Privacy Policy

Last Updated: 31/12/2024

Welcome to Lockngo Ltd (“we,” “us,” “our”). We provide a SaaS platform that enables businesses to offer digital locker keys to their end users. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services, including any websites, mobile applications, or web applications we operate (collectively the “Services”).

By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not access or use our Services.

1. Introduction

Business Name: Lockngo Ltd
Registered In: The United Kingdom (England)
Parent or Subsidiary: None (independent company)
Registered Address: Seek House, Funtington, Chichester, England, PO18 9LG
Contact Email: contact@lockngo.io

For privacy-related inquiries, you can reach our designated privacy contact:
Data Protection Contact: Luke Alexander-Hill (CTO)
Email: luke@hestiadesign.co.uk

2. Scope of This Policy

This policy applies to personal data of:

• End Users: Individuals who use digital locker keys facilitated by our Services.
• Business Clients: Our B2B customers who purchase licences or bespoke software solutions from us.

3. The Data We Collect

3.1 End Users

• Name: As submitted via our app/webapp or via SMS.
• Phone Number: Used for account creation, locker access, and communication.
• Payment Information: Handled by third-party processors (Google Pay, Apple Pay, Stripe). We do not store full card details on our own servers.
• Usage Data / Analytics: Via basic Google Analytics cookies (IP address, browser type, pages visited, etc.), kept to the minimum needed.

3.2 Business Clients

• Contact Details: Name, business email address, phone number, etc.
• Company Information: Company name, address, VAT number, and other corporate details.

4. How We Collect Your Data

• Directly from You: When you sign up, fill out a form, or communicate with us via email, SMS, or in-app messaging.
• Through Our App/Webapp: When end users request lockers or update their user profiles.
• Cookies & Analytics: We use cookies for essential login/session management and limited Google Analytics for usage data.

5. Why We Process Your Data (Legal Basis)

We process personal data on several legal bases under UK GDPR:

• Performance of a Contract: To facilitate locker access, manage user accounts, and provide our core Services.
• Legitimate Interests: To track returning users, provide loyalty points, protect our Services from misuse, and simplify the user journey.
• Consent: For optional marketing communications (in the future) and for certain analytics cookies (where required by law).

We do not conduct automated decision-making or profiling that produces legal or similarly significant effects on individuals.

6. How We Share Your Data

We may share personal data with the following categories of recipients:

• Payment Processors: Google Pay, Apple Pay, Stripe.
• SMS Providers: Twilio (for SMS confirmations/notifications).
• Hosting Providers: PythonAnywhere (EU-based servers) for database hosting.
• Business Partners: For locker system revenue sharing (basic usage info).
• Lock Manufacturer: We may share end-user name and phone number with ILOQ to facilitate digital key generation for the locker system.
• We do not sell or rent personal data.

We are in the process of formalizing Data Processing Agreements with our sub-processors.

7. International Data Transfers

All hosting servers are located within the EU. We do not currently transfer personal data outside the UK or EU. Should a transfer become necessary, we will implement appropriate safeguards (e.g., Standard Contractual Clauses).

8. Data Retention

We retain personal data for as long as necessary to provide the Services or as required by law:

• End User Accounts: Kept until the user requests deletion or is inactive for a defined period (e.g., 1–2 years).
• Transactional Records: Typically 6 years for UK tax and regulatory compliance.
• Analytics Data: Retained in line with Google Analytics settings (e.g., 14 months), after which it is deleted or anonymized.

9. Your Rights

Under UK GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data.
• Right to Rectification: Correct any inaccurate or incomplete data.
• Right to Erasure: Request deletion of data if it’s no longer necessary or if processing is unlawful.
• Right to Restrict Processing: Under certain conditions, limit how we use your data.
• Right to Data Portability: Request transfer of your data in some cases.
• Right to Object: To processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: If processing is based on consent, you can withdraw it at any time.

To exercise these rights, please use the dedicated contact form on our website or email luke@hestiadesign.co.uk. We may require additional information to verify your identity.

10. Security Measures

We protect personal data through technical and organizational measures. Our hosting provider, PythonAnywhere, implements SSL/TLS and other standard security protocols. Internally, access to personal data is limited to those who need it for their job functions.

However, please note that no method of online transmission or storage is completely secure.

11. Children’s Privacy

Our Services are generally open to users of all ages with a mobile phone. We do not knowingly collect personal data from children under 16 without parental consent. If you believe a child under 16 has provided personal data without parental consent, please contact us. We will take steps to delete such information.

12. Updates to This Policy

We review this Privacy Policy at least annually or whenever we make significant changes to our data practices or legal obligations. If we make any material changes, we will notify you via a banner notice on our website or a push notification in the app. The “Last Updated” date at the top indicates the most recent changes.

13. Contact Us

If you have any questions or concerns, or if you want to exercise your data protection rights, please reach out to us:

Email: luke@hestiadesign.co.uk
Postal Address: Seek House, Funtington, Chichester, England, PO18 9LG
Website: https://lockngo.io

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe we have not complied with your data protection rights.