GDPR Compliance

Kahrbon is committed to protecting the privacy and rights of individuals in accordance with the General Data Protection Regulation (GDPR). This page explains how we comply with GDPR requirements and how we help our customers fulfill their own GDPR obligations.

The GDPR applies to organizations operating within the European Union (EU) and European Economic Area (EEA), as well as organizations outside these areas that offer goods or services to, or monitor the behavior of, EU/EEA residents.

2.1 Kahrbon as Data Controller

Kahrbon acts as a Data Controller when we collect and process personal data for our own purposes, such as:

• Account registration and management for our customers
• Marketing communications (with consent)
• Website analytics and improvement
• Customer support interactions

2.2 Kahrbon as Data Processor

Kahrbon acts as a Data Processor when we process visitor data on behalf of our customers. In this role:

• Our customers (the organizations using Kahrbon) are the Data Controllers
• We process visitor data according to our customers' instructions
• We have implemented technical and organizational measures to ensure data security
• We only use sub-processors who provide sufficient GDPR guarantees

4.1 For Kahrbon Customers

If you are a Kahrbon customer (account holder), you can exercise your rights by:

• Accessing and updating your account information through your dashboard
• Exporting your data using our built-in export tools
• Deleting your account through account settings or by contacting us
• Emailing us at [email protected]

4.2 For Visitors

If you are a visitor who checked in at a location using Kahrbon, you should contact the organization you visited directly, as they are the Data Controller for your visitor data. They can process your request using tools within the Kahrbon platform.

If you cannot reach the organization, you may contact us at [email protected] and we will assist in forwarding your request.

4.3 Response Time

We will respond to your request within one month of receipt. If your request is complex or we receive numerous requests, we may extend this by up to two additional months, and we will inform you of any extension.

Under GDPR, we must have a lawful basis for processing personal data. The legal bases we rely on include:

5.1 Contract Performance

Processing necessary to provide our Services to customers under our Terms of Service.

5.2 Legitimate Interests

Processing necessary for our legitimate business interests, such as improving our Services, fraud prevention, and security, where these interests are not overridden by your rights.

5.3 Consent

Processing based on your explicit consent, such as for marketing communications or certain cookies.

5.4 Legal Obligation

Processing necessary to comply with legal requirements, such as tax reporting or responding to law enforcement requests.

Kahrbon is headquartered in the United States. When we transfer personal data from the EU/EEA to the United States or other countries, we use the following safeguards:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses for transfers to countries without an adequacy decision.
• EU Data Centers: For customers requiring data residency within the EU, we offer hosting in our EU data centers.
• Supplementary Measures: We implement additional technical and organizational measures to protect transferred data, including encryption and access controls.

As required by GDPR Article 28, we offer a Data Processing Agreement (DPA) to our customers that sets out:

• The subject matter and duration of processing
• The nature and purpose of processing
• The types of personal data processed
• The categories of data subjects
• The rights and obligations of both parties
• Security measures we implement
• Sub-processor requirements
• Assistance with data subject requests

Enterprise customers can request a copy of our DPA by contacting [email protected].

We use trusted sub-processors to help deliver our Services. All sub-processors are contractually bound to protect personal data and comply with GDPR requirements:

We will notify customers of any changes to our sub-processors with at least 30 days' notice.

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access, multi-factor authentication, and audit logging
• Regular Testing: Annual penetration testing and vulnerability assessments
• Incident Response: Documented procedures with 72-hour breach notification
• Employee Training: Regular security and privacy awareness training

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our customers can configure their own retention periods for visitor data within the Kahrbon platform, ranging from 30 days to 7 years depending on their compliance requirements.

When data is no longer needed, it is securely deleted or anonymized.

10.1 Retention Period Guidelines

10.2 Data Deletion Process

Upon expiration of the retention period or receipt of a valid deletion request, data undergoes our secure deletion process:

• Soft deletion: Data is immediately marked as deleted and becomes inaccessible
• Hard deletion: Within 30 days, data is permanently removed from active systems
• Backup purge: Within 90 days, data is removed from all backup systems
• Verification: Deletion completion is logged and can be audited

Kahrbon implements privacy by design principles as required by GDPR Article 25. This means we consider data protection implications at every stage of product development and service delivery.

11.1 Data Minimization

We only collect personal data that is necessary for the specified purposes.

11.2 Purpose Limitation

Personal data is processed only for the purposes specified at the time of collection. We do not use visitor data for marketing purposes, sell data to third parties, or process data in ways that are incompatible with the original purpose.

11.3 Default Privacy Settings

Our platform is configured with privacy-protective defaults out of the box. Features that involve additional data processing, such as photo capture or ID verification, are opt-in and require explicit configuration by the customer.

11.4 Transparency

We provide clear privacy notices at the point of data collection. Our kiosk interface displays customizable privacy information to visitors, explaining what data is being collected and why.

Kahrbon conducts Data Protection Impact Assessments (DPIAs) as required by GDPR Article 35 for processing activities that are likely to result in high risk to individuals' rights and freedoms.

We have completed DPIAs for the following features:

• Visitor photo capture and storage
• ID document verification
• Watchlist screening
• Biometric authentication (where offered)
• Location tracking within facilities

Enterprise customers can request summaries of relevant DPIAs by contacting our Data Protection Officer.

In the event of a personal data breach, Kahrbon will:

• Detect and contain: Our security monitoring systems are designed to detect breaches quickly, and we have procedures in place to contain incidents immediately
• Assess the risk: We will evaluate the nature and severity of the breach and the risk to affected individuals
• Notify customers: We will notify affected customers without undue delay, and in any event within 48 hours of becoming aware of a breach that affects their data
• Support customer notification: We will provide customers with information necessary for them to notify their supervisory authority (within 72 hours as required by GDPR) and affected individuals as appropriate
• Document: We maintain records of all breaches, including facts, effects, and remedial actions taken