GDPR Compliance

1. Introduction

EKKO Ltd ("EKKO", "we", "us", or "our") is committed to ensuring the security and protection of the personal data that we process, and to providing a compliant and consistent approach to data protection. This page explains what EKKO Review Flow stores, why it is used, how it is protected and how people can exercise their rights under the UK GDPR and, where applicable, the EU GDPR.

2. Roles and Responsibilities

Under GDPR, there are two main roles regarding personal data:

• Data Controller: We act as the Data Controller for the personal data of our account holders (users and agencies) collected during signup, billing, and support.
• Data Processor: We act as a Data Processor for the customer data (end-customers) that account holders upload to EKKO Review Flow for the purpose of sending review requests. The account holder remains the Data Controller for this data.

3. Data Categories

We process the following categories of data:

• Account Holder Data: Name, email address, business name, account settings, password hash and subscription status. Full payment-card details are held by Stripe, not EKKO.
• Customer Data: Name, email address, phone number, service description and service date provided by account holders.
• Feedback & Review Data: Ratings, feedback requests sent, delivery status, ratings, private feedback, Google review content, reply drafts and posted replies.
• Technical Data: IP addresses, browser types, device and usage records, consent records and security logs used to operate, protect and troubleshoot the service.

4. How We Use Data

• To create accounts, provide the dashboard and manage subscriptions.
• To send review requests by email or WhatsApp on a business's instructions.
• To display Google reviews and publish replies authorised by the connected profile owner.
• To generate one-off AI reply drafts when the business chooses to use that feature.
• To prevent abuse, investigate delivery failures, provide support and meet legal obligations.

5. Service Providers

We use third-party sub-processors to provide the Service. These partners are vetted for their security and data protection standards:

6. Data Subject Rights

Individuals have the following rights under GDPR:

• The right to be informed about the collection and use of data.
• The right of access to personal data.
• The right to rectification of inaccurate data.
• The right to erasure (the "right to be forgotten").
• The right to restrict processing.
• The right to data portability.
• The right to object to processing and withdraw consent where consent applies.

To exercise these rights, please contact us at contact@weareekko.io.

7. Data Deletion and Retention

We retain personal data for as long as an account is active. Account owners can request deletion from the Settingspage or by emailing contact@weareekko.io. The in-app deletion process removes the account and associated operational data from active systems. Limited billing, fraud-prevention or legal records may be retained where the law requires it. Agency-managed business users should ask their agency account owner or contact EKKO.

8. International Transfers and Security

Some providers may process data outside the UK or EEA. Where this happens, we rely on recognised safeguards such as adequacy decisions, the UK International Data Transfer Agreement or Standard Contractual Clauses. We use encryption in transit, access controls, business-level data separation, audit records and rate limits to protect the service.

9. Contact

If you have any questions about our GDPR compliance, please contact our Data Protection team:

EKKO Ltd, 124 City Road, London EC1V 2NX, United Kingdom.
Email: contact@weareekko.io