EKKO is a global digital agency specialising in websites, CRM systems and AI automation. Operated by EKKO Ltd (Company No. 16982307), registered in England & Wales, and EKKO Labuan Ltd (Company No. LL22426), registered in Labuan, Malaysia. weareekko.io

This page is maintained by EKKO to answer common questions about how we look after the data flowing through our websites, CRMs and AI systems for clients in the United Kingdom, the United States, Hong Kong, Singapore, Australia and New Zealand. It supplements, and does not replace, our Privacy Policy.

Where data lives

Client systems we build are hosted on reputable cloud providers, with hosting region confirmed per project. UK and EU clients are hosted in the UK or EEA by default. For clients in the United States, Hong Kong, Singapore, Australia or New Zealand we can host in the closest available regional data centre where the underlying provider offers one; otherwise data is hosted in the UK/EEA under appropriate transfer safeguards.

Cross-border transfers

Because EKKO is UK-based, personal data may be transferred to the United Kingdom for support, development and administration. Where applicable, transfers rely on the UK IDTA, the UK Addendum to the EU Standard Contractual Clauses, or equivalent contractual protections. Clients in the United States (applicable state privacy laws), Australia (Privacy Act 1988 / APPs), New Zealand (Privacy Act 2020), Singapore (PDPA) and Hong Kong (Personal Data (Privacy) Ordinance) are informed of the overseas handling of personal information as required by their local law.

Access control

Production access is limited to named EKKO engineers. Credentials are stored in a managed secret store, not in code, and rotated when team members change.

Encryption

Data is encrypted in transit (TLS) and at rest using the provider's standard encryption. Sensitive secrets are stored separately from application data.

AI systems

Where we use AI features (e.g. WhatsApp receptionists, the website assistant, EKKO Loop®), prompts and responses may be processed by third-party model providers under their data-processing terms, which may involve processing outside your country. We do not use client data to train third-party models.

Backups & retention

Live systems are backed up on a rolling schedule appropriate to the project. Client data is retained for the duration of the engagement plus any statutory requirements, then deleted on request.

Incidents

If we become aware of a security incident affecting your data, we'll notify you without undue delay and work with you to investigate and remediate, following notification duties in your jurisdiction (UK GDPR, applicable US state breach-notification duties, Australia's Notifiable Data Breaches scheme, New Zealand's Privacy Act 2020 notification duty, Singapore's PDPA data-breach notification obligation, and Hong Kong's PDPO breach-notification guidance).

Questions

Email contact@weareekko.io or info@ekkoltd.co.uk

How EKKO Handles Data