Gatekeeper Systems Privacy Notice

1. Who this privacy notice applies to

This privacy notice applies to the following data subject categories and covers the use of personal data when:

• You visit our website www.gatekeepersystems.com, (website visitor);
• Interact with us for product information (contact page, sales contact form or vendor and service company inquiry form, through phone and email enquiries), (sales enquiry);
• Sign up to receive more information through the Learn More and MarketWatch pages (newsletter subscriber);
• When you access our GDOCS platform, (implementers and GKS staff);
• When you apply to a position directly for our vacancies. (job applicant);
• When you are interact with us at trade shows or were contacted by us when cold calling (lead or a customer representative);
• When you make use of our platform as an employee of our customers;
• When you use our platform as a video classifying agent.

This section of the privacy notice applies to all individuals and customers. If you are accessing from California, Europe or the UK, a different section of the privacy notice will also list additional COPPA and GDPR-related information depending on jurisdiction (see links above).

2. Who this privacy policy does not apply to

If you are a store shopper and you believe your personal data was collected in a retail area where Gatekeeper Systems solutions are implemented, whether you are an employee or a patron or store visitor, please approach the store owner for more information on what data protection rights are available to you and how to exercise them. As a data controller (GDPR Art.4.7), making use of our solutions, the retail company owner of the shop you visited is the custodian of your data and your data protection rights.

3. What data we need and why we need it

In the tables below, you will find the following information:

a) Context and data subject category: provides background information and helps determine whether this processing actually applies to you.
b) Activity processing your data: describes a business need or a service that makes use of your data.
c) Purpose served: describes that business need or service.
d) Categories of personal data: outlines the exact data being processed.
e) Legal base for the process of your personal data (GDPR and UK GDPR-relevant only)
f) Retention period for this data: specifies how long that data is retained for the purpose (stated in c.).
g) Selling of information: indicates whether and what PII is sold. (CCPA-relevant only)

There are several scenarios in which we collect and process your personal data.

Please locate the scenario of interest to you in the relevant table below to identify what data is processed in which context.

Please note that the following scenarios apply to all data subjects listed in Section 1 regardless of jurisdiction (unless specified as US-only). The controller for the following processing activities is Gatekeeper Systems Inc., with details included below.

4. Data processing by GatekeeperSystems Inc.

GKS Inc. (USA)

Who We Are

For the data collected in the scenarios below, Gatekeeper System, Inc. is a data controller/business that controls the collection of a consumer’s personal information.

To exercise a subject rights request or to ask questions relative to how your data is processed, this is how you may contact us:

Gaterkeeper Systems, Inc.

90 Icon, Foothill Ranch
CA 92610, USA
+1.949.453.1940
info@GatekeeperSystems.com

4.1. Providing the website, the platform and marketing services

4.2. Provision of products and services

4.3. What third parties do we share/disclose your data with/to?

4.4. Are other websites accessible through our website?

Yes. Our site does have links to the websites of affiliates, including the GNET, StorePort and StorePortG2 websites. Your use of such sites is strictly governed by those respective sites’ posted terms and conditions and privacy policies. We encourage you to read such terms and policies.

4.5 How do we protect your information?

To prevent unauthorised access or use of your information, we have put in place commercially reasonable and appropriate administrative, technical and physical procedures to safeguard the information we collect through the Site. These include:

1. Encryption
   Encrypted video transfer, post processing and storage to localized encrypted-at-rest video storage in the EU*. This ensures that video data is encrypted while stored on the servers and in transit. Encryption standard used: HTTPS with TLS 1.2 protocol and AES-256.
2. Building security camera access control
   A switch is maintained in a locked cabinet and by default the keys are not available to store personnel. During an installation the WiFi temporarily enabled.

4.5. Do we use Cookies?

Yes. Cookies enable us to personalise your web browsing experience.

4.6. Do we track information about your online activities?

Our Site does not currently respond to “Do Not Track” signals sent from your browser. However, we do not collect information about your online activities over time, across third party websites or through other online services. As mentioned above, we do use Google Analytics and Hotjar to support our Site, which involves the automatic collection of information such as the web address of our Site and your IP address. For more information about the use of Google Analytics, see Google’s privacy policy. For more information about the use of Hotjar, see Hotjar’s privacy policy.

