Last Reviewed and Approved: November 14, 2023
The personal data that we collect includes:
Digilock takes your privacy very seriously and does not disclose, share, or sell your data without your consent, unless required to do so by law. We only retain your data for as long as is necessary and for the purpose(s) specified in this notice or required by law. Where you have consented to us providing you with promotional offers and marketing, you are free to withdraw this consent at any time.
The purposes and reasons for processing your personal data are detailed below:
Under data privacy laws and regulations, you are entitled to several individual rights pertaining to your personal information processed by Digilock, including:
Depending on the privacy law or regulation applicable to our business and your personal information, you may have additional rights under privacy law, including the right to data portability of your information and the right to be informed about any automated decision-making we may use.
If you would like to request that we perform any activities related to your rights under privacy law, please submit a request to our team using our Data Privacy Request Form.We will review your request and process as deemed necessary and appropriate considering your rights under privacy law, our privacy practices, and any applicable legal exceptions. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.
We will review your request and process as deemed necessary and appropriate considering your rights under privacy law, our privacy practices, and any applicable legal exceptions. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.
Digilock utilizes the third-party systems and service providers to conduct business activities and delivery our products and services. Use of our products and services may include the collection and processing of your personal information via use of these third-party services. We have established agreements with these third parties, which include the appropriate safeguarding of any personal information being processed by their services, and we monitor the activities of our third-party service providers to evaluate their adherence to these agreements.
Digilock takes your privacy seriously and takes reasonable measures and precautions to protect and secure your personal data. We work hard to protect your information from unauthorized access, alteration, disclosure or destruction and have several layers of security measures in place, including implementation and use of:
Access. We implement user authentication and user access management procedures to prevent unauthorized access to your data. Customers that use our DigiLink or PackageHold web applications may input personal information into the web applications to facilitate the functioning and use of the application and our services. These users are required to validate their identity via user authentication and are responsible for managing access to their web application environment.
Least-Privilege. Our policies and procedures for access control require that access to your data be limited to our personnel as required to perform necessary and appropriate roles and responsibilities, in connection with our services and commitments for security, confidentiality, and privacy. We restrict access to your information based on these commitments and requirements, limiting access to your data to authorized personnel that must have the access to perform job roles and responsibilities.
Digilock, and our subsidiary Digilock Europe BV, utilizes some products or services (or parts of them) that may be hosted/stored in the USA, which means that we may transfer any information, which is submitted by you through the website, outside the European Economic Area ("EEA") for the below purposes:
Considering, when you use our website, send us an email, or sign up to our newsletter, the personal information you submit may be stored on servers which are hosted in the USA. Where this is the case, we will take steps to ensure that we use secure technologies and solutions when handling for your information and abide by applicable laws, regulations, and contractual obligations to protect your data and comply with the relevant data protection laws.
Additionally, we may share personal data across the Digilock entities. Access to this data is highly restricted outside the EU and can only be processed by limited members of Digilock’s global team.
You are not obligated to provide your personal information to Digilock; however, the receipt of your personal information may be required for us to provide you with our services or deliver your products. If you do not consent or provide other authorization to use your personal information, we may not be able to offer some of our services without it.
As mentioned in the 'How We Use Your Personal Data' section of this policy, we occasionally process your personal information under the legitimate interest legal basis. Where this is the case, we have carried out a thorough Legitimate Interests Assessment (LIA) to ensure that we have weighed your interests and any risk posed to you against our own interests; ensuring that they are proportionate and appropriate.
We use the legitimate interests as our legal basis for processing your personal data and have identified that our interests are direct marketing, keeping our records up to date, identifying and recording which of our products are of interest to you, and seeking your consent when we needed for further data processing.
For our DigiLink and PackageHold web applications, we have determined that we process personal information to adhere to contractual obligations of our customers (system users) which have legally engaged to use our smart lock management and/or package locker management web applications, DigiLink/PackageHold.
Digilock, and our subsidiaries retain personal information for as long as it is necessary to conduct our legitimate interest or contractual obligations, with exception to any legal or regulatory requirements applicable to our business. We follow established policies and procedures for data security and data retention to meet our objectives for data protection and appropriate management of your data.
We conduct a regular review of data processed by our company to ensure that we only retain information needed to conduct our processing activities. Where deemed necessary based on our legal and regulatory requirements, including Dutch tax law, retain your basic personal data (name, address, contact details) for the duration of time needed to conduct necessary processing activities and comply with applicable law and regulation.
We collect consent from our website visitors to collect and process data needed for our company to conduct direct marketing activities. Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent. When you have withdrawn consent, we will remove your data from our system to ensure that we cease processing activities.
Regarding our offered product and services, Digilock is unlikely to collect or process “special category” data (i.e., ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, etc.) about you. In the event that we collect such information, we will only request and process the minimum necessary for the specified purpose and identify a compliant legal basis for doing so.
Most web browsers allow some control to restrict or block cookies through the browser settings; however, if you disable cookies, you may experience a different, more restrictive, ability to use certain parts of our website or services. For more information about cookies visit https://www.aboutcookies.org.
In connection with the use of our products and services, we may use both session cookies (which expire once you close your web browser) and persistent cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on our website, products, or services. We obtain consent to use these cookies via use of our cookie banner on our website, which allows you to allow or deny cookies, and any contractual agreements in place with the delivery of our products or services.
Please note: At all times you are responsible for updating your personal data to provide us with your most current e-mail address. In the event that the last e-mail address that you have provided us is not valid, or for any reason is not capable of delivering to you the notice described above, our dispatch of the e-mail containing such notice will nonetheless constitute effective notice of the changes described in the notice.
