Akkroo is an Event Lead Capture Software-as-a-Service (SaaS) solution for collecting and processing data from people, primarily at events. It comprises the following:
Handling your data is our primary business, and we take personal data protection, privacy and security very seriously. The documents here explain how we handle data collected when a client uses Akkroo software.
We have always been committed to invest in a continuous and growing security program since we first established Akkroo, and strive to go beyond the expectations of our customers wherever possible.
Here are a few practical examples of security controls within our product:
We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of data.
We also make use of external security experts from time to time to appraise our work and our data protection procedures.
For clarity, here are some terms we use in our security documents, and what they mean:
Data and Personally Identifiable Information collected via our software is stored for the sole use of the Controller.
We facilitate the reliable collection and storage of data on our customers behalf, and our intentions will always be framed by this.
Some members of the Akkroo technical staff from time to time will have restricted access to the data we store on your behalf in order that we can carry out absolutely necessary service tasks such as the monitoring and improving the quality and performance of our own services, however under no circumstances are we or any third-party able to access your data for any other purpose, such as marketing or communication purposes.
We fully comply and operate within the jurisdiction of UK and EU data law.
In light of the UK's potential withdrawal from the European Union in the coming years, we will continue to appraise the situation and adopt the most customer-favourable position on data security that we can achieve.
As a company registered in the UK and storing data within the EEA, we are regulated by European laws which are widely considered more strict than many outside of the region.
Much of our compliance covers the core requirements of data law abroad, however we believe that European laws and the protection of rights of the individual and ownership of data currently provide the best protection of data anywhere worldwide.
If you are unsure about how this impacts your use of Akkroo, we suggest you seek additional legal advice. We generally find compliance teams find parity even where we do not comply to a specific foreign law.
We have developed a Data Processing Addendum/Agreement (DPA) that we will enter into with anyone that uses our service and requires one. This service is free of charge. The DPA forms part of a contract of service with Akkroo (who are the Data Processor) and you as our customer (as the Data Controller). The DPA reflects the parties' agreement with regard to the processing of personal data performed using the Akkroo service. You may find this document useful in meeting your own GDPR (General Data Protection Regulation) commitments.
We continually and successfully work with data providers and organisations that already work within standardised frameworks such as ISO 27001, and we understand you may need to see accreditations as part of your assessment. We have gathered all the relevant documents for review.
Akkroo is working towards meeting its own first international standards, so our current approach is to provide our own body of documents and policies that meet the requirements of organisations that do maintain these standards.
Our data is stored within certified facilities and our infrastructure built upon certified services.
We are members of the United Kingdom's Information Commissioner's Office (ICO) Data Protection Register in the United Kingdom, and our registration number is ZA033795.
Data associated with your Akkroo account (including personal information and collected record data) is retained for as long as you have a Akkroo account and for a longer period as may be required by law.
We don’t cancel a licence or account for inactivity. If you cancel your licence, or it terminates for any reason, your data will be retained for a period of 90 days then permanently erased.
You may delete your data from your dashboard and apps at any time.
We will notify the Account Owner or Key Contact via email when an account is being prepared for deletion. We send a series of emails which confirm the deletion timeline (we provide a 90 day grace period after the account is expired to stop the process), including a confirmation email once the erasure has occurred. Erasure is permanent, and it is not possible to re-activate a username associated with an erased account.
You can delete collected records data or event data from inside your Akkroo dashboard which will 'soft-delete' it. Once deleted from your account, you can contact us to request a permanent deletion of the soft-deleted data. We automatically purge soft-deleted data within 30 days.
Collected data is stored on devices, and we use username and passcode based user authentication to prevent access to viewing and managing the data.
Records can be viewed or edited individually by authenticated users, however there is no way to extract or download bulk record data from inside the app.
When collecting data offline, all this data is stored inside the application until a connection can be established. At this point, all collected data is transferred automatically to the server.
Uninstalling the app erases all data from the device permanently.
We maintain regular secure encrypted backups. It may take up to 12 months from the point you start record deletion to erase all traces of the data stored in our backup systems. We describe this as 'residual data', and this data is not accessible via the Akkroo dashboard.