5. US and California residents

Please note that the following scenarios apply to data subjects listed in Section 1 residing in the United states and California. The controller for the following processing activities is Gatekeeper Systems Inc., with details included in Section 2.

California Consumer Privacy Act

We will not distribute your personal information to third parties for the purposes of marketing or advertising third party products to you without obtaining your consent in advance.

You have the following additional data subject rights under the California Online Privacy Protection Act:

1. The right to not be discriminated against for exercising your rights,
2. The right to object to the selling of your information.

5.1 COPPA – Children’s Online Privacy Protection Act

We do not intentionally collect information from any individual under 13 years of age. Our Site, products and services are all directed to people who are at least 18 years of age or older.

6. UK Resides and UK GDPR provisions

On top of the processing activities listed in Section 2, the following information applies specifically to data subjects located in the United Kingdom.

Data processing by Gatekeeper Systems Ltd.

GKS Ltd. (UK)

Who We Are

For the data collected in the scenarios below, Gatekeeper System, Ltd. is a data controller in the meaning of UK GDPR Art.4.7.

To exercise a subject rights request or to ask questions relative to how your data is processed, you may contact us using:

Gatekeeper Systems, Ltd.

27/28 Eastcastle Street
London, W1W 8DH, United Kingdom
01455882900
privacyuk@gatekeepersystems.com

Our appointed data protection officer

TechGDPR DPC GmbH,
Heinrich Roller Str. 15,
10405 Berlin, Germany
+493054908661
gatekeeper.dpo@techgdpr.com

Supervisory authority of registration

Information Commissioner’s Office
Water Lane, Wycliffe House, Wilmslow- Cheshire SK9 5AF
Nr: + 44 1625 545 700
Elizabeth Denham
https://ico.org.uk

6.3. UK Data Subject Rights

As a data subject located in the United Kingdom, you have the following rights with respect to us regarding the data relating to you:

• Right to information about your stored personal data, its origin and possible recipients and the purpose of the data processing (Art. 15 GDPR),
• Right to rectification of inaccurate data (Art. 16 GDPR),
• Right to erasure of processed personal data, unless processed to fulfil a legal obligation or public interest (Art.17 GDPR), or there are statutory retention periods (see point 12.)
• Right to restriction of processing (Art. 18 GDPR),
• Right to withdraw your consent. We will then no longer continue the processing based on this consent for the future. The lawfulness of the processing carried out on the basis of the consent until the revocation is not affected by the revocation. (Art. 7 GDPR),
• Right to data portability but only in instances where data is processed on the basis of consent or performance of a contract (Art. 20 GDPR),
• Right to object within the framework of the legal requirements. Should the data processing by us be based on legitimate interests, you have the right to object to the processing of your data at any time for reasons arising from your particular situation. You may object to the processing of your data for direct marketing purposes at any time, even without giving reasons (Art. 21 GDPR).

You have the right to revoke your consent at any time. This means that we will no longer process the data based on this consent in the future. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

If we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time on grounds relating to your particular situation. If it is a matter of objecting to the processing of data for direct marketing purposes, you have a general right of objection, which will also be implemented by us without giving reasons.

How you can exercise your rights

If you wish to exercise your right of revocation or objection, it is sufficient to send a message to the relevant Gatekeeper Systems entity.

On top of the rights indicated in the table above you also have the rights to lodge a complaint with the supervisory authority should we fail to respond to your request within a month or if you judge the response unsatisfactory. We are registered with the UK ICO but you can contact the authority of your choice.

7. EU Resides and GDPR provisions

On top of the processing activities listed in Section 2, the following information applies specifically to data subjects located in the European Union.

Data processing by GatekeeperSystems GmbH

GKS GmbH (DEU)

Who We Are

For the data collected in the scenarios below, Gatekeeper System GmbH is a data controller in the meaning of GDPR Art.4.7.

