Global Commitment to Privacy

EKO Instruments is committed to protecting your personal data. We abide by all applicable laws and regulations, with a particular focus on the EU General Data Protection Regulation (GDPR) as our global standard for data privacy. We may update this Privacy & Data Protection Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page, and where appropriate, notified to you. This policy is effective from April 12, 2025.

Consent and Scope

By registering for or using the EKO-Q platform, you agree to this Privacy & Data Protection Policy and consent to the collection, use, and processing of your information as described herein. This Policy applies to all users of the EKO-Q web application and related services, whether you access the service as an individual consumer or on behalf of a company or other organization. It covers personal data collected through your use of EKO-Q. This Policy does not cover any offline data processing or interactions you may have with EKO Instruments outside of the EKO-Q platform (for example, through our corporate website or in person), which may be subject to separate privacy notices.

Legal Basis for Processing

Under GDPR, EKO Instruments must have a valid legal basis to process your personal data. Depending on the context, one or more of the following legal bases may apply:

• Performance of a Contract: We process personal data to provide the EKO-Q services you have requested. For example, we require your name and email to create and administer your user account, and we use your data (like measurements inputs or usage actions) to deliver the platform’s functionality. Processing your data for billing and to provide customer support is also based on fulfilling our contractual obligations to you as a user.
• Legitimate Interests: We may process certain data as necessary for our legitimate business interests, provided those interests are not overridden by your data protection rights. For instance, it is in our legitimate interest to collect usage logs and analytics data to improve our platform’s performance and features, to ensure the security of our service (e.g., detecting fraud or misuse), and to communicate important service updates. When we rely on this basis, we consider and balance any potential impact on your rights.
• Consent: In some cases, we rely on your consent to process personal data. For example, if we ever want to use your personal data for a purpose that requires consent (such as using your email to send promotional marketing not related to the core service), we will ask for your explicit consent. You have the right to withdraw your consent at any time. (Note: Using EKO-Q itself and the data processing involved in providing the service is generally not based on consent but on the other bases listed here, since the processing is necessary for the service.)
• Legal Obligation: We also process personal data when required to comply with our legal obligations. For example, for financial and tax regulations we may need to retain invoice information including your name, company details, VAT ID, and transaction history. If authorities lawfully require us to provide personal data (such as for law enforcement or regulatory purposes), we will do so under the legal obligation basis.
• Vital Interests or Public Interest: In very unlikely scenarios, we might process data to protect someone’s vital interests (life or safety) or for a task in the public interest, but these bases are generally not applicable to the EKO-Q service’s typical operations.

We will always ensure that we have a valid legal ground to collect and use your data, and we will document our decision-making for these bases as required by GDPR.

Cookies and Analytics

Like most web applications, EKO-Q uses cookies and similar tracking technologies to ensure the platform functions correctly and to enhance your user experience:

• Functional Cookies: When you log into EKO-Q, our system uses an authentication cookie (or similar mechanism) to maintain your session. This cookie allows you to stay logged in as you navigate the platform and ensures that the correct account information is displayed to you. We may also use cookies to remember certain preferences (for example, your language or other settings) so that you don’t have to reconfigure them each time. These cookies are essential for providing the service and do not require consent under GDPR, as they are necessary for the operation of the site.
• Analytics: To understand how users engage with EKO-Q and to improve our services, we use an analytics tool called Umami. Umami is a privacy-focused, self-hosted analytics platform. This means that any analytics data collected about the usage of EKO-Q is stored on our own servers (hosted on DigitalOcean) and is not shared with third-party analytics providers. Importantly, Umami does not use cookies and does not collect personally identifiable information. It tracks general usage metrics such as page views, buttons clicked, and geographic regions of users (using anonymized IP information). The analytics data helps us see overall trends (for example, how many users use a certain feature or which days the platform is most active) without profiling individual users. Because Umami does not store personal data or use tracking cookies, its use is designed to be GDPR-compliant and respectful of your privacy.
• Other Tracking Technologies: Aside from cookies, we may use local storage or similar mechanisms for caching data on your browser to improve performance (for instance, storing a small bit of data so that a page loads faster on repeat visits). We do not use any third-party advertising networks or social media trackers on the EKO-Q platform.
• Cookie Management: You have the ability to control and delete cookies if you wish. Most web browsers allow you to refuse new cookies, delete existing cookies, or notify you when new cookies are set. Please note, however, that if you disable or delete cookies related to EKO-Q, some core functionality (like staying logged in) may not work properly. Since our analytics do not rely on cookies, disabling cookies will not affect the data collected by Umami, but you are already protected as that data is anonymized. We do not display cookie consent banners within the EKO-Q application itself because we do not use non-essential or third-party cookies that require consent. If our practices change in the future, we will implement appropriate notice and consent mechanisms.

By using EKO-Q, you agree to our use of cookies and analytics as described above. For more information on our analytics configuration or any questions about cookies, feel free to contact us.

