioned their monolithic application into a microservices architecture. While this offered benefits in terms of scalability and maintainability, it inherently increased the number of individual containerized services and the overall infrastructure footprint.

      The migration coincided with a broader microservices transformation. What had been a single, workaround type ECS service became multiple Kubernetes deployments, each with individual resource requirements and overhead.

      The microservices pattern, while offering architectural benefits, introduced significant infrastructure overhead:

          • Multiple ingress points requiring separate load balancer allocation

          • Individual service scaling parameters leading to resource fragmentation

          • Increased inter-service communication creating additional network costs

          • Separate monitoring and logging streams for each service

        Over-provisioned containers went unoptimized

        During the initial deployment on EKS, the development teams largely ported their existing resource requests and limits from their ECS environment without rigorous performance testing or right-sizing for the new Kubernetes orchestration. Without historical performance data for the new microservices architecture, the development team made conservative resource requests. Each service received generous CPU and memory allocations based on worst-case scenario planning rather than actual utilization patterns.

        The result was dramatic over-provisioning:

            • Web frontend services allocated 4 vCPUs when the actual requirement was a fraction of it.

            • Database connection pools sized for peak load that occurred less than 1% of operating time.

            • Background job processors running continuously despite intermittent workload patterns.

          Result: 2x cost with minimal value gain initially

          Within the first few months post-migration, the client’s AWS bill for their container infrastructure doubled. This increase was primarily attributed to:

              • The fixed cost of the EKS control plane.

              • A larger number of worker nodes, many of which were underutilized due to over-provisioned containers.

              • Increased network traffic and the need for more robust monitoring and logging in the more complex Kubernetes environment.

            Despite the significant cost increase, the client initially saw minimal immediate value gain beyond meeting the AWS Marketplace requirement. The benefits of the microservices architecture were yet to be fully realized, and the inefficiencies in resource utilization were negating any potential cost savings. After the initial migration had been completed, we initiated the cost optimization process and the cost became almost the same as it was before the migration. This case study highlights the critical importance of proactive cost management and optimization when adopting Kubernetes.

            The true cost anatomy of running Kubernetes

            To effectively manage and optimize Kubernetes costs, it’s essential to understand the different categories of expenses involved i.e fixed, variable, and human costs.

            Fixed costs (control plane, core add-ons)

            Fixed costs refer to the minimum spend for any Kubernetes deployment:

                • Control plane fees: $70/month per cluster for EKS, similar for other managed services.

                • Core add-on licensing: Monitoring tools, security scanning, backup solutions.

                • Essential infrastructure: Load balancers, NAT gateways, DNS zones.

                • Compliance and security baselines: Encryption, audit logging, secret management.

              These costs scale with the number of clusters and environments rather than workload intensity. Organizations with multiple regions or extensive development/staging environments face multiplied fixed costs.

              Variable costs (resource usage, traffic, snapshots)

              These costs fluctuate based on your application’s resource usage and activity:

                  • Compute resources: The cost of CPU, RAM, and storage consumed by your worker nodes. This is the most significant variable cost and is directly tied to application’s demands and the efficiency of your resource allocation.

                  • Network traffic: Costs associated with data transfer in and out of your cluster, between nodes, and to external services.

                  • Storage costs: Persistent volumes, backups, and snapshots contribute to storage expenses.

                  • Load balancer and ingress costs: Charges based on the number of load balancers, rules, and the amount of traffic they handle.

                  • Monitoring and logging ingestion: Costs associated with the volume of metrics, logs, and traces ingested by your observability tools.

                  • Image registry traffic: Container image pulls and distribution.

                Human costs (DevOps, troubleshooting, reviews)

                These are the costs associated with the personnel required to manage and operate your Kubernetes environment:

                    • DevOps team salaries: The cost of engineers responsible for cluster management, deployments, and troubleshooting.

                    • Platform engineering: Designing, implementing, and maintaining cluster architecture.

                    • 2nd day operations: Day-to-day cluster management, upgrades, patches.

                    • Incident response: Troubleshooting outages, performance issues, security events.

                    • Cost optimization: Regular reviews, right-sizing exercises, efficiency improvements.

                    • Training and upskilling: Developing internal Kubernetes expertise.

                  How to design Kubernetes with cost visibility from day one

                  Avoiding Kubernetes cost surprises requires intentional design decisions and ongoing financial observability rather than retroactive optimization.

                  Right-size nodes and workloads early

                  Establish resource sizing based on actual performance data rather than speculation:

                      • Instance sizing: Don’t default to oversized instances or containers, instead size instances as per the accurate requirements. Use Karpenter if you’re in AWS. It’s a must have!

                      • Load testing: Conduct realistic performance tests to understand actual CPU and memory requirements.

                      • Setup limits: Define appropriate CPU and memory requests and limits for your pods

                      • Vertical Pod Autoscaler (VPA): Deploy VPA in recommendation mode to gather utilization data before setting resource requests.

                      • Gradual scaling: Start with conservative node sizes and scale up based on observed demand patterns.

                      • Mixed instance types: Use ARM-based instances where application stacks support them for cost advantages.

                    Monitor continuously (Grafana, Kubecost, etc.)

                    Financial visibility requires more than basic infrastructure monitoring, it also requires specific kubernetes cost optimization tools, some of the commonly used ones are:

                        • Kubecost: Provides detailed cost attribution per namespace, service, and deployment (but requires a license for production-grade clusters).

                        • Cloud provider billing: Set up detailed cost allocation tags to track spending by team, project, and environment.

                        • Prometheus + Grafana: Monitor actual resource utilization vs. requested resources to identify optimization opportunities.