To exercise a subject rights request or to ask questions relative to how your data is processed, you may contact us here:

Gatekeeper Systems GmbH

Albertstr. 2‐6
73054 Eislingen, GERMANY
info@gks-eu.com

Our appointed data protection officer

TechGDPR DPC GmbH,
Heinrich Roller Str. 15,
10405 Berlin, Germany
+493054908661
gatekeeper.dpo@techgdpr.com

Supervisory authority of registration

We are registered with the
Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, GERMANY

7.3. EU Data Subject Rights

As a data subject located in the European Union, you have the following rights with respect to us regarding the data relating to you:

• Right to information about your stored personal data, its origin and possible recipients and the purpose of the data processing (Art. 15 GDPR),
• Right to rectification of inaccurate data (Art. 16 GDPR),
• Right to erasure of processed personal data, unless processed to fulfil a legal obligation or public interest (Art.17 GDPR), or there are statutory retention periods (see point 12.)
• Right to restriction of processing (Art. 18 GDPR),
• Right to withdraw your consent. We will then no longer continue the processing based on this consent for the future. The lawfulness of the processing carried out on the basis of the consent until the revocation is not affected by the revocation. (Art. 7 GDPR),
• Right to data portability but only in instances where data is processed on the basis of consent or performance of a contract (Art. 20 GDPR),
• Right to object within the framework of the legal requirements. Should the data processing by us be based on legitimate interests, you have the right to object to the processing of your data at any time for reasons arising from your particular situation. You may object to the processing of your data for direct marketing purposes at any time, even without giving reasons (Art. 21 GDPR).

You have the right to revoke your consent at any time. This means that we will no longer process the data based on this consent in the future. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

If we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time on grounds relating to your particular situation. If it is a matter of objecting to the processing of data for direct marketing purposes, you have a general right of objection, which will also be implemented by us without giving reasons.

How you can exercise your rights

If you wish to exercise your right of revocation or objection, it is sufficient to send a message to the relevant Gatekeeper Systems entity.

On top of the rights indicated in the table above you also have the rights to lodge a complaint with the supervisory authority should we fail to respond to your request within a month or if you judge the response unsatisfactory. We are registered with the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, but you can contact the authority of your choice.

7.5. How do we protect your information?

To prevent unauthorised access or use of your information, we have put in place commercially reasonable and appropriate administrative, technical and physical procedures to safeguard the information we collect through the site.

We implement the following technical measures:

