in 2016, Europe adopted a new set of data protection laws called the General Data Protection Regulation (GDPR).
These laws are meant to protect the personal data of EU citizens and have been in effect since May 25th, 2018.
We take data security very seriously and have worked to ensure GDPR compliance by the enforcement date.
This page outlines that regulation and provides more details to ensure you are following compliance regulations for your own applications and data.
What is the GDPR?
The European Commission approved and adopted the new General Data Protection Regulation (GDPR) in 2016.
This regulation aims to give EU-citizens more control over their data, and create uniform privacy rules to enforce across the EU. This will be replacing the EU Data Protection Directive as well as local laws relating to it.
Although this law originates in the EU the reach of these regulations is global. Any business holding personal data on customers, prospects, or employees based within the EU are subject to the new regulations.
The GDPR defines “personal data” as any information related to a natural person or ‘Data Subject’ that can be used to directly or indirectly identify the person.
Is Knack compliant with the GDPR?
Yes. We’ve long maintained data centers in Europe to ensure data for our European customers is not leaving the EU. We can confirm that all Knack accounts which house data in these EU data centers comply with the GDPR as of May 25th, 2018.
To further comply with the GDPR we’ve worked on implementing the following:
We’ve added a new feature that will enable you to easily and completely delete all data linked to an individual user.
More information on this can be found here.
We’ve created a new Data Processing Agreement (DPA) that explains the privacy considerations in place and our terms for meeting GDPR compliance.
If you are a current Knack customer who would like to enter into a DPA with us, you can do so by navigating to your App Settings. At the top, navigate to the Info tab and you’ll see a link to View & Sign under the section: Agreements.
You’ll need to download, review, and sign the agreement. You can then return it back to us by sending the signed DPA to: [email protected]
We have appointed a Data Protection Officer to oversee and maintain policies as they relate to data management.
To contact the Data Protection Officer at any time, please reach out to [email protected]
We’ve also augmented our team training to accommodate needs associated with GDPR.
We have already self-certified under the E.U.-U.S. Privacy Shield to ensure that all transferring of personal data is compliant.
As such, we currently maintain data centers within the European Union – specifically, Frankfurt, Germany.
All of the data for these EU apps are completely isolated to these servers, including the jobs and backups, to ensure no data ever leaves the EU. This data is 100% encrypted both in transit and at rest.
If you are unsure if your data is currently housed in our EU data center, you can check within your App Settings to confirm. At the top, navigate to the Info tab and you’ll see where your data is hosted under the section: Data Location.
Invalidation of the EU-US Privacy Shield Framework:
Knack is aware of the Court Justice of the EU’s decision invalidating the Privacy Shield as a mechanism for authorizing data transfers to the US from the European Union. Knack currently maintains a dedicated data center for its EU customers within the EU and only allows limited “view-only access” by US staff for troubleshooting and technical support purposes. Although Knack participates in the Privacy Shield, Knack routinely executes Data Protection Addendums with its EU customers which incorporate the Standard Contractual Clauses. Knack remains committed to compliance with the Privacy Shield as required by the US Department of Commerce. In the event of a conflict, we will comply with the requirement that would be more protective of our customers. We will await further guidance from the European Data Protection Board and our applicable data protection authority regarding the use of the Standard Contractual Clauses moving forward.
Do you need to do anything to be compliant?
The short answer here is yes. Although we can make sure that the information we collect and store is compliant, the actions you take in acquiring information from your own users may require additional steps to be compliant.
Some steps you can take are:
- Read up on the GDPR and how it may impact your business.
- Discuss any potential changes you may need to make with your attorney.
- Take a fresh look at all the existing information you process and how it’s processed, to determine if any changes need to be made.
- Keep information privacy at the forefront of your mind when developing new applications, and auditing your current applications.