                        • VictoriaMetrics: More cost-effective alternative to Prometheus for any-scale metrics collection.

                      Schedule cost audits (quarterly, sprint-linked)

                      Cost optimization shouldn’t be an emergency response to budget overruns, instead they should be scheduled in advance.

                          • Quarterly reviews: Establish regular cost review cycles aligned with business planning.

                          • Sprint-linked optimization: Include cost optimization stories in regular development sprints.

                          • Automated reporting: Generate regular cost trend reports with actionable recommendations.

                          • Cross-functional collaboration: Include finance stakeholders in architectural decisions with cost implications.

                        Use tagging and spend tracking per namespace

                        Visibility enables accountability and informed decision-making.

                           

                            • Namespace-based cost allocation: Map application costs to business units or products.

                            • Resource tagging strategy: Consistent tagging across all cloud resources for accurate cost attribution.

                            • Environment-specific budgets: Set spending limits for development, staging, and production environments.

                            • Team-based dashboards: Provide engineering teams with real-time visibility into their infrastructure costs.

                          Naviteq’s perspective: Avoiding Kubernetes sticker shock

                          At Naviteq, our experience working with diverse clients has revealed that successful Kubernetes cost optimization and management requires treating FinOps as a core practice rather than an afterthought.

                          FinOps as a core practice, not an afterthought

                          We treat the adoption of FinOps as a fundamental practice, not just an occasional exercise. This involves fostering collaboration between engineering, finance, and business teams to make informed decisions about cloud spending. Kubernetes cost optimization is not treated as an afterthought but as an integral part of the development, operations process and kubernetes performance optimization.

                          The most successful Kubernetes implementations embed cost considerations into architectural decisions from day one. This means:

                              • Cost-aware design reviews: Including cost implications in technical architecture discussions.

                              • Financial impact assessments: Evaluating the cost trade-offs of different deployment strategies.

                              • Budget-driven constraints: Using cost limitations to drive more efficient architectural choices.

                              • Cross-team collaboration: Regular interaction between finance, operations, and engineering teams.

                            Pre-migration planning and architecture trade-offs

                            Before migrating to Kubernetes, we work closely with clients to conduct thorough pre-migration planning. This includes a detailed analysis of their current infrastructure, workload requirements, and cost profiles. We help evaluate the trade-offs between different architectural patterns and Kubernetes deployment options, ensuring that cost implications are a key factor in decision-making.

                            Kubernetes migrations require honest assessment of value versus cost:

                                • Migration justification: Clear business case beyond “keeping up with technology trends”.

                                • Alternative evaluation: Comparing Kubernetes against simpler alternatives like managed container services.

                                • Staged migration approach: Gradual transition allowing cost impact assessment at each phase.

                                • Exit strategy planning: Understanding how to revert or pivot if costs exceed value.

                              Smart defaults for cost-aware platforms

                              Our approach involves establishing smart defaults for cluster configurations, resource requests, and scaling policies that are inherently cost-efficient. We guide clients in selecting appropriate instance types, leveraging spot instances where suitable, and implementing auto-scaling strategies to match resource consumption with actual demand.

                              By embedding cost optimization into our Kubernetes design and management methodologies, we empower our clients to harness the power of Kubernetes while avoiding cloud bill shock. We believe that with intentional design, continuous monitoring, and a strong focus on financial observability, Kubernetes can be a cost-effective and transformative platform for building and scaling modern applications.

                              Platform teams should establish cost-conscious defaults rather than requiring individual teams to make optimization decisions:

                                  • Resource request templates: Pre-configured resource profiles based on application patterns.

                                  • Automated right-sizing: Tools that adjust resource allocations based on historical usage.

                                  • Environment-specific configurations: Different resource defaults for development vs. production.

                                  • Cost guardrails: Automated policies that prevent obviously wasteful configurations.

                                The key insight from our client engagements is that Kubernetes cost optimization isn’t primarily a technical problem, it’s an organizational alignment challenge. The most successful implementations treat cost management as a shared responsibility across engineering, operations, and finance teams. 

                                Proactive optimization strategies

                                Rather than reactive cost cutting, we advocate for continuous optimization as part of normal operations:

                                    • Spot instance strategies: Designing resilient applications that can leverage cheaper, interruptible compute.

                                    • Multi-zone traffic optimization: Minimizing expensive cross-zone data transfer through intelligent scheduling.

                                    • Storage tier management: Using appropriate storage classes and implementing automated lifecycle policies.

                                    • Auto-scaling tuning: Optimizing scaling parameters to avoid over-provisioning during traffic spikes.

                                  Conclusion: Kubernetes ROI requires intentional cost management

                                  Kubernetes delivers substantial value when implemented thoughtfully, but treating it as “free” infrastructure creates financial and operational risks. The platform’s flexibility and power come with corresponding complexity and cost implications that require active management.

                                  The organizations that succeed with Kubernetes investments share common characteristics i.e they plan for total cost of ownership upfront, establish cost visibility and accountability mechanisms, and treat financial optimization as an ongoing engineering practice rather than an emergency response.

                                  Most importantly, they recognize that the largest Kubernetes cost isn’t infrastructure, it’s the organizational alignment and expertise required to operate the platform efficiently. Investing in that human capital and process development ultimately determines whether Kubernetes delivers positive ROI or becomes an expensive technical debt burden. Therefore it’s often wise to consult experts like that from Naviteq who can guide you through the process and create a customized kubernetes migration strategy that is tailormade for your organization.

                                  Ready to optimize your Kubernetes costs without sacrificing performance?