1. Encryption of data sets
   We encrypt the mail contents and data stored in the cloud, as well as the email header and body. For the external digital exchange of data media, care is taken to sufficiently strongly encrypt the data e.g. with BitLocker.
2. Building security, access control and visitor logging
   We implement physical entry security. External visitors request access via an intercom. We also implement system access control and logging of visitors at the reception. The physical security perimeter is defined and visible. Outside of the office hours, access to the building requires a key whereas access to individual offices requires a key at all hours. Visitors are granted access only after registration and have limited access prior to being greeted by a staff member.
3. System and data, access control, VPN and IP filtering 
   Remote work is only possible if VPN is used and IP filtering is implemented.
4. Protection from viruses
   Our Microsoft terminals are equipped with a centrally-managed antivirus which cannot be deactivated by the user. Firewalls on mobile phones are updated automatically. WLAN network segregation is implemented. Unused LAN sockets are deactivated
5. Laptop encryption
   We implemented the following two encryptions on laptops:
   1. Laptop encryption (type1) : hardware-based SSD encryption in the BIOS (OPAL SSC: AES-128/256bit encryption)
   2. Laptop encryption (type2) : hard disk encryption, e.g. Bitlocker with AES-128/256bit, or TrueCrypt/VeraCrypt with AES, Twofish or Serpent, or dm-crypt/crypt-setup/LUKS with AES, Twofish.
6. Data media security
   A governed internal use of mobile media is implemented.
7. Backup security
   Backups are required when installing and configuring files. Backups are password protected.
8. Data deletion 
   Deletion is defined for encrypted data.
9. Management of removable media
   The use of private data media is not permitted.
10. Event logging
    External data sharing requires explicit data owner permissions.
11. Assets handling
    Data export to mobile data carriers occurs only after a documented customer request. Data exports are logged and are traceable.
12. Protection from malware
    All windows computers are equipped with a virus scanner. For windows users, signature update intervals take place daily & heuristic detection is enabled (ESET).The virus scanner is also activated in servers. All workstations are equipped with an operating system Software firewall. Outgoing traffic from workstation clients is filtered via an application-level firewall (web proxy), which also breaks open TLS connections and analyzes their content. User rights are achieved through group membership, so that connections are only possible to preconfigured content types of web pages. A software firewall is installed on all servers, the configuration of which maps the requirements of data exchange between the systems, and thus limits communication to the ports/services and, if necessary, IP ranges. Servers with increased protection requirements are in a separate ring of protection and can only be accessed via upstream proxies or load balancers with their own fire
13. User controls/ authorizations
    The user rights are restricted to the areas of activity according to the minimum principle. Each user or their user profile is assigned to a department-dependent role that reflects the necessary authorisations for their tasks. The group / department head works out the authorisation matrix with the data protection officer and forwards it to the specialist department for the allocation of authorisations. When a person joins a department, the role and thus the authorisation is determined on the basis of this matrix; when the person leaves the department, the assignment of rights is reversed.
14. Access controls
    Access authorisations are assigned on a role-based basis. For systems that cannot manage roles, authorisation levels are predefined, requested, assigned and rolled out for a user. Role authorisations are designed by the group/department head based on the task, tested, and documented in a matrix. Individual authorisations are documented for each system. As part of the onboarding process the rights are requested by the group/department and set by the Software Engineering / IT department. In the offboarding process, these assignments are reversed. Passwords secure system access and are therefore at the heart of security requirements. Password policy: at least 8 characters, at least 3 of 4 criteria (upper case letter, lower case letter, digit, special character). For core systems, the password must be at least 12 characters long for administrative access. The use of password management programs is encouraged. Logging of changes made to data sets.
15. Transfer controls
    E-mail communication is encrypted. Automatic data transfers are traceable. When sending e-mails, the target address is read out from the DNS resolution for the determined target domain, starting from the customer configuration. The electronic data transmission is logged with date, time, message ID, sender, recipient, send and receive IP, reverse DNS name, if any, and SMTP error code. The logs are deleted according to the deletion matrix.
16. Transport controls
    Ensures that the confidentiality and integrity of the data physically transported out of our company is protected. For the external digital exchange of digital data media sufficiently strong encryption of the data data is used, e.g. Bitlocker or 7zip. External exchange only takes place with the explicit, documented permission of the data owner.
17. Restorability
    The IT department is responsible for the correct operation, the follow-up of system messages and the configuration of the data backup. This is carried out with open source software or proprietary software. In the event of a malfunction, the operating system, configuration and data can be transferred through partially or fully automated installation (data restore and/or automated deployment). The systems are backed up automatically every 24 hours and the data status of the last 30 days are available. The backup is carried out per Computer centre and office in Schwäbisch Gmünder with local agents via the internal gigabit network centrally on a backup system with hard disk RAID. This allows for a restore to be started within a few minutes. Deletion periods are observed in accordance with legal requirements. Documented test restores take place.A disaster recovery plan is in place. For disaster preparedness, at least one remote data center site in Germany is used for operations, which are maintained by certified operators. This data center has redundant power supply, network supply, air conditioning and extinguishing systems on its own. Data processing is already fully guaranteed with the operation of a single data center. The second and further data centers are used to increase redundancy. Central data systems are additionally doubled with automatic replication as well as hot-fail-over functionalities. Communication and exchange of data is always encrypted.