9 Willowbrook Court
Petaluma, CA 94954
telephone / 707-766-6000
email / firstname.lastname@example.org
Digilock Europe BV
Contact: Geert.N.W van Dijk
Schillingweg 22, 2153 PL Nieuw-Vennep, The Netherlands
telephone / +31 6 53751414
email / email@example.com
Schillingweg 22, 2153 PL Nieuw-Vennep
telephone / +31 20 303 30 60
At Digilock, we understand the importance of protecting your data. It’s a big deal. With security at the core of our business, products, and services, we understand the importance of protecting valuables, including your personal information.
This article is designed to provide an understanding about privacy practices within our company and our compliance with the General Data Protection Regulation (GDPR) to ensure that the sensitive, confidential, and personal information that we collect and process is handled with care and protected from unauthorized access, disclosure, manipulation, or subject to data breach.
There are many components to data privacy compliance with GDPR, including our responsibility to implement systems and processes that protect personal information processed by our company.
Considering security is one of the primary and fundamental components to GDPR compliance, let’s review security related to our business, products, and services. As a security company, maintaining our security practices is a part of our culture. We implement various policies, procedures, systems, security training, and roles and responsibilities to implement and operate our information security program established to safeguard (or protect) our users' data and limit exposure to data breaches.
Our SaaS web application, DigiLink, used for remote administration and management of our 6G network smart lock products, has successfully completed a SOC 2 Type 2 certification and received a SOC report from an independent CPA firm. This provides a professional opinion that we have implemented appropriate internal controls (or processes) for security, availability, and confidentiality for the IT network of our Digilink web application.
Our SOC 2 Type 2 report demonstrates that we have implemented appropriate security practices and safeguards for our data processing activities. The SOC 2 examination included working with auditors to evaluate the organization, technical, and procedural controls that we have implemented within our IT network to secure our users' data.
The examination includes inspection of security configurations and procedural documentation that supports our implementation of data security best practices technologically, organizationally and culturally.
We will be conducting our SOC 2 Type 2 examination annually to continue to demonstrate our security practices and our ability to implement appropriate safeguards for protecting our users' sensitive, confidential, and personal information.
You can request a copy of our SOC 2 Type 2 report by submitting a request to our Contact Us page. This details all of the above-mentioned security practices for our DigiLink web application.
Data protection is very important in our business, and so is GDPR compliance. Our company has implemented several important pieces to our GDPR compliance program to ensure we maintain compliance with GDPR requirements applicable to our organization. These include the implementation of the following technologies, activities, or justifications supporting GDPR compliance within our company:
Our Data Privacy Request Form
We have updated our Contact Us page to include a form to submit inquiries related to Privacy. This form can be used to request our team to assist with any matters concerning data privacy, personal information, or data subject rights. Our team will review the request and process all valid requests, as deemed appropriate.
Documentation of our Lawful Basis for Processing
Our data processing activities are necessary for the performance of our service contracts with our customers, to which data subjects are an indirect party. Companies that have purchased our smart lock products have entered into an agreement with our company to use our products and services. As a result, we process personal information in connection with the delivery of these products and services.
Documented Instructions and Data Processing Agreement (DPA)
All customer transactions are governed by our terms and conditions published to our company website. Additionally, transactions that are executed by contract/service agreement with our company include additional terms and conditions that are applicable to the respective transaction(s), including transactions related to our DigiLink SaaS product.
Where applicable, a data processing agreement will be executed as a part of the transaction to define data processing activities and data privacy practices to be performed by our organization in accordance with documented instructions.
Implementation of Appropriate Technical and Organizational Safeguards (Security)
As mentioned, we have a SOC 2 Type 2 report that speaks to our security practices for protecting our customers' data. These security practices include the implementation of encryption and access controls technologies/ procedures to ensure we protect our data.
Our SOC 2 and GDPR Compliant Third-Party Data ProcessorsWe utilize third-party processors that are compliant with SOC 2 standards and GDPR. Their compliance with these standards and regulations helps our company to protect personal data, including providing guidance and technologies that help us maintain GDPR compliance.
Designated Individual Responsible for GDPR Compliance and a Data Protection Officer (DPO)
We have designated a DPO within our organization, and our DPO works closely with our Executive Management team (President, Vice President, and Legal) to provide oversight and execution of Digilock’s risk management and data security and privacy practices, including GDPR compliance.
Established a Process for Notifying Supervisory Authorities and Data Subjects of Data Breaches
We have implemented incident response procedures and identified the appropriate supervisory authority to notify in the event of a data breach, which is a requirement for GDPR compliance.
Appoint a Representative within a European Member State
A GDPR requirement for companies that operate outside of the EU, includes appointing a representative within an EU member state that can communicate with data protection authorities in the event of a data breach. Our EU representative is as follows:
Information Commissioner’s Office
Douglassingel 47, 1119MD, Schiphol-Rijk
telephone / +31 20 303 30 60
GDPR Information Audit
We have performed an information audit of our data processing activities and data privacy control activities to evaluate their operation and ensure our full compliance with GDPR standards. This process included the implementation of systems and procedures that will allow our team to have appropriate insight into our data processing activities and procedures for processing requests pertaining to data subject rights. We will continue to perform regular information audits to evaluate the state of our environment and GDPR compliance.
If you have any questions regarding our GDPR compliance and privacy practices, please contact our team using our Data Privacy Request Form.