                                  Contact Naviteq today for a free consultation. Our expert team can help you design cost-efficient Kubernetes architectures, implement proactive optimization strategies, and gain complete financial observability into your cloud environment. Don’t let hidden Kubernetes costs surprise you. Partner with Naviteq for a smarter, more cost-effective cloud journey.

                                  Frequently Asked Questions

                                  While the software itself is free, you pay for the infrastructure like the virtual machines (worker nodes) and managed services that run it. Teams often over-provision resources during migration, leading to significant, unexpected costs.

                                  The largest cost is almost always the worker nodes. These costs can be kept in check by continuously monitoring resource usage of your apps and implementing autoscaling to ensure you’re only paying for what you need.

                                  FinOps is a cultural practice that promotes collaboration between engineering and finance to manage cloud costs. For Kubernetes, it means making cost-aware decisions from day one and treating cost management as an ongoing process.

                                  The effort of cost optimization is not just about cost-cutting, but about providing more value to the organization. The savings can be reinvested into new features or performance improvements, which leads to direct business benefits.

                                  You might also like

                                  Privacy Policy

                                  1. Introduction

                                  Naviteq is committed to protecting the privacy rights of data subjects.

                                  “Naviteq”, “we,” and “us” refer to Naviteq Ltd. Israel (Check out our contact information.) We offer a wide range of software development services. We refer to all of these products, together with our other services and websites as “Services” in this policy.

                                  This policy refers to the data we collect when you use our services or communicate with us. Examples include visiting our website, downloading our white papers and other materials, responding to our e-mails, and attending our events. This policy also explains your rights with respect to the data we collect about you. Data privacy of our employees is regulated in separate local acts and is not regulated by this policy.

                                  Your information is controlled by Naviteq. If you have any questions or concerns about how your information is handled, please direct an inquiry to us at [email protected]. Alex Berber is our Data Protection Officer (DPO), with overall responsibility for the day-to-day implementation of this policy.

                                  If you do not agree with this policy, please do not access or use our services, or interact with any other aspect of our business.

                                  2. Data we gathered from our website’s users

                                  When you visit our website, we collect usage statistics and other data, which helps us to estimate the efficiency of the content delivered. Processing data gathered from our website also helps us to provide a better user experience and improve the products and services we offer. We collect information through the use of “cookies,” scripts, tags, Local Shared Objects (Flash cookies), web beacons, and other related methods.

                                  2.1. We collect the following categories of data:

                                  • Cookies and similar technologies (e.g., web beacons, pixels, ad tags and device identifiers)
                                  • Usage data, user behavior collected by cookies
                                  What is a cookie?

                                  HTTP cookie is a small piece of data that we send to your browser when you visit our website. After your computer accepts it or “takes the cookie” it is stored on your computer as an identification tag. Cookies are generally employed to measure website usage (e.g., a number of visitors and the duration of a visit) and efficiency (e.g., topics of interest to our visitors). Cookied can also used to personalize a user experience on our website. If necessary, users can turn off cookies via browser settings

                                  2.2. How we process the data gathered

                                  Naviteq and third-party providers we partner with (e.g., our advertising and analytics partners) use cookies and other tracking tools to identify users across different services and devices and ensure better user experience. Please see the list of them below.

                                  2.2.1. Analytics partners

                                  The services outlined below help us to monitor and analyze both web traffic and user behavior.

                                  • Google Analytics (Google LLC.) Google Analytics is a web analysis service provided by Google Inc. (Hereinafter in this document referred to as Google). Google utilizes the data collected to track and examine user behavior, to prepare reports, and share insights with other Google services. Google may use the data collected to contextualize and personalize the advertisements launched via Google’s advertising network. The service is subject to Google’s privacy policy. Google’s Privacy Policy
                                  • Google Tag Manager (Google LLC.) Google Tag Manager is a web service designed to optimize the Google Analytics management process. The service is provided by Google Inc. and is subject to the company’s privacy policy. Google’s Privacy Policy
                                  • Facebook Ads conversion tracking (Facebook, Inc.) Facebook Ads conversion tracking is an analytics service that binds data gathered from the Facebook advertising network with actions performed on Naviteq websites. The service is provided by Facebook, Inc. and is subject to the company’s privacy policy. Facebook’s Privacy Policy
                                  • Google AdWords Tools (Google AdWords Conversion Tracking/ Dynamic Remarketing / User List / DoubleClick) (Google LLC) Google AdWords conversion tracking and other Google Ads services are analytic instruments, that connect data from the Google AdWords advertising network with actions taken on Naviteq websites. The services are provided by Google Inc. and are subject to the company’s privacy policy. Google’s Privacy Policy
                                  2.2.2. Advertising partners

                                  User data may be employed to customize advertising deliverables, such as banners and any other types of advertisements to promote our services. Sometimes, these marketing deliverables are developed based on user preferences. However, not all personal data is used for this purpose. Some of the services provided by Naviteq may use cookies to identify users. The behavioral retargeting technique may also be used to display advertisements tailored to user preferences and online behavior, including outside Naviteq websites. For more information, please check the privacy policies of the relevant services.