International Data Transfers

Because EKO Instruments operates globally, your data may be transferred to and stored in countries outside of your own. In particular, any personal data collected through EKO-Q will be transferred to the United States, because our application servers and databases are located in the USA region via DigitalOcean. This means that if you are located in the European Economic Area (EEA) or the United Kingdom, your personal information is transferred from the EEA/UK to the U.S. for processing.

• Data Protection Safeguards: We understand that the U.S. is not currently deemed to have an “adequate” level of data protection by the European Commission. To ensure that your data remains protected to EU GDPR standards when it is transferred internationally, we have put in place appropriate safeguards, such as European Commission-approved Standard Contractual Clauses (SCCs) with our U.S.-based processors (e.g., DigitalOcean and Stripe). These contractual clauses obligate the recipients of the data to protect it according to the GDPR’s requirements. In addition, where possible, we implement additional technical measures like encryption both in transit and at rest, as well as policies to minimize who can access your data.
• Access by EKO Global Offices: EKO Instruments Co., Ltd. is based in Japan, and we have subsidiaries and affiliates in other countries (including in the EU and the US). The data you provide may be accessed by authorized EKO personnel in these jurisdictions strictly on a need-to-know basis (for example, a support request you make might be handled by our EU office, or technical maintenance might be done by teams in Japan or elsewhere). All such internal transfers are covered by intra-group agreements that include data protection obligations.

By using the EKO-Q platform, you acknowledge that your personal data will be transferred to and processed in the United States and potentially other countries outside of your home country. We will, however, always protect your information as described in this Privacy Policy, regardless of where it is processed. If we need to transfer your data to any third party or country not covered by an adequacy decision, we will do so in accordance with GDPR Articles 44-49 (for instance, using SCCs, obtaining your consent where appropriate, or other valid transfer mechanisms). If you would like more information about our international data transfer practices or copies of the relevant safeguards in place, please contact us and we will be happy to provide further details.

Data Retention

We will retain your personal data only for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. The retention period can vary depending on the type of data and the purpose of processing. Here is a summary of our retention practices:

• Account Data: We retain the personal information associated with your EKO-Q account (such as your profile info, sensor data, and usage logs) for as long as your account is active. If you choose to deactivate your account or request deletion, we will initiate the deletion of your personal data from our production systems. Inactive accounts may be retained for a reasonable period (for example, if your subscription lapses, we might keep your account data for a certain number of months in case you reactivate, but we will inform you of such policies in advance).
• Sensor Data: Measurements data are collected and stored in EKO-Q and will be retained as long as you have an active account, so that you can access historical measurements. You have the ability to delete certain datasets or entries via the platform; deleting such data will remove it from active databases, though it may persist in backups for a limited time (see below).
• Transaction and Billing Records: We keep records of transactions, invoices, and related billing information for at least the minimum duration required by tax and financial laws. For example, in many jurisdictions, we are legally required to keep invoice and payment records for a number of years (commonly 7 years) for auditing purposes. This means that if you made a purchase, some basic personal data tied to that purchase (like your name, company and billing details, payment amount, and date) may be retained even after your account is deleted, solely for legal compliance.
• Support Communications: If you contacted us for support, we may retain those communications (including emails or ticket records) for a period of time after resolution. This helps us keep track of service history and improve our support processes. Typically, support records are retained for a few years, unless you request a deletion and we have no overriding reason to keep them.
• Analytics Data: Analytics data collected via Umami is generally kept in aggregate form. Since this data does not identify users, we may keep aggregate usage statistics indefinitely to observe long-term trends. However, raw log data that could be tied to IP addresses is usually rotated or deleted within a short timeframe. For instance, server logs containing IP addresses are typically retained for security analysis for a few weeks to a few months, and then automatically purged or anonymized.
• Backups: We perform regular backups of our database and systems to ensure we can recover from downtime or disasters. These backups are encrypted and stored securely. Backup files are retained for a limited retention cycle (e.g., backups might be kept for 30-60 days before being overwritten with newer backups). If you request deletion of your data, we will remove your data from our live systems and it will no longer be used, but it might remain in encrypted backups until those backups expire and are replaced. We treat data in backups as protected and will not restore or use deleted data unless absolutely necessary for security or legal reasons.

After the applicable retention period has elapsed, or upon your valid request for erasure, we will either securely delete or anonymize your personal data so that it can no longer be associated with you. If complete deletion (for example, from backups) is not immediately feasible, we will ensure the data is isolated and protected until deletion is possible.

