Smart locks and GDPR
An access system processes personal data: names, contact details and who came in when. These are the points to look at as a host or business. This is practical guidance, not legal advice.
What is recorded
Data of people
Name and, if you enter them, email address and phone number of guests or staff.
Access
When a code or key was used and which code or person that was.
Codes
PIN codes are stored encrypted.
Practical points
Collect only what you need: a name is often enough, a phone number only if a digital key requires it. Give access to the system only to people who need it, with the lowest role that fits. Turn on two-step verification for administrators.
Data of expired bookings does not need to be kept forever. Sojolock cleans up old data after a while. Explain in your own privacy statement which data you use and why.
- Enter only necessary data
- Set roles and rights per employee
- Two-step verification for administrators
- Keep your own privacy statement up to date
Frequently asked questions about privacy
Who decides what happens with the data?
You, as the customer, decide which data you enter. Sojolock processes it to deliver the service. The privacy statement describes which data, for what and how long.
Can staff see the log?
That depends on the role you give them. A read-only role can look; a key manager only sees keys and the key plan.
Do I have to inform guests?
Yes, through your own privacy statement. For questions about the GDPR it is best to consult a lawyer.
Read more
Privacy
How Sojolock handles personal data: which data, for what, how long and which rights you have.
PIN code for guests
Why a temporary PIN code per guest is safer than a key safe, how it works and what you need to arrange: spare key, battery and internet.
Key management for offices
Keep track of who has which key: issue and return keys with QR confirmation, a digital key plan and reminders for keys that are late.