Computer equipment and storage media are securely reformatted and repurposed or destroyed beyond repair at their end of life. Our hosting provider shreds end-of-life hardware (although we are unable to provide certification for individual pieces of hardware), and we use secure erasure or destroy any storage media we use within the organisation.
All computer hardware and devices are issued centrally, and are logged in our central asset management system.
Our UK based Data Centre is located in Powergate Business Park in the Thames Valley (we refer to this as our London data centre in this document) and is operated by Equinix Telecity. Equinix Telecity hold the following security related accreditations.
We store backup data and some auxiliary data in Amazon's AWS S3 & Glacier facilities in Ireland (EU). Accreditation and certification details of both these services/facilities can be viewed below:
Our Data Centre implements the following access controls at its premises and facilities:
Our Software Update Policy is here.
Personal data enters the Akkroo System when an individual willingly enters their details via our software (on any device), or if data is loaded into the Application via the Akkroo Dashboard or the documented Akkroo API.
Personal data leaves the Akkroo System when you export it as a downloadable file from the Akkroo Dashboard or establish an integration or webhook which sends the data to a location of your choice.
Some of our optional premium or custom product features require the use of third-party services outside of the EEA. Where we must work with third-party contractors or data services located in other jurisdictions, we prefer to work with companies that operate within government-backed schemes such as the EU-US Privacy Shield (previously Safe Harbor) scheme where possible.
Where possible we also always aim to anonymise data (decoupling it from the source) when transferring data to third parties.
In order to transcribe cards quickly but reliably we use a highly effective human element in the processing. Our service uses third-party contractors to carry out an accurate validation and transcription of the images taken using the feature in the app.
The cards are provided to the third-party digitally and anonymously on secure, time-limited URLs, supplied to them without context. For instance they are unable to identify the origin of the card, who supplied the card or on whose behalf they are transcribing the data.
They are aware that Akkroo is the origin of the card, however we never provide any specific identifying information unless you provide it within the scanned image. Once transcribed and the data has returned to the Akkroo servers, the images are 'expired' automatically and no longer retrievable.
The image of the business card may be viewed and transcribed outside the EU during the transcription process as our transcribers are not always on-site, however the images are stored in the EU on our own servers, as with all of our data.
Please note, our business is not to act as a dedicated backup and archival service, so we always encourage our customers to use common sense and take sensible actions to make their own backup provisions in addition to the measures we take.
Our comprehensive backup schedule and redundant, versioned, distributed backup means that in the event of a major disruption, we are in a strong position to recover very recent data and return servers to an operational state.
Our mobile and tablet apps work in offline mode when there is no good connection to our server, so if the main server hosted applications are offline, it will not affect any unsynchronised data on the apps.
We carry out an annual scheduled review of all privacy practices and policy at Akkroo to ensure up-to-date and appropriate practices
Any incident of privacy violation surrounding collected data is logged centrally and reviewed quarterly. Remediations will be proposed and timescales for implementation agreed and recorded in the log.
Should we ever need to grant emergency privileges to internal or external personnel for any reason, this action is logged in our Emergency Access Log with full reasoning. We also log when those privileges are revoked.
Staff privileges are assigned appropriate to their specific roles by senior staff members, and reviewed when employment ceases or when they change roles.
When a staff member leaves employment at Akkroo, we deactivate access to staff accounts as soon as we physically can, which is usually immediately. This deactivation always occurs within 48 hours of the end of their employment. Accounts are deleted within 30 days. All role changes are logged.
We permit Akkroo team members to work from home and away from our dedicated office spaces. We require all team members to take care with their Akkroo-issued devices when they are working outside of a dedicated Akkroo office space, and we also apply a number of additional user verification controls to Akkroo online services and administration features.
Access to Akkroo online services are only available over a secure, encrypted connection.
Our staff have access to our software service on mobile, desktop and when working remotely because our service is offered as Software as a Service (SaaS). Access to Akkroo online services are only available over a secure (HTTPS) internet connection.
In addition, for technical users with escalated access privileges, we manage access through key based role and permissions management.
How we handle data life in our data retention and protection policies can be found here.
Any new system level components installed with vendor default settings in place are reset beforehand to remove risk of unsecure defaults.
Any redundant components, protocols, services and functions are shut down and removed as soon as technically feasible.
Any audit logs are established to be kept for a period of at least 1 year, with the last three months to remain immediately available.
