Yes, the data remains the property of the museum or heritage organisation at all times.

We have full control over the content you upload to AWS services via KLEKSI. AWS provides a sophisticated set of access, encryption, and logging features to help us do this effectively. AWS provides APIs to configure access control permissions for all services we develop. AWS does not have access to or use your content for any purpose without our permission. AWS never uses or extracts information from your content for marketing or advertising purposes.

We have set up KLEKSI Europe as the AWS region where your content is stored, we only replicate and back up your content on servers within Europe. AWS will not move or replicate this content outside of Europe without our permission, except as necessary to comply with the law or a binding order of a government authority.

We chose AWS in part because of its industry-leading encryption features to protect your data in transit and at rest, AWS provides the ability to manage our own encryption keys. These data protection features include:

- Data encryption capabilities available in over 100 AWS services.
- Flexible key management options using AWS Key Management Service (KMS)

AWS will never disclose Customer Content unless required to do so to comply with the law or a binding order of a government agency. If a government agency requests Customer Content from AWS, we will direct the government agency to request that information directly from KLEKSI. If we are required to disclose Customer Content to a government agency, we will promptly notify our customers so that they have an opportunity to seek a protective order or other appropriate remedy, unless prohibited by law.

AWS has developed a Security Assurance Program that uses global privacy and data protection best practices to help you operate securely within KLEKSI and leverage their security control environment. These security and control processes are independently validated by multiple independent third-party assessments.