Privacy policy

1. Controller

Dukiwi SA, Grand-Rue 18, 1470 Estavayer-le-Lac, Switzerland, UID CHE-166.358.852. Questions and requests: dpo@dukiwi.com.

For a RelayServer relay installed by a company on its own servers, that company is the controller of the data handled there; Dukiwi SA then only receives the licence check information (server name, version, number of sessions and devices).

2. The content of your sessions

Screen, keyboard, mouse, files, clipboard and chat are end-to-end encrypted between the apps. The relay only passes on encrypted data it cannot read. We never record the content of a session. Any video recording happens only on the Agent’s computer, at its user’s request.

Your address book is encrypted by the apps; the relay keeps only an encrypted copy.

3. Data we handle

• Account: email address, password as a hash (Argon2id), language, date and version of the accepted terms, optional answers (industry, number of employees), security settings (encrypted authenticator secret, passkey public keys), organisation, role and support profile (name, job title) if you fill them in.
• Devices: 9-digit ID, name given to the device, app type, last time online.
• Connection log: which ID connected to which, the IP address of the connecting device, start, end, result (accepted, refused…) and relayed volume.
• Security: sign-ins to the account and failed attempts with their IP address, approved locations, anti-abuse counters (IP addresses and emails as hashes).
• Website: number of downloads per day and app, with no IP address or identifier. The host’s technical logs are used for security only.

4. Why

• to provide the service and your account (performance of the contract);
• to protect the service and its users against abuse, fraud and intrusion, and to show you who connected to your devices (legitimate interest);
• to send you the emails needed: temporary password, password reset, approval of a new location, security alerts;
• to produce overall, anonymous statistics (for example the split by industry);
• to meet our legal obligations.

We send no advertising and do no profiling.

5. Who has access

• Dukiwi SA, for operation and support, on a least-privilege basis;
• in an organisation, its owner and administrators see the organisation’s devices and connection log; the person being helped sees the name and job title of the person connecting;
• our technical processors, bound by contract: Infomaniak Network SA (Geneva, Switzerland) for hosting the website, relay and database, and Dukiwi SA’s email sending provider;
• authorities, only where the law requires it.

We do not sell or rent any data.

6. Where

Data is hosted in Switzerland. During a session between two devices in different countries, the encrypted data passes through the relay in Switzerland.

7. For how long

• account: as long as it exists; an account created but never used is deleted after 48 hours;
• connection log and security events: 365 days, then deleted automatically;
• device not seen for 90 days: its ID is deleted;
• app sign-in unused for 90 days: ended;
• password reset link: 1 hour; verification step: 5 to 15 minutes;
• anti-abuse counters: a few days at most;
• accounting records of paid plans: 10 years, as Swiss law requires.

When an account is deleted, its data is erased, except what the law requires us to keep.

8. Cookies

The website uses technical cookies only, with no advertising, no audience measurement and no third-party service:

• dukiwilink_session: your dashboard sign-in (12 hours);
• dukiwilink_mfa: the verification step in progress (a few minutes);
• dukiwilink_form: form protection (until the browser closes);
• dukiwilink_known: this browser was already used to sign you in (1 year), so a lock caused by an attack does not keep you out;
• dukiwilink_lang: the language you chose (1 year).

9. Security

TLS everywhere, end-to-end encryption of sessions, passwords hashed with Argon2id, secrets encrypted in the database, two-step verification (code or passkey), progressive locking of attempts, email approval of new locations, updates signed by Dukiwi SA.

10. Your rights

You can ask to access your data, correct it, delete it, receive it in a common format, or object to its processing, by writing to dpo@dukiwi.com. We answer within 30 days. You can also contact the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, the authority of your country.

11. Changes

This policy may change with the service or the law. The version in force and its date are on this page; significant changes are announced by email or in the dashboard.