                                  • Facebook Audience Network (Facebook, Inc.) Facebook Audience Network is an advertising service that helps to monitor and evaluate the efficiency of advertising campaigns launched via Facebook. The service is provided by Facebook, Inc. and is subject to the company’s privacy policy. Facebook’s Privacy Policy
                                  • Bing Ads (Microsoft Corporation). Bing Ads is advertising for launching and managing advertising campaigns across Bing search and Bing’s partner network. The service is provided by Microsoft Corporation and is subject to the company’s privacy policy. Microsoft Corporation’s Privacy Policy
                                  • Google AdWords (Google LLC) DoubleClick (Google Inc.) / DoubleClick Bid Manager / Google DoubleClick Google AdWords and Double Click are advertising services that enable efficient interaction with potential customers by suggesting relevant advertisements across Google Search, as well as Google’s partner networks. Google AdWords and Double Click are easily integrated with any other Google services—for example, Google Analytics—and help to process user data gathered by cookies. The services are provided by Google Inc. and are subject to the company’s privacy policy. Google’s Privacy Policy
                                  • LinkedIn Marketing Solutions / LinkedIn Ads (LinkedIn Corporation) LinkedIn Ads allow for tracking the efficiency of advertising campaigns launched via LinkedIn. The service is provided by LinkedIn Corporation and is subject to the company’s privacy policy. LinkedIn’s Privacy Policy
                                  • Twitter Advertising / Twitter Conversion Tracking (Twitter, Inc.) The Twitter Ads network allows for tracking the efficiency of advertising campaigns launched via Twitter. The service is provided by Twitter Inc. and is subject to the company’s privacy policy. Twitter’s Privacy Policy
                                  2.2.3. Other widgets and scripts provided by partner third parties

                                  In addition to advertising partners and analytics partners mentioned above, we are using widgets, which act as an intermediary between third-party websites (Facebook, Twitter, LinkedIn, etc.) and our website and allow us to provide additional information about us or our services or authorize you as our website user to share content on third-party websites.

                                  • Disqus (Disqus, Inc.) is a blog comment hosting service for websites and online communities that use a networked platform. Disqus integration into a corporate blog enables website users to submit a comment to any article posted on the blog after he/she authorizes it into a personal Disqus account. Disqus Privacy Policy
                                  • WordPress (WordPress.org) is a free and open-source content management system (CMS). WordPress Stats is the CMS’s analytics module, which gathers the following statistics: views and unique visitors, likes, followers, references, location, terms, words, and phrases people use on search engines (e.g., Google, Yahoo, or Bing) to find posts and pages on our website. The service also allows for gathering such data as clicks on an external link, cookies, etc. The service is subject to WordPress’s privacy policy.
                                  • Twitter Button and Twitter Syndication (Twitter, Inc.) allow you to quickly share the webpage you are viewing with all of your followers. Twitter Syndication enables users to implement a widget, which gathers information about the company’s Twitter profile and tweets. The services are provided by Twitter Inc. and are subject to the company’s privacy policy. Twitter’s Privacy Policy
                                  • Facebook Social Graph (Facebook, Inc.) is used to implement widgets to get data into and out of the Facebook platform. In our case, this widget is used to enable content sharing and display the number of sharings by Facebook users. The service is provided by Facebook, Inc. and is subject to the company’s privacy policy. Facebook’s Privacy Policy
                                  • LinkedIn Widgets (LinkedIn Corporation) are a quick way to infuse LinkedIn functionality into our website. We use this widget to enable content sharing and display the number of sharings by LinkedIn users. The service is provided by LinkedIn Corporation and is subject to the company’s privacy policy. LinkedIn’s Privacy Policy
                                  • OneSignal (OneSignal, Inc) is a push notification service. OneSignal’s Privacy Policy
                                  • ShareThis (ShareThis, Inc.) is a share button service. ShareThis Privacy Policy

                                  2.3. Purposes and legal basis for data processing

                                  Naviteq is gathering data via this service with a view to improving the development of our products or services. Data gathering is conducted on the basis of our or third party’s legitimate interests, or with your consent.

                                  User data collected allow Naviteq to provide our Services and is employed in a variety of our activities that correspond our legitimate interests, including:

                                  • enabling analytics to draw valuable insights for smart decision making
                                  • contacting users
                                  • managing a user database
                                  • enabling commenting across the content delivered
                                  • handling payments
                                  • improving user experience (e.g., delivering highly personalized content suggestions) and the services delivered (e.g., a subscription service), etc.
                                  • providing information related to the changes introduced to our Customer Terms of Service, Privacy Policy (including the Cookie Policy), or other legal agreements

                                  2.4. Data retention period

                                  We set a retention period for your data — collected from our websites — to 1 year. We gather data to improve our services and the products we deliver. The retention period from our partners is set forth by them in their privacy policies.

                                  2.5. Data recipients

                                  We do not transfer the gathered data to third parties, apart from the cases described in the General data processing section or in this Section, as well as cases stipulated in our third partner’s privacy policies.

                                  3. Data we gather from our web forms

                                  3.1. We collect the following categories of data

                                  When you fill out any of the forms located at our websites, you share the following information with us:

                                  • Name/surname
                                  • Position
                                  • Phone number
                                  • E-mail
                                  • Location
                                  • Company name
                                  • Any other information you provided to us from your request

                                  3.2. How we process the data gathered

                                  The information about the request is transferred to our CRM or Hubspot. Later, it may be used to contact you with something relevant to your initial request, provide further information related to the topic you requested, and deliver quality service.

                                  By sharing personal information with us, you are giving consent for us to rightfully use your data for the following business purposes:

                                  • Send any updates regarding services you have shown interest in or provide further information related to the topic you requested.
                                  • Contact and communicate with you regarding your initial request. To get your consent to further contact you regarding any other services you might be interested in.
                                  • To get your consent to further contact you regarding any other services you might be interested in.
                                  • Maintenance and support activities of our CRM system and related activities.

