FKram Connect is the app for the fairs held at the Kram Exhibition Centre (Parc des Expositions du Kram). This policy explains which personal data the app processes, why, and how you stay in control of it. It applies to visitors and exhibitors who use the app.
1. Data controller
Data is processed by FKram — Parc des Expositions du Kram, Le Kram, Tunis, Tunisia ("we"), organiser of the fairs. The FKram Connect app is published on its behalf by 123 Consultancy, which develops and operates it technically.
For any question about your data: contact@fkram.com.tn.
2. Data we collect
Account data
- Required: email address and password (stored only in hashed form, never in plain text), first and last name.
- Optional (profile): phone, company, job, city, country, date of birth, profile photo, preferred language.
- Sign in with Google or Apple: the identifier provided by Google or Apple, your email address, your name and, for Google, your profile photo. We never receive your Google or Apple password.
Tickets
The tickets you book: fair, ticket type, price if any, booking date, status and entry QR code, as well as the checks of that QR code at the fair entrance. Online payment is not yet active: the app collects no bank details.
Contacts swapped by QR code
When you scan the QR code of a visitor or exhibitor, or they scan yours, we record the exchange: both people, the date and the fair where it took place. Each person's profile details (name, email, phone, company, job, city, photo) become visible to the other. You always see a person's details before saving the contact.
Exhibitor area
If you manage an exhibitor or belong to its team: the exhibitor's information (name, logo, description, business contact details, products and photos), your participations in fairs, team members and the email addresses of invited people.
Notifications
Your device's technical notification identifier (Firebase token) and the history of notifications received in the app.
App usage
Views and clicks on banners and featured exhibitors, to measure their audience for exhibitors. These measurements may be linked to your account when you are signed in. We use no third-party analytics, no advertising ID and no ad trackers.
Technical data
With each exchange with our servers: IP address, date and time, app type. This is used to run and protect the service (for example, to limit sign-in attempts).
3. Device permissions
| Permission | Use | Data sent |
|---|---|---|
| Camera | Scan QR codes (contacts, exhibitors) and take a profile or product photo. | No image of the scan is kept. Only the photo you choose to send is uploaded. |
| Photos | Choose a profile photo, a logo or a product photo. | Only the selected image. |
| Location | Show your position on the venue map while you are viewing it. | None: your position stays on your phone. |
| Notifications | Keep you informed (reminders, exhibitor news, practical information). | The device's notification token. |
Each permission is requested when it is needed and can be withdrawn at any time in your phone's settings.
4. How we use data
- To provide the service: account, tickets, entry control, map, programme, contact exchange, exhibitor area (performance of the service you request).
- To keep you informed: service emails (verification codes, password reset, invitations) and notifications about the fairs.
- To measure the audience of featured exhibitors and banners, in aggregate (legitimate interest).
- To secure the service: preventing abuse and fraudulent sign-ins (legitimate interest).
- Legal obligations: keeping ticketing and payment records as required by law.
We do not sell your data and do not use it for targeted advertising.
5. Data sharing
- With exhibitors and visitors, at your initiative: only during a QR code contact exchange. An exhibitor can then find your details in their contact list and export them for business follow-up.
- With the fair organisation: authorised staff (reception, ticket control, administration) access the data needed for their work.
- With our technical providers (next section), who act on our instructions.
- With the authorities, if the law requires it.
6. Providers and hosting
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services | Hosting of the servers and database | European Union (Sweden) |
| Google Firebase Cloud Messaging | Sending notifications | United States / worldwide |
| Google (Sign-In) and Apple (Sign in with Apple) | Signing in with a Google or Apple account, if you choose to | United States |
| Elastic Email | Sending service emails | United States / Canada |
When data is transferred outside Tunisia, we rely on recognised providers that apply appropriate safeguards.
7. Retention
- Account and profile: as long as your account exists. You can delete it at any time (how to do it).
- When the account is deleted: your personal data is erased or anonymised immediately, and your swapped contacts, notifications and access are removed. Tickets and payments are kept in anonymous form for the period required by accounting rules.
- Backups: backup copies are deleted automatically after 14 days.
- Verification codes: a few minutes; sign-in security counters: 1 hour at most.
- On your phone: a copy of your tickets and of the fairs is kept for offline use. It is erased when you sign out.
8. Security
All exchanges between the app and our servers are encrypted (HTTPS). Passwords are stored as hashes, your session is kept in the phone's secure storage, data access is limited by role, and sign-ins to the organisers' back office require two-step verification. Changing or resetting your password signs out all your other sessions.
9. Your rights
Under Tunisian Organic Law No. 2004-63 of July 27, 2004 on the protection of personal data (and the GDPR for people located in the European Union), you can:
- access your data and get a copy;
- correct it: most of it can be edited directly in the app (Profile);
- delete it, from the app or on request;
- object to processing or ask for it to be restricted;
- withdraw your consent to notifications or location, in your phone's settings.
To exercise these rights, write to contact@fkram.com.tn from your account's email address. We reply within one month. You can also contact the National Authority for the Protection of Personal Data (INPDP, inpdp.tn).
10. Minors
FKram Connect is intended for adults (18 and over). We do not knowingly collect data about minors. If you believe a minor has sent us data, contact us so we can delete it.
11. This website
These pages use Google Analytics (Google LLC) to measure their audience statistically: pages viewed, language, clicks on the download buttons and FAQ questions opened. No advertising signals are enabled and these measurements are not linked to your app account. If you declined cookies on fkram.com.tn, no measurement cookie is set on these pages.
12. Changes
We may update this policy, for example when online payment opens. The date of the last update appears at the top of the page; if there is an important change, we will let you know in the app.
13. Contact
FKram — Parc des Expositions du Kram, Le Kram, Tunis, Tunisia
Email: contact@fkram.com.tn