Any new service, protocol and or additional grant of port access are subject to our Change Management & Change Control Policies.
Change Control provides an orderly way to make changes to key process at Akkroo. It means notifying anyone affected by the change, and listening to the response should the change adversely affect team members or customers. It also means devising reasonable contingency plans for restoring the system if a change doesn't work.
By using a series of standardized and repeatable procedures and actions, we are able to introduce changes to the Akkroo infrastructure in such a way that any negative impact is minimized
This policy describes the process that is to be used for requesting and managing these changes. The following are the key roles specific to the Change Control process. One individual may be responsible for several roles as well as several individuals may be fulfilling a single role.
Our risk assessment & management programme is by our internal, cross-functional Risk Team.
All Akkroo team members share in the responsibility for ensuring the information assets we handle are given an appropriate level of protection by observing this Information Classification policy:
All company owned information and information entrusted to us from third parties falls into one of four classifications:
It is our policy that Customer Confidential data must not be sent via email or any publicly accessible electronic communication service without first being encrypted with a secure password that complies with our internal password policies. Data should only be transitted this way when other internal facing methods are not available. Passwords must be transmitted by a unassociated medium other than the medium the files are transmitted, such as via phone call.
We also do not ordinarily permit the storage or transfer of Customer Confidential data on removable media such as USB keys and external hard drives. Should it be necessary or unavoidable, any such data transferred or stored on removable media must be encrypted with a secure password that complies with our internal password policies.
Our staff are issued with modern Apple devices for the conduct of their work, and we encourage them to run all updates in a timely manner, advise them on security. Critical OS updates are enforced by the manufacturer, or by us as necessary.
We deliver security training to all new team members and enforce disk encryption for all company issued devices.
We maintain a centralised, fast, secure reporting system for the communication of all security and privacy issues. If a security or privacy issue is raised, a director of the business is immediately notified to co-ordinate the evaluation and necessary response, and the nature of the incident is logged alongside details, who is involved, actions taken and proposals for future action.
Should it be determined as necessarily significant during this evaluation, we will communicate the nature of the security incident or breach to affected parties including customers as soon as we are able within the context of the situation, and in a manner which we believe will not exacerbate the worsening of the issue.
We will also notify the relevant authorities as soon as feasibly possible.
We run a Clean Desk Policy at Akkroo. We do not permit the printing or creation of physical copies of customer data, and we do not provide printing facilities for our teams, so there is no need to issue printer controls (biometrics, card controls etc).
Should an extraordinary instance arise where we need to create physical record of customer data, permission must be sought from a member of the leadership team, a record made of its existence, and any such items will be stored in locked cabinets in the office overnight and securely destroyed on-site when no longer needed.
Application Updates are managed with a formalised version control flow, and go through a process of development team testing, wider internal testing (both automated and human), and pre-release testing with the live database
The final deployment of an Application update is automated and migrating to a new version requires no humanly noticeable downtime.
We update our servers with new patches on a monthly schedule. We also monitor for zero-day critical vulnerabilities and implement fixes within 24 hours or sooner where a patch is available.
We support the current and immediately prior major version of the iOS operating system. We offer limited support for specific Android devices. We provide an up to date list of supported devices and operating systems here.
Official social media accounts are managed and operated by a small number of authorised senior staff members. Access is granted and revoked on a case by case basis.
We do not currently record phone calls made to our support team, however we may opt to update this policy in the future.
We review all of our internal policies on an as-needed basis, and also on a scheduled annual basis.
We carry out a scheduled three-layer penetration test conducted by trusted third-party security company each year.
Our policy is that all reported issues are assessed within three business days, and remedied as fast as possible.
The scope of our penetration test consists of:
An abbreviated summary of our most recent penetration test (scope, results and remedial) are available for download. For reasons of infrastructure security, we will not be able to supply the unabridged report.
If you are collecting personal data from European citizens after May 2018, your activity will be subject to the European General Data Protection Regulation. This even applies to European citizen data shared or captured outside of European geographical boundaries.
You can find out more about Akkroo's commitment to meeting the requirements of the GDPR right here – GDPR & Akkroo.
For more information about the impact of GDPR on your own lead capture activity, view our comprehensive guides on GDPR for Events.
You can also find a copy of our Data Processing Addendum here.