Data security and incident response policy

Last updated: 27 October 2026

This policy applies to Kigo.Cloud and its add-ons (the Kigo.Cloud Fiskalizacija Shopify app, the WooCommerce plugin and the Android app). It is issued by Symmetria d.o.o., Zagreb, Croatia. Person responsible for security: Dejan Potočić.

How we protect data

• Encrypted connections: Kigo.Cloud works over HTTPS only, and the web pages of the server are reachable from the internet only through Cloudflare.
• Encrypted keys: Shopify access tokens are stored encrypted.
• Separate company data: every company has its own database. A user sees only the data of their own company, and the company administrator decides what each user may do.
• Limited staff access: only authorised Symmetria administrators access the server and the databases. Administrator sign-in works only with a cryptographic key, and repeated failed sign-in attempts are blocked automatically.
• Backups: every database is backed up every night, and an off-server copy is kept for 30 days.
• Separate testing: the development and test environments are separate from production, and changes are tried on demo and test data before they reach customers.

What a security incident is

Any unauthorised access to Kigo.Cloud data or systems, a data leak or data loss, a compromised key, password or certificate, and malicious traffic that endangers the service.

How to report an incident

If you notice a security problem or suspect that your data is at risk, write to [email protected] with the subject "Security". Symmetria staff and contractors report an incident to the person responsible straight away.

What we do when an incident happens

1. Within 1 hour: we stop the damage (blocking an address, disabling the affected account or integration, changing the affected passwords and keys), preserve the system logs as evidence and record what was noticed and done.
2. Within 24 hours: we establish which data and which companies are affected, since when and how, and assess the risk for the people the data relates to.
3. Notification: we notify affected merchants without undue delay, describing what happened and what they need to do. For a personal data breach that poses a risk to people's rights, we notify the Croatian data protection authority (AZOP) within 72 hours of becoming aware of it (Article 33 GDPR). When data from Shopify stores is affected, we also notify Shopify under the Shopify Partner Program terms. The people the data relates to are notified when the risk is high (Article 34 GDPR), in agreement with the merchant as the controller.
4. Recovery: we remove the cause, restore data from backup where needed, check that the service works and monitor the logs closely for the next 7 days.
5. After the incident: within 14 days we write a report on the cause, the consequences, the measures taken and what we change so it does not happen again. Reports are kept for at least 3 years.

Related

Privacy policy of the Kigo.Cloud Fiskalizacija Shopify app