18. Data integrity
    Specification of functional and non-functional new projects using a customised version. A 4-eyes principle is applied for all changes to live systems. Changes to authorization and configuration objects and personal data are possible via the control panel. Every action – incl. (failed) logon – is recorded in the audit log with date, time, logon name, action, object and original IP address. For the authorization management there are three standard authorization roles: user, customer administrator, partner. Individually definable authorizations, which are also made available as roles are possible. Users are assigned to these roles. Data transfer takes place exclusively over encrypted connections (VPN or TLS). Data transfers from tier 1 (front end) to tier 2 or from tier 2 to tier 3 (back end) are only possible for defined end points.
19. Data Processing Agreements
    We only select processors that meet the requirements of the GDPR and conclude GDPR-compliant DPAs. When awarding contracts to contractors, the points required by the GDPR are contractually fixed. If the processor is not able to do this, a DPA will not be concluded. We ensure the deletion of data after the DPA termination. There is an ongoing review of processors. Gatekeeper Systems GmbH attaches great importance to documented and practised data protection and IT security processes and checks the documentation. Contracts with contractors are only concluded if they clearly commit themselves contractually to compliance with confidentiality and data protection.
20. Separation controls
    We separate the control and test systems. Logically and physically separate systems with their own database and data structure are used for internal purposes (e.g. development, testing and backup).
    We implement  a logical separation of clients. Client separation is set up so that a client (cloud user) does not receive unauthorized information from other clients (cloud users). It ensures that no client can access the resources of another client, for example, to virtual machines, networks or cloud storage (OwnCloud). All data is stored by the client in dedicated tables for each client.
21. Organisational controls
    We implement regular review and evaluation cycles. An internal reporting process encourages all employees to escalate detected irregularities. An employee receives the information and adjusts existing processes with the involvement of the relevant group leaders. Employees receive feedback on reported issues. Regular checks and, if necessary, adjustments are made to the measures to determine whether they are still state of the art. Regular network scans check for occurrence of unauthorised service provisioning.
    Employees (incl. interns, student assistants) are regularly instructed in writing about data protection and must confirm this by signature (1x per semester). Regular information is provided on processes and topics relevant to data protection; participation is mandatory. The contents are available on an internal drive for all employees to read.
    We have created a deletion concept. Gatekeeper Systems GmbH distinguishes different personal data per service. A detailed matrix of the regular deletion periods can be found in the deletion matrix, which can be requested separately. Deletion in special situations, which is not covered by the regular deletion periods, is carried out on a case-by-case basis with the specialist department responsible for the data storage. The data protection officer is in charge. Suspension of deletion – particularly in the case of archived e-mails – is possible at the request of the customer or an authorized body. If data is stored beyond the times specified in the matrix for regular deletion periods, this is done anonymously by cumulating the data files.
    We have a procedure in place for addressing data subjects rights requests. The GDPR provides a right of access for data subjects (Art. 15 GDPR). RequestS are recorded in the system. A detailed process for requests is made available to staff:
    1. verification whether the request is for information at all.
    2. verification of the identity of the requestor.
    3. checking whether personal data of the data subject have been processed.
    4. if no data are available: Negative notification to the data subject. if data are available: Compilation and immediate response within one month of receipt. In cases of extension of the deadline, the applicant will be informed of this immediately.A data carrier disposal concept is implemented. In the event of a defect, data media on which customer data was once stored will not be claimed but sent directly to data media destruction. Reuse of a data carrier once provided with customer data is also excluded. Data media to be destroyed are collected under lock and key. Data media are professionally destroyed by a certified provider who is contracted by Remynd Systems GmbH as required. The destruction of data media is monitored and recorded. If the data carriers to be deleted are servers used abroad with built-in data carriers, the following regulation applies: – Deletion of all personal data, configurations and scripts for the services – Installing and running a wipe Program – Remynd Systems GmbH is responsible for disposal of the data.
22. Secure storage
    Secure long term storage of invoices on NextCloud (Remynd).

8. Changes to our privacy notice and contact details

Changes to our Privacy Policy

If we decide to change our Policy we will post those changes on this Site. Each posted Privacy Policy will include the latest date of revision.

Contact

This site is owned and operated by Gatekeeper Systems, Inc. If you have any questions concerning this Policy and our site’s use of your information, please contact us at: info@gatekeepersystems.com or 888.808.9433.