                                  All the information gathered via contact forms is processed by the following services:

                                  • WordPress (Privacy Policy)
                                  • Hubspot (Privacy Policy)
                                  • Gmail services that deliver notifications about the filled out contact forms to our employees (Privacy Shield)

                                  3.3. Purposes and legal basis for data processing

                                  If you fill out a contact form to get an expert’s take on your project or to get familiar with the services our company delivers, we process your data in order to enter into a contract and comply with our contractual obligations (to render Services), or answer to your request. This way, we may use your personal information to provide services to you, as well as process transactions related to the services you inquired about from us. For example, we may use your name or an e-mail address to send an invoice or to establish communication throughout the whole service delivery life cycle. We may also use your personal information you shared with us to connect you with other of our team members seeking your subject matter expertise. In case you use multiple services offered by our company, we may analyze your personal information and your online behavior on our resources to deliver an integrated experience. For example, to simplify your search across a variety of our services to find a particular one or to suggest relevant product information as you navigate across our websites.

                                  With an aim to enhance our productivity and improve our collaboration—under our legitimate interest—we may use your personal data (e.g., an e-mail, name, job title, or activity taken on our resources) to provide the information we believe may be of interest to you. Additionally, we may store the history of our communication for the legitimate purposes of maintaining customer relations and/or service delivery, as well as we may maintain and support the system, in which we store collected data.

                                  If you fill out contact forms for any other purpose, including the download of white papers or to request a demo, we process data with a legitimate interest to prevent spam and restrict the direct marketing of third-party companies. Our interactions are aimed at driving engagement and maximizing the value you get through our services. These interactions may include information about our new commercial offers, white papers, newsletters, content, and events we believe may be relevant to you.

                                  3.4. Data retention period

                                  We set a retention period for your data collected from contact forms on our websites to 1 year. This data may be further used to contact you if we want to send you anything relevant to your initial request (e.g., updated information on the white papers you downloaded from our websites).

                                  3.5. Data recipients

                                  We do not transfer data to third parties, apart from the cases described in the General data processing section and this section.

                                  4. Data we gather from our web forms

                                  4.1. We collect the following categories of data

                                  When you answer a question and/or provide information via chatbot, you share the following information with us:

                                  • Name/surname
                                  • Position
                                  • Phone number
                                  • E-mail
                                  • Location
                                  • Company name
                                  • Any other information you provided to us from your request

                                  4.2. How we process the data gathered

                                  The information gathered is transferred to our CRM or Hubspot. Later, it may be used to contact you with something relevant to your initial request, provide further information related to the topic you requested, and deliver quality service.

                                  By sharing personal information with us, you are giving consent for us to rightfully use and process in any way your data, including for the following business purposes:

                                  • Send any updates regarding services you have shown interest in or provide further information related to the topic you requested.
                                  • Contact and communicate with you regarding your initial request.
                                  • To get your consent to further contact you regarding any other services you might be interested in.
                                  • Maintenance and support activities of our CRM system and related activities, etc.

                                  All the information gathered via chatbot is processed by the following services:

                                  • WordPress (Privacy Policy)
                                  • Gmail services that deliver notifications about the filled out contact forms to our employees (Privacy Shield)
                                  • Drift.com, Inc. (Privacy Policy)

                                  4.3. Purposes and legal basis for data processing

                                  If you share personal data via chatbot to get an expert’s take on your project or to get familiar with the services our company delivers, we process your data in order to enter into a contract and to comply with our contractual obligations (to render Services), or answer to your request. This way, we may use your personal information to provide services to you, as well as process transactions related to the services you inquired from us. For example, we may use your name or an e-mail address to send an invoice or to establish communication throughout the whole service delivery life cycle. We may also use your personal information you shared with us to connect you with other of our team members seeking your subject matter expertise. In case you use multiple services offered by our company, we may analyze your personal information and your online behavior on our resources to deliver an integrated experience. For example, to simplify your search across a variety of our services to find a particular one or to suggest relevant product information as you navigate across our websites.

                                  With an aim to enhance our productivity and improve our collaboration—under our legitimate interest—we may use your personal data (e.g., an e-mail, name, job title, or activity taken on our resources) to provide information we believe may be of interest to you. Additionally, we may store the history of our communication for the legitimate purposes of maintaining customer relations and/or service delivery, as well as we may maintain and support the system, in which we store collected data.

                                  If you share personal data via chatbot for any other purpose we process data with a legitimate interest to prevent spam and restrict direct marketing of third-party companies. Our interactions are aimed at driving engagement and maximizing value you get through our services. These interactions may include information about our new commercial offers, white papers, newsletters, content, and events we believe may be relevant to you.

                                  4.4. Data retention period

                                  We set a retention period for your data collected from communication with us via chatbot to 6 years. This data may be further used to contact you if we want to send you anything relevant to your initial request (e.g., updated information on your initial request, etc).

                                  4.5. Data recipients

                                  We do not transfer data to third parties, apart from the cases described in the General data processing section and this section.

                                  5. Data we gather via e-mails, messengers, widgets, and phones

                                  5.1. We collect the following categories of data

                                  When you interact with us via any other means and tools, we gather the following information about you:

                                  • Name/surname
                                  • Position
                                  • Phone number
                                  • E-mail
                                  • Location
                                  • Company name
                                  • Any other information you provided to us from your request

                                  The information about a customer call is stored in our internal system and includes a full call recording (starting the moment a connection was established), a voice recording if any available, a phone number, and a call duration.

                                  5.2. How we process the data gathered

                                  All the requests acquired via e-mail are stored within a business Gmail account of Naviteq located at the Google’s server. The information about the request is further transferred and stored in internal CRM either by employees of Naviteq manually or automatically for further processing according to our purposes. We may maintain and support the system, in which we store collected data.

