Skip to main content

GDPR Compliance

How Kuviq helps you comply with the General Data Protection Regulation (GDPR) and other data protection requirements.

Overview​

GDPR is a European Union regulation that governs how personal data must be handled. Kuviq provides features and tools to help you meet these requirements.

Key GDPR Principles​

PrincipleDescription
LawfulnessProcess data with legal basis
Purpose LimitationOnly use data for specified purposes
Data MinimizationCollect only necessary data
AccuracyKeep data accurate and up-to-date
Storage LimitationDon't keep data longer than needed
Integrity & SecurityProtect data from unauthorized access
AccountabilityDemonstrate compliance

Personal Data in Kuviq​

What Constitutes Personal Data​

Data that identifies individuals:

  • User accounts - Names, emails, phone numbers
  • Inspection records - Who performed inspections
  • Audit logs - Activity records with user details
  • Signatures - Digital signatures on inspections
  • Photos - If they contain identifiable individuals

Data Categories​

CategoryExamplesRetention
Account DataEmail, name, roleUntil account deleted
Activity DataLogins, actionsPer retention policy
Content DataInspections, notesConfigurable
Technical DataIP addresses, device infoLimited period

Your Rights Under GDPR​

Right of Access​

Users can request their data:

  1. For users:

    • Go to Profile > Privacy
    • Click Download My Data
    • Receive data export

  2. For admins:

    • Go to Settings > Privacy
    • Select user
    • Generate data export

Right to Rectification​

Correct inaccurate data:

  1. Personal information:

    • Edit user profile
    • Update contact details
    • Correct name spelling

  2. Inspection data:

    • Edit inspection (if permitted)
    • Add corrections
    • Document reason for changes

Right to Erasure​

Request data deletion:

  1. Self-service:

    • Profile > Privacy
    • Request Account Deletion
    • Confirm request

  2. Admin-initiated:

    • Settings > Users
    • Select user
    • Delete User Data

Right to Portability​

Export data in standard format:

  1. Go to Profile > Privacy
  2. Click Export My Data
  3. Choose format (JSON, CSV)
  4. Download package

Right to Restriction​

Limit how data is processed:

  1. Contact administrator
  2. Request processing restriction
  3. Admin applies restriction
  4. Limited operations allowed

Admin Tools for GDPR​

Data Subject Requests​

Handle user requests:

  1. Receive request

    • Through any channel
    • Document receipt

  2. Verify identity

    • Confirm requester identity
    • Document verification

  3. Process request

    • Access, export, or delete
    • Within 30 days

  4. Document response

    • Record action taken
    • Maintain audit trail

Track user consent:

  1. Record consent

    • When obtained
    • What for
    • How given

  2. Consent preferences

    • Users set preferences
    • Respect choices

  3. Withdrawal

    • Easy to withdraw
    • Stop processing

Data Retention Settings​

Configure retention periods:

  1. Go to Settings > Privacy > Data Retention
  2. Set retention for each data type
  3. Enable automatic deletion
  4. Document policy

Data Processing​

Data Processing Agreement (DPA)​

Kuviq acts as a data processor:

  • You are the data controller
  • Kuviq processes data on your behalf
  • DPA available for download
  • Required for GDPR compliance

Getting the DPA​

  1. Go to Settings > Legal > Documents
  2. Download DPA
  3. Review and sign
  4. Upload signed copy
  5. Or contact support

Sub-processors​

Third parties that process data:

ServicePurposeLocation
Cloud HostingInfrastructureEU/US
Email ServiceNotificationsUS
AnalyticsUsage analysisEU
SupportCustomer serviceEU

Full list available in Settings > Privacy > Sub-processors

Security Measures​

Technical Measures​

Data protection technology:

MeasureImplementation
Encryption in TransitTLS 1.3 for all connections
Encryption at RestAES-256 for stored data
Access ControlsRole-based permissions
Authentication2FA available
Audit LoggingAll actions recorded

Organizational Measures​

Security practices:

  • Regular security training
  • Access reviews
  • Incident response plan
  • Security policies
  • Vendor assessments

Data Deletion​

Deleting User Data​

To delete a user's data:

  1. Go to Settings > Users
  2. Find the user
  3. Click Delete User
  4. Choose deletion options:
    • Keep inspection records (anonymize)
    • Delete all records
  5. Confirm deletion

What Gets Deleted​

Data TypeStandard DeletionFull Deletion
User ProfileYesYes
Login HistoryYesYes
Inspection RecordsAnonymizedDeleted
Audit LogsAnonymizedAnonymized*
Photos with UserRetainedDeleted

*Audit logs may be retained anonymized for compliance

Deletion Timeline​

  • Request received: Same day confirmation
  • Verification: Within 24 hours
  • Deletion processed: Within 30 days
  • Backups purged: Within 90 days

Data Export​

Personal Data Export​

Export includes:

  • Account information
  • Login history
  • Activity records
  • Inspection data (where identifiable)
  • Preferences and settings

Export Format​

Standard format includes:

{
  "user": {
    "email": "user@example.com",
    "name": "John Doe",
    "created": "2024-01-15",
    "role": "Manager"
  },
  "activity": [
    {
      "date": "2024-01-20",
      "action": "Login",
      "details": "..."
    }
  ],
  "inspections": [
    {
      "id": "INS-001",
      "date": "2024-01-20",
      "item": "Fire Extinguisher"
    }
  ]
}

Privacy Settings​

Organization Settings​

Configure privacy:

  1. Settings > Privacy

    • Data retention periods
    • Auto-deletion policies
    • Consent requirements

  2. Cookie Settings

    • Essential only
    • Analytics (optional)
    • Marketing (optional)

User Privacy Controls​

Each user can:

  • View their data
  • Export their data
  • Request deletion
  • Manage preferences
  • Control notifications

Breach Notification​

What Is a Breach​

A security incident involving personal data:

  • Unauthorized access
  • Data theft
  • Accidental disclosure
  • Data loss

Notification Requirements​

GDPR requires:

  1. Authority notification: Within 72 hours
  2. User notification: Without undue delay (if high risk)

Kuviq Support​

If a breach occurs:

  1. Kuviq notifies you immediately
  2. Provides incident details
  3. Supports investigation
  4. Assists with notifications

Reporting a Suspected Breach​

If you suspect a breach:

  1. Contact security@kuviq.io immediately
  2. Provide details
  3. Don't share sensitive info via unsecured channels

Documentation​

Required Records​

Maintain documentation of:

  • Data processing activities
  • Legal basis for processing
  • Data subject requests
  • Consent records
  • Security measures

Kuviq Provides​

  • Processing activity records
  • Data subject request logs
  • Audit trails
  • Security documentation
  • Sub-processor list

Compliance Checklist​

For New Organizations​

  • Review and sign DPA
  • Configure privacy settings
  • Set data retention periods
  • Train administrators
  • Document legal basis
  • Implement consent processes

Ongoing Compliance​

  • Regular access reviews
  • Handle data requests promptly
  • Monitor for breaches
  • Update retention settings
  • Review sub-processors
  • Annual compliance review

Resources​

Documentation​

  • Data Processing Agreement
  • Privacy Policy
  • Sub-processor List
  • Security Whitepaper

Support​

External Resources​