Privacy Overview: Why we restrict client information (PII)

  • updated 1 yr ago

What is PII

Personally Identifiable Information (PII) is anything that can be used to identify an individual. Data points that people often think of as PII include social security numbers and health information, neither of which Kotis collects. But it also includes things we commonly collect such as name, email, street address, phone number, and more.


Why is this Info Restricted

Different states and countries have varying laws mandating how to protect consumer information, with California and the European Union being among the most stringent.  California, for instance, passed the California Consumer Protection Act

Under this law personal information cannot be disclosed to third parties; sharing personal data such as names, emails, etc. are prohibited.  Violations are punishable by law and carry a minimum fine of $2500 per incident.

Our system is not designed or intended to be a data collection mechanism, and when end users enter data into our system it indicates that their data will only be used for the purpose of fulfilling their orders. Generally speaking, this means that the data cannot be used for other purposes. As the client, you are the Data Controller for this data, and we recommend you discuss this process with your legal advisors if you have concerns. We restrict PII because it protects both you and Kotis.

Who Can View PII

Kotis will process PII solely for the purposes of providing the Kotis Online Services, and will not process it for any other purpose. Kotis limits its employee access to PII to only those roles who need access to perform their job. This may include customer service, shipping, and IT. Access requests for PII are logged by user and timestamped, and only allowed during periods when the respective department would need access. User accounts are not shared, and are protected by MFA on company-issued devices with security protocols enforced. Further security measures outside the scope of this article are overseen through our annual SOC2 audit.

We generally cannot share PII with Clients, unless appropriate legal arrangements have been made regarding responsibility for compliance with privacy laws. Regardless of these arrangements, Clients are the Data Controller for PII and Kotis is a Processor. That means it is your responsibility to comply with the rules of GDPR, CCPA, and any other privacy laws; and Kotis as a Processor will support those responsibilities however our platform is able. In order to make PII visible to clients, we require a Data Processing Addendum to be in place; a link to your Privacy Policy posted to end users; and signoff from your legal and security departments that you understand your legal responsibilities as a Data Controller.

Data Storage and Deletion

Data is stored at AWS in the United States, and is encrypted at rest and in transit. Backups are stored separately in AWS and also encrypted.

We automatically purge PII at the following schedule:

  • 5 years: Data for orders being shipped outside the USA, per legal retention periods for customs purposes
  • 18 months: Data for any orders that involved credit cards, to facilitate chargebacks
  • 12 months: All other data, to provide customer service

We do not have the ability to provide custom retention periods for different Clients. Data is purged automatically by a script that runs once per day, so data will be purged within 24 hours of exceeding the timelines listed above.

Once data is purged, the data is completely erased from all Kotis systems. No Kotis employee will be able to access the data, and even limited data will no longer be accessible to Clients.

  • 1 yr agoLast active
  • 475Views
  • 1 Following