                                  5.3. Purposes and legal basis for data processing

                                  When you contact us via any other means to get an expert’s take on your project / our services or to make any kind of a request, we process your data in order to enter into a contract, to comply with our contractual obligations (to render Services), or answer to your request.

                                  This way, we may use your personal information to provide services to you, as well as process transactions related to the services you inquired from us. For example, we may use your name or an e-mail address to send an invoice or to establish communication throughout the whole service delivery life cycle. We may also use your personal information you shared with us to connect you with other of our team members seeking your subject matter expertise. In case you use multiple services offered by our company, we may analyze your personal information and your online behavior on our resources to deliver an integrated experience. For example, to simplify your search across a variety of our services to find a particular one or to suggest relevant product information as you navigate across our websites. With an aim to enhance our productivity and improve our collaboration, what is our legitimate interest, we may use your personal data—such as an e-mail, name, job title, or activity taken on our resources—to provide information we believe may be of interest to you. Additionally, we may store the history of our communication for the legitimate purposes of maintaining customer relations and/or service delivery.

                                  If you communicate with us for any other purpose we process data with a legitimate interest to prevent spam and restrict direct marketing of third-party companies. Our interactions are aimed at driving engagement and maximizing value you get through our services. These interactions may include information about our new commercial offers, white papers, newsletters, content, and events we believe may be relevant to you or your initial request.

                                  5.4. Data retention period

                                  We set a retention period for the data collected to 6 years. This data may be further used to contact you if we want to send you anything relevant to your initial request.

                                  5.5. Data recipients

                                  We do not share data with third parties, apart from the cases described in the General data processing section and cases stipulated in our third partner’s privacy policies.

                                  6. Data we gather if you are our customer

                                  6.1. We collect the following categories of data

                                  If you are our customer, you have already shared the following information with us to process:

                                  • Names/surnames of contact persons
                                  • Positions
                                  • Phone numbers
                                  • E-mails
                                  • Skype IDs
                                  • Company name/address
                                  • Any other information you provided to us during service delivery
                                  • History of our communication, etc.

                                  6.2. How we process the data gathered

                                  • Information about the existing customers is transferred to our internal CRM (by our employees manually or automatically on receiving a contact form) and Hubspot (HubSpot, Inc. Privacy Policy) for further processing a customer request and providing relevant services, as well as developing recommendations on improving the services we deliver. We may further need any maintenance and support activities of our CRM system or any related activities.
                                  • To share contact information and information related to the services a customer is interested in, we may use the following messengers: Skype (Privacy Policy), Viber (Privacy Policy), WhatsApp (Privacy Policy), or Telegram (Privacy Policy), as well as e-mail services—Gmail (Privacy Policy) or Outlook (Privacy Policy)
                                  • To store and share project requirements or any other information submitted by a customer (e.g., a project budget estimation to deliver a suitable commercial offer, UI mockups submitted by a customer, test access to a customer system, etc.), we may use services of Google (Privacy Policy), Adobe (Privacy Policy), Microsoft Office (Privacy Policy), Atlassian (Privacy Policy), and Trello (Privacy Policy)
                                  • To provision phone calls in a distributed manner, Naviteq makes use of services to store historical data about the activities conducted.
                                  • To establish internal business processes within our departments and teams and to ensure timely request processing, we make use of Trello (Privacy Policy) and Atlassian (Privacy Policy). These services may store project information related to a technology stack, budget, roadmap, deadlines, Naviteq project team, etc.
                                  • To store the audio recordings of negotiations with a customer in order to clarify details if necessary and conduct meetings with previous, existing, and potential customers, we make use of GoToMeeting (Privacy Policy), and Hangouts (Privacy Policy), or Zoom (Privacy Policy).
                                  • To store case studies, describing a delivered project approved by a customer, we use an internal web portal—SharePoint Portal (Privacy Policy)—which only employees of Naviteq can access.
                                  • To provision contracts, all the data about the active customers is stored in a secured internal network resource with limited access. This resource is available only to our account managers or other employees concerned for the purpose of improving service delivery while establishing communication with a customer, issuing an invoice, and generating reports for a customer. Additional services Naviteq uses for issuing invoices Azets AS (Privacy Policy). These services process data in compliance with the privacy policies of the mentioned services.
                                  • Additionally, by sharing with us this information you are giving consent to contact you in order to get your consent for the possibility to contact you regarding any other services you might be interested in

                                  6.3. Purposes and legal basis for data processing

                                  We use personal data submitted for the following purposes:

                                  To fulfill/comply with our contractual obligations or answer your request. For example, we use your name or an e-mail in contact to send invoices or communicate with you at any stage of the service delivery life cycle. This way, we may use your personal information to provide services to you, as well as process transactions related to the services you inquired from us. For example, we may use your name or an e-mail address to send an invoice or to establish communication throughout the whole service delivery life cycle. We may also use your personal information you shared with us to connect you with other of our team members seeking your subject matter expertise. In case you use multiple services offered by our company, we may analyze your personal information and your online behavior on our resources to deliver an integrated experience. For example, to simplify your search across a variety of our services to find a particular one or to suggest relevant product information as you navigate across our websites.

                                  With an aim to enhance our productivity and improve our collaboration, what is our legitimate interest, we may use your personal data—such as an an e-mail, name, job title, or activity took on our resources — to provide the information we believe may be of interest to you and communicate with you in order to get your consent for a possibility to contact you regarding any other services you might be interested in. Additionally, we may store the history of our communication for the legitimate purposes of maintaining customer relations and/or service delivery as well as to maintain and support our CRM system and related activities.

