Privacy Policy

This policy explains how Credit Card Keys Ltd ("CCKEYS", "we") handles personal data when you use the CCKEYS Portal, our key-management service for dealerships. We are the controller for portal account data, and we process key-cabinet data on behalf of your dealership, which remains the controller of its own staff records.

Who we are

Credit Card Keys Ltd, Lightning Works, Birmingham Road, Hopwood, B48 7AL, United Kingdom. Email info@cckeys.co.uk, telephone 0121 445 4551.

What we process

• Account and staff records - names, usernames, email addresses and phone numbers of cabinet users and administrators, as entered by your site.
• Key activity - which keys were taken and returned, when, by whom and from which cabinet. This is the audit trail the service exists to provide.
• Sign-in and security data - session records, sign-in attempts and security audit logs, including IP address and browser type.
• RFID card numbers - the card identifiers used at the cabinets.

Biometric data: zero retention

Fingerprint and palm enrolment happens on your premises: the template is written directly from the reader on your computer to the door device on your local network. No fingerprint or palm data ever reaches or is stored on the portal or our servers. We record only that an enrolment took place and which finger was enrolled, never the biometric itself. Removing a user removes their templates from the door device.

Cookies

The portal sets only essential cookies: a session cookie that keeps you signed in, deleted when your session ends. We use no advertising or analytics cookies on the portal. Our marketing website at cckeys.com carries its own cookie policy.

Where data lives

The portal runs on Microsoft Azure in the UK (UK South region). Key-cabinet records are held in Creone's KeyWin 6 cloud service, which acts as a sub-processor. Data is encrypted in transit (TLS) and at rest (AES-256).

How long we keep it

• Sessions expire after 8 hours and are then deleted.
• Security audit logs are retained for up to 12 months.
• Staff records and key activity are retained while your site subscribes to the service, and deleted on written request when the subscription ends.

Who we share it with

We do not sell, exchange or release your personal information to third parties for marketing. Data is shared only with our hosting and platform sub-processors (Microsoft Azure; Creone AB for KeyWin) as needed to run the service, or where the law requires it.

Your rights

Under UK GDPR you may request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. Contact info@cckeys.co.uk and we will respond within one month. If you are unhappy with our response you may complain to the Information Commissioner's Office (ico.org.uk).

Changes

We will post any changes to this policy here and update the date above. Material changes will be notified to site owners by email.

← Back to sign in