GDPR Compliance

1. Preamble

Even though the obligation is not formally established in the GDPR, it is essential that software, packaged software, or other applications (which we call “product” for convenience) enable their users (companies or public bodies) to comply with the obligations set by the GDPR.

Three types of constraints can be distinguished:

constraints relating to the product itself;
constraints relating to the use of the product;
constraints relating to the security of the product.

It is specified that as a Kroqi client, you are the data controller under the GDPR and must respond directly to this framework’s requirements.

This document constitutes the list of these requirements and specifies how Kroqi allows you to meet them.

2. Points relating to the product

These are essentially endogenous constraints, tied to the product itself.

2.1 Data update

Art. 16 GDPR: Right to rectification: “The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.”
Kroqi response: Every Kroqi user can at any time modify and rectify their personal data (My account section) and receives a message indicating that their changes have been saved.

2.2 Data access and copy

Art. 15.1 GDPR: Right of access by the data subject
”The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed (…)”
Art. 15.3 GDPR: Right of copy
”The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.”
Kroqi response
Right of access by the data subject: the personal data protection policy lists the processing operations performed by Kroqi on personal data. The data controller can at any time send this document to a person wishing to exercise this right.
Right of copy: the data likely to be used for processing are those displayed in the My Account section (accessible, modifiable, and copyable by the end user).

2.3 Data portability

Art. 20 GDPR: Right to data portability: “Data subjects shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format and shall have the right to transmit that data to another controller without hindrance from the controller to which the personal data have been provided…”
**Kroqi response
**Kroqi offers an export feature for all activities tied to a user and enables copying of personal data from the My Account section.

2.4 Full or partial purge

Art. 5 e) GDPR: deletion of data after a certain period: “Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), subject to the implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (storage limitation);”
**Kroqi response
**The retention period of personal data does not exceed that necessary for the purposes for which they are processed (transparent teamwork, project management, traceability).
When a Kroqi account is deleted (the processing purposes having become obsolete), all personal data of the users of that account are also deleted within 30 days of the account deletion.

2.5 Limitation

**Art. 18 GDPR: Right to restriction of processing:
**1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
The notion of “limitation” is clarified in Article 4 “definitions” of the GDPR which specifies
“restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.”
**Kroqi response
**Kroqi can implement processing restriction on simple written request from the client (data controller) to dpo-wimi@racine.eu specifying the nature of the desired restriction, the processing operation(s) concerned, and the user(s) concerned.

2.6 Erasure

**Art. 17 GDPR: right to erasure (“right to be forgotten”):
**“The data subject shall have the right to obtain from the controller the erasure of personal data concerning them without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds (…)”
**Kroqi response
**Kroqi undertakes to delete the personal data of a user wishing to exercise their right to be forgotten on simple written request from the client (data controller) to dpo-wimi@racine.eu specifying the user(s) concerned.

2.7 User account

**Art. 13 and 14 GDPR: Information and access to personal data:
**When personal data relating to a data subject are collected from that person, the controller shall provide them with information including:
The identity and contact details of the controller (or their representative);
The purposes of the data processing;
The recipients of the data; etc.
**Kroqi response
**Every Kroqi user can consult our personal data protection policy from the www.kroqi.fr site, which provides the user with all the information required by the GDPR.

**Art. 7: Conditions for consent:
**“1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.”
**Kroqi response
**When a new user is added to a Kroqi account, they consent to the processing of the personal data they will deposit on Kroqi.

3. Points relating to security

3.1 Security of processing

**Article 32 “security of processing”:
**specifies that the data controller (client) and the processor (provider) shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
**Kroqi response
**The frontend server encrypts all external connections with a web security policy mechanism (HTTP Strict Transport Security aka HSTS). This protects our services against active and passive network attacks (eavesdropping). A man-in-the-middle attacker has a very limited ability to intercept requests and responses between a user and our web application servers.
Kroqi also benefits from network isolation. Network isolation means that all the servers in our infrastructure are isolated inside the data center and connected by dedicated private networks.

3.2 Product access conditions

**Recital 57 GDPR:
**“Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials used by the data subject to log-in to the on-line service offered by the data controller.”
**Kroqi response
**Kroqi offers strong authentication through the “Advanced password policy” option. In that case, passwords must meet the following conditions:
at least 8 characters
one lowercase and one uppercase letter
a number or a symbol
not have been used before
Kroqi also offers authentication via existing identities in its clients’ enterprise directory via SAML V2. In that case, the credentials are strictly identical to those used at the data controller (client).

3.3 Product access conditions

**Art. 5 f) GDPR:
**Processing ensuring data security, protection against unlawful processing and loss
**Kroqi response
**Kroqi has activity logs and alerts that trace any suspicious activity. Access to these logs is strictly controlled and limited. Generally, all access to the Kroqi infrastructure is via VPN: only certain predefined IPs are authorized to establish a tunnel (IP allowlist) using an RSA 4096 key. This communication tunnel is then encrypted in AES-256-CBC and hashed in SHA-512. Administrators must authenticate via SSH using their private key (ED25519 or ECDSA) protected by a passphrase. The data centers used by Kroqi have maximum physical security. All access to the premises is strictly controlled. To protect against intrusions and hazards, the data centers are secured with barbed wire fences. Motion detection systems and video surveillance also operate continuously. Activity in the data centers and outside the buildings is monitored and recorded on secure servers, and the surveillance team is on site 24/7.

3.4 Technical and organizational security

**Art. 32 1. GDPR:
**”(…) the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (…)”
Recital 39 GDPR:
“Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.”.
**Kroqi response
**The number of Kroqi employees with access to the infrastructure is extremely limited. These individuals are bound by a specific confidentiality undertaking and by a confidentiality clause in their employment contract.
All access to the Kroqi infrastructure is strictly controlled, monitored, and via VPN: only certain predefined IPs are authorized to establish a tunnel (IP allowlist) using an RSA 4096 key.
This communication tunnel is then encrypted in AES-256-CBC and hashed in SHA-512.
Administrators must then authenticate via SSH using their private key (ED25519 or ECDSA) protected by a passphrase.
Databases are backed up every 3 hours. Files are replicated and backed up nightly. Backup servers are secured, isolated, and accessible only by backup applications.

3.5 Security vulnerability management

GDPR framework GDPR security obligation
**Implementation
**Our infrastructure is mostly based on open-source technologies, which have the advantage of bringing together extremely large communities of contributors and users, thanks to which security vulnerabilities are discovered quickly. We systematically apply all approved and stable security patches.