                                  6.4. Data retention period

                                  We set the retention period for your data about our customer to 1 year from last Service delivery. We keep it to be able to reach you when we have something relevant to your initial request (for example, updated information on related services, news, events, updates, etc).

                                  6.5. Data recipients

                                  We do not share data with third parties, apart from the cases described in the General data processing section or in this section.

                                  7. Data we gather from the attendees of our events

                                  7.1. We collect the following categories of data

                                  When you register or attend an event organized by Naviteq, you share the following information with us:

                                  • Names/surnames of contact persons
                                  • Positions
                                  • Phone numbers
                                  • E-mails
                                  • Skype IDs
                                  • Company name/address
                                  • Any other information you provided to us during service delivery
                                  • History of our communication, etc.

                                  7.2. How we process the data gathered

                                  Data about users who filled out a contact form is stored in our internal CRM, which shall be maintained and supported, and Hubspot (HubSpot, Inc. Privacy Policy) — by our employees manually or automatically on receiving a contact form — for further processing a customer request and providing relevant services, as well as developing recommendations on improving the services we deliver.

                                  To share contact information, as well as information related to the events and services that may be of interest to a customer, Naviteq may use the following:

                                  • Messengers: Skype (Privacy Policy), Viber (Privacy Policy), WhatsApp (Privacy Policy), or Telegram (Privacy Policy)
                                  • E-mail services Gmail (Privacy Policy) or Outlook (Privacy Policy)
                                  • Social media platforms: LinkedIn (Privacy Policy)
                                  • VOIP phone and conferencing services: GoToMeeting (Privacy Policy), Hangouts (Privacy Policy) or Zoom (Privacy Policy).

                                  To provide users with the possibility to register for an event organized by Naviteq and acquire tickets, we use Eventbrite (Privacy Policy).

                                  To store and share information about attendees of the events organized by Naviteq, as well as to improve all the online activities related to such events, Naviteq makes use of the services of Google (Privacy Policy) and Microsoft (Privacy Policy)

                                  To enable marketing activities and share information about relevant services provided by our company, we use remarketing and advertising instruments available through Google Adwords (Privacy Policy).

                                  To build a strong community around the events organized by Naviteq and to interact with those interested in our services, we use Meetup.com (Privacy Policy).

                                  To optimize internal processes and improve communication channels, we may use Atlassian (Privacy Policy) and Trello (Privacy Policy).

                                  7.3. Purposes and legal basis for data processing

                                  To establish efficient communication with customers about our services, we may use the following data:

                                  • To fulfill and comply with our contractual obligations or answer to your request. To maintain contract development, we use your contact data to send transactional information via e-mail, Skype, or any other communication means or services. Your contact data is also used to confirm your request, respond to any of your questions, inquiries, or requests, provide support, as well as send you any updates on the services we deliver.
                                  • To fulfill our legitimate interest, we use your contact information and information about your interaction with our services to send promotional materials that we find relevant to you via e-mail, Skype, or any other communication means or services. Our interactions are aimed at driving engagement and maximizing the value you get through our services. These interactions may include information about our new events, commercial offers, newsletters, content, and events we believe may be relevant to you. To fulfill our legitimate interest, we use your contact information which is stored at our CRM system in order to maintain and support our CRM system and carry on any related activities.

                                  7.4. Data retention period

                                  We set the retention period for your data about our customer to 6 years from the last event you have been registered. We keep it to be able to reach you when we have something relevant to your initial request (for example, updated information on calls, e-mail, etc.).

                                  7.5. Data recipients

                                  We do not share personal data with third parties, apart from the cases, which implies Naviteq is to provide a list of registrars to the organizer of the event with a view to ensuring an acceptable level of organization and security.

                                  8. General data processing and data storage

                                  Our processing means any operation or set of operations that is performed on personal data or on sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, support, maintenance, etc.

                                  The retention period of storing data varies on its type. As the retention period expires, we either delete or anonymize personal data collected. In case data was transferred to backup storage and, therefore, cannot be deleted, we continue to store it in a secure fashion, but do not use it for any purpose. In all the other cases, we proceed with the deletion of data.

                                  The information available through our websites that was collected by third parties is subject to the privacy policies of these third parties. In this case, the retention period of storing data is also subject to the privacy policies of these third parties.

                                  To prevent spam, we keep track of spam and swindler accounts, which may be blocked through filtering at the server level.

                                  A request containing words, which may be treated as spam-related or which may promote the distribution of misleading information, are filtered at the server level, as well as by company employees manually.

                                  Data storage on our servers, as well as on cloud services provided by Google, Amazon, Hubspot, and on other services, inter alia Drift.com or other stipulated in this policy.

                                  We do not make automated decisions, including profiling.

                                  9. Your rights

                                  Below, you will find a list of the rights you are subject to. Please note that some of the enlisted rights may be limited for the requests, which expose the personal information of another individual who is subject to the very same rights for privacy. In such a case, we will not be able to satisfy your request for data deletion if it contains information we are eligible to keep by law.

                                  The right to be informed and to access information. You have legal rights to access your personal data, as well as request if we use this data for any purpose. Complying with our general policy, we will provide you with a free copy of your personal information in use within a month after we receive your request. We will send your information in use via a password-protected PDF file. For excessive or repeated requests, we are eligible to charge a fee. In case of numerous or complex requests, we are eligible to prolong our response time by as much as two additional months. Under such circumstances, you will be informed about the reasons of these extensions. In case, we refuse to address a particular request, we will explain why it happens and provide you with a list of further actions you are eligible to proceed. If shall you wish to take further action, we will require two trusted IDs from you to prove your identity. You may forward your requests to our Data Protection Officer ([email protected]). Please provide information about the nature of your request to help us process your inquiry.

