What's Koalendar EU GDPR compliance status?
The European Union General Data Protection Regulation (GDPR) is a regulation that aims at unifying EU member state data privacy regulations into a single regulation, enforced on the EU single market. This article describes the GDPR compliance status of Koalendar.
If your company needs to ensure it is GDPR-compliant, it also needs to ensure its providers (ie. Koalendar) are also GDPR compliant. Koalendar is GDPR-compliant, and strictly enforces the regulation as to protect the user data we store.
Koalendar and GDPR (in 10 points)
2. Information we hold
- Our customers (ie. the operators creating Koalendar booking pages)
- Our customers end-users (ie. the users of our customers)
Koalendar does not share, or resell, any kind of user data (whether data described in point 1 or 2 above). The data is not used for advertising (both 1 and 2) or analytics (on 2). Our business model is solely based on paid subscriptions (ie. the user is not the product).
2.1. Information held on our users
- User first and last name, email, and profile picture
- User payment details (includes invoicing information, eg. company address and country — the credit card number is stored by Stripe)
We don't log user activity, except for system logs including IP, user agents and time of connection. They are solely used for debugging and lawful purpose and retained maximum 1 year.
2.2. Information held on our users' end-users
- End-user name and email address (if provided by end-user, thus involving a consent)
- End-user phone number (if provided by end-user, thus involving a consent)
- End-user information shared in the booking form (if provided by end-user, thus involving a consent)
The information help on our users' end-users is solely the responsibility of our users (ie. the individual events organizers using Koalendar). It is the responsibility of our users to manage the data they hold in their personal Koalendar dashboard. to remove sensitive data if someone may happen to share it with them (eg. Social Security Numbers, etc.). It is our responsibility to secure access to this data (ie. only website operators can access it and have a right to rectification and deletion).
3. Communicating privacy information
4. Individuals’ rights
- Right of access: our users can access all their data, without restriction, from the Koalendar apps
- Right of rectification: it's as simple as contacting us, we'll process all your rectification queries
- Right of erasure: it's as simple as contacting us, we'll process all your erasure queries
- Right to restrict processing: we don't process the data of our customers (and our customers end-users)
- Right to data portability: our users may contact us anytime if they wish to get an export of their data
- Right to be informed: we clearly inform our users about the use that will be made of their data
- Right to object: we handle all requests on this matter from our users and users' end-users (contact us)
- Right not to be subject to automated decision-making including profiling: we don't do that (and never will)
5. Subject access requests
6. Lawful basis for processing personal data
9. Data breaches
Koalendar will notify their users of any data breach, 24h maximum after knowing about it and fixing the flaw. It is then the responsibility of our users to report this data-breach to their end-users in due time.
10. Data Protection by Design and Data Protection Impact Assessments
Koalendar developers are well educated to software and network security, which helped us build a secure by design software over time.