Your Rights Under GDPR

If you are in the European Union, the United Kingdom, or other jurisdictions with similar data protection laws, you have certain rights regarding your personal data. EKO Instruments is committed to honoring these rights. Even if you are not in those regions, we extend many of these core rights to all our users as part of our commitment to privacy. Under GDPR (and equivalent laws), you have the following rights:

• Right of Access: You have the right to request confirmation of whether we are processing your personal data, and if so, to request a copy of the personal data we hold about you. This allows you to know and verify the lawfulness of our processing.
• Right to Rectification: If any of your personal information is inaccurate or incomplete, you have the right to ask us to correct or update it. We encourage you to keep your profile information up-to-date, and you may correct some of this directly in your account settings. For any details you cannot update yourself, you can request that we make the correction.
• Right to Erasure: This is also known as the “right to be forgotten.” You may request that we delete your personal data when it is no longer necessary for us to retain it. You can delete your EKO-Q account via the platform interface or by contacting us. Upon such a request, we will erase your personal data, provided we do not have a valid legal reason to continue processing it (for example, we might need to keep certain transaction records as noted earlier). We will also inform any third-party processors to delete data they hold on our behalf, to the extent required by law.
• Right to Restrict Processing: You have the right to ask us to limit the processing of your personal data in certain circumstances. For instance, if you contest the accuracy of your data, you can request we restrict processing while we verify the information. Or if you object to our processing based on legitimate interests, you can request restriction pending our assessment of whether our interests override yours. When processing is restricted, we can still store your data but will not use it further until the restriction is lifted.
• Right to Object: You have the right to object to our processing of your personal data when that processing is based on legitimate interests or public interest. If you object, we will evaluate whether our legitimate grounds for processing outweigh your rights and freedoms. You also have an unconditional right to object to your data being used for direct marketing purposes. In practice, we do not use your EKO-Q data for unsolicited marketing without consent, but if you ever receive marketing communications from us, you can opt-out at any time.
• Right to Data Portability: You have the right to receive your personal data that you have provided to us in a structured, commonly used, machine-readable format, and the right to have that data transmitted to another controller where technically feasible. In plain terms, this means you can ask for an export of your data (for example, your sensor datasets or account details) to take to another service. We will help by providing your data in a CSV or similar standard format. Note that this right applies to data processed by us by automated means, where the processing is based on your consent or on a contract.
• Right to Withdraw Consent: If we rely on your consent for any part of processing, you have the right to withdraw that consent at any time. For example, if you consented to receive a newsletter, you can unsubscribe later. Withdrawing consent will not affect the lawfulness of any processing we carried out before your withdrawal.
• Right to Lodge a Complaint: If you believe that we have infringed your data protection rights or processed your data unlawfully, you have the right to file a complaint with a supervisory authority. For EU users, this would typically be your country’s Data Protection Authority (DPA). For UK users, it’s the Information Commissioner’s Office (ICO). We kindly request that you attempt to resolve any concerns with us first, by contacting us, and we will do our best to address them.

To exercise any of your rights, please contact us using the information provided in the Contact section below. We may need to verify your identity before fulfilling certain requests (to ensure we don’t disclose data to an unauthorized person). We will respond to your request as soon as possible and in any event within one month, as required by GDPR. If for some reason we cannot fulfill your request (for example, if it adversely affects the rights of others or if we must retain data for legal reasons), we will explain the reasoning to you.

Please note that these rights are subject to some conditions and exceptions. For example, the right to erasure can’t be used to demand deletion of data that we are obligated to keep by law, and data portability applies only to information you have provided to us. However, we fully intend to honor your requests to the fullest extent possible.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy & Data Protection Policy or the handling of your personal data, please reach out to us. We are here to help and will respond promptly.

• Data Controller: The data controller responsible for your information is EKO Instruments Co., Ltd., the owner of the EKO-Q platform. EKO Instruments has offices in the EU, US, and Japan.
• Email: You may email our data protection team at eko-q@eko-instruments.com. Please include "EKO-Q Privacy Inquiry" in the subject line for quicker routing.
• Online Contact Form: You can also send us a message through the contact form on our website (found on the EKO Instruments Contact Us page). Simply mention that your inquiry is about EKO-Q and privacy.
• Postal Mail: If you prefer, you can write to us at our European office:
  EKO Instruments Europe B.V.
  Lulofsstraat 55, 2521 AL, The Hague, The Netherlands
  Please include attention to "Privacy Officer - EKO-Q".
  (You may also contact our headquarters in Japan at EKO Instruments Co., Ltd., but contacting the Europe office may lead to a faster response for GDPR-related queries.)

We will do our best to address any questions or issues you have about your personal data. If you contact us to exercise any of your data rights, please provide sufficient information for us to verify your identity and locate your data (for example, the email associated with your EKO-Q account and the specific request). For certain requests like data access or deletion, we may need to ask for additional verification or details for security reasons.

Thank you for reading our Privacy & Data Protection Policy. Your trust is important to us, and we are continuously working to maintain and improve the security and transparency of the EKO-Q platform. We encourage you to review this Policy periodically for any updates. By continuing to use EKO-Q, you acknowledge that you have read and understood this Policy. If you do not agree with any aspect of this Policy, please discontinue use of the platform and contact us to address your concerns.

Updated at: 17/04/2025