                                  The right for rectification. In case you believe, we store any of your personal data, which is incorrect or incomplete, you may request us to correct or supplement it. You also have the right to introduce changes to your information by logging into your account with us.

                                  The right to erase, or “the right to be forgotten”. Under this principle, you may request us to delete or remove your personal data if there is no solid reason for your data continued processing. If you would like us to remove you from our database, please e-mail [email protected]). The right to be forgotten may be brought into force under the following reasons:

                                  • Data, which no longer has a relation to its original purpose for the collection.
                                  • You withdraw consent with respect to the original reason data was processed, and there is no other reason for us to continue to store and process your personal data.
                                  • You have objections to processing your personal data, and there are no overriding legitimate reasons for us to continue to process it.
                                  • Your personal data has been unlawfully processed.
                                  • Your personal data has to be deleted to comply with a legal obligation in a European Union or a Member State law to which Naviteq is subject.
                                  • Your personal data has been collected in relation to the offer of information society services.

                                  The right to restrict processing. Under this right, you may request us to limit the processing your personal data. In this regard, we are eligible to store information that is sufficient to identify which data you want to be blocked, but cannot process it further. The right to restrict processing applies to the following cases:

                                  • Where you contest the accuracy of your personal data, we will restrict data processing until we have verified the accuracy of your personal data.
                                  • Where you have objected to data processing under legitimate interests, we will consider whether our legitimate interests override yours.
                                  • When data processing is unlawful, and you oppose data deletion and request restriction instead.
                                  • If we no longer need your personal data, but you require this data to establish, exercise or defend a legal claim.

                                  If we have disclosed your personal data in question to third parties, we will inform them about the restriction on data processing, unless it is impossible or involves disproportionate effort to do so. We will inform you if we decide to lift a restriction on data processing.

                                  The right to object. You are eligible to object to processing your personal data based on legitimate interests (including profiling) and direct marketing (including profiling). The objection must be on “grounds relating to his or her particular situation.” We will inform you of your right to object in the first communication you receive from us. We will stop processing your personal data for direct marketing purposes, as soon as we receive an objection.

                                  The right to data portability. You are eligible to obtain your personal data, which is processed by Naviteq, to use it for your own purposes. It means you have the right to receive your personal data — that you have shared with us—in a structured machine-readable format, so you can further transfer the data to a different data controller. This right applies in the following circumstances:

                                  • Where you have provided the data to Naviteq.
                                  • Where data processing is carried out because you have given Naviteq your consent to do so.
                                  • Where data processing is carried out to develop a contract between you and Naviteq.
                                  • Where data processing is carried out automatically. (No membership data is processed using automated means, so this right does not apply).

                                  Withdrawal of consent. If we process your personal data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any point in time. Please note, that if you exercise this right, you may have to then provide your consent on a case-by-case basis for the use or disclosure of certain personal data, if such use or disclosure is necessary to enable you to utilize some or all of our services.

                                  Right to file a complaint. You have the right to file a complaint about manipulations applied to your data by Naviteq with the supervisory authority of your country or a European Union Member State.

                                  10. Data security and protection

                                  We use data hosting service providers in the United States and Ireland to store the information we collect, and we do use extra technical measures to secure your data.

                                  These measures include without limitation: data encryption, password-protected access to personal information, limited access to sensitive data, encrypted transfer of sensitive data (HTTPS, IPSec, TLS, PPTP, and SSH) firewalls and VPN, intrusion detection, and antivirus on all the production servers.

                                  The data collected by third-party providers is protected by them and is subject to their terms and privacy policies.

                                  The data collected on our websites by Naviteq, as well as the data, which you entrust us under NDAs and contracts, is protected by us. We follow the technical requirements of GDPR and ensure security standards are met without exception.

                                  Though we implement safeguards designed to protect your information, no security system is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that data is absolutely safe from intrusion by others during transmission through the Internet, or while stored on our systems, or otherwise in our care.

                                  11. Data transfer outside EEA

                                  We collect information worldwide and primarily store this information in the United States and Ireland. We transfer, process, and store your information outside of your country of residence across regions wherever we or our third-party service providers operate for the purpose of delivering our services to you and for maintenance and support purposes. Whenever we transfer your information, we take precautionary measures to protect it. Thus, the data by third-party providers may be transferred to different countries globally for processing. These data transfers fall under the terms and privacy policies of these providers and (or) under standard data protection clauses.

                                  The data collected by Naviteq may be transferred across our offices. Headquartered in Israel.

                                  12. General description

                                  We may supplement or amend this policy by additional policies and guidelines from time to time. We will post any privacy policy changes on this page. We encourage you to review our privacy policy whenever you use our services to stay informed about our data practices and the ways you can help to protect your privacy.

                                  Our services are not directed to individuals under 16. We do not knowingly collect personal information from individuals under 16. If we become aware that an individual under 16 has provided us with personal information, we will take measures to delete such information.

                                  If you disagree with any changes to this privacy policy, you will need to stop using our services.

                                  Contact us

                                  Your information is controlled by Naviteq Ltd. Israel If you have questions or concerns about how your information is handled, please direct your inquiry to Naviteq Ltd. Israel, which we have appointed as responsible for facilitating such inquiries.

                                  Naviteq Ltd. Israel:

                                  Israel, Tel Aviv, Alon Building 1, Yigal Alon St 94, Tel Aviv-Yafo

                                  Phone/fax: +972 (58) 4448558

                                  E-Mail: [email protected]