Privacy notice

<%projectOwner%> is the controller of the personal information processed in the Service, which means we decide why and how it is processed.

The platform the Service runs on is provided and operated for us by in2detail ltd. in2detail acts as our processor: it processes your information only on our documented instructions and under a written agreement that meets the requirements of Article 28 of the UK GDPR.

If you were given access to the Service by your employer or by a client of ours, that organisation may also process your information for its own purposes, under its own privacy notice.

Information given to us about you. Your account is usually set up by us or by the organisation that gave you access, not by you. It holds:

• Account details — your name and business email address (which is also your username).
• Sign-in details — your password, which we store only in a one-way hashed form that cannot be read back.
• Access details — the sites, assets and pages you may see and what you may do there.
• Preferences — settings you choose in the Service.
• Alert details — if you receive alerts, the email address and telephone number they are sent to, and the sites or assets they cover.

Information created when you use the Service.

• Activity records — which account made which request to the Service, and when.
• Sign-in records — the IP address your browser signs in from, which we use to slow down repeated failed sign-in attempts and protect your account.
• Message records — the alerts and reports sent to you: when, to which address or number, their content, and whether delivery succeeded.

Monitoring data. The Service mainly processes readings from lifts, building systems and other equipment. These readings are about equipment, not people, but a site address or an event log may sometimes relate to an identifiable person, and where it does we treat it as personal information under this notice.

Sensitive information. We do not process special category data (such as health, ethnicity or religious beliefs). Please do not enter any into the Service.

UK data protection law requires us to have a legal basis for each use of your information. We use it:

• To provide the Service — creating and running your account, signing you in, showing you the sites and assets you have access to, and sending you the alerts and reports you are set up to receive. Legal basis: performance of our contract with you or with the organisation that gave you access, and our legitimate interest in providing a working monitoring service to our clients.
• To keep the Service secure — protecting accounts against password guessing, investigating misuse, and keeping activity records so that changes can be traced. Legal basis: legitimate interests in securing the Service and the equipment it monitors.
• To support and improve the Service — answering your questions, fixing faults and understanding how the Service performs. Legal basis: legitimate interests.
• To comply with the law — for example responding to lawful requests from public authorities, or establishing, exercising or defending legal claims. Legal basis: legal obligation, or legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights and you may object (see section 10). We do not use your information for marketing, and we make no decisions about you by automated means that have legal or similarly significant effects.

When you sign in, the Service sets one cookie to keep you signed in. It is strictly necessary for the Service to work, so it does not need your consent. It can only be read by the Service over a secure connection, it is not available to scripts on the page, and your session ends after an hour without activity or twelve hours after you signed in, whichever comes first, or when you sign out.

We do not use analytics, advertising, social media or any other tracking cookies or technologies, and the Service does not load content from third-party sites.

We do not sell your information. We share it only with:

• in2detail ltd, which operates the platform as our processor (see section 1).
• Google Cloud, which hosts the Service and its data.
• Message delivery providers (ClickSend and Textlocal for SMS and voice alerts, and an email delivery provider for email), which receive the address or number and content of each message so they can deliver it.
• Other users of the Service on the same account — for example, administrators can see who has access and what they have done.
• Public authorities, courts and professional advisers, where the law requires it or to establish, exercise or defend legal claims.
• A buyer or successor, if all or part of our business, or in2detail's, is sold, merged or reorganised; they would remain bound by this notice.

Each service provider acts only on instructions and under a written contract that requires it to protect your information.

The Service is hosted by Google Cloud in data centres in the European Economic Area, which the UK recognises as providing an adequate level of protection. Some of our message delivery providers may process the content of a message outside the UK and EEA in order to deliver it. Where that happens, we make sure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of these safeguards.

We keep account details for as long as your account is active. When your access ends, we delete or anonymise your account details, unless we need to keep them to meet a legal obligation or to establish, exercise or defend legal claims. Activity, sign-in and message records are kept only as long as needed for security, support and to show what the Service did, and are then deleted.

Copies held in backups are deleted as the backups expire, and are isolated from any further use until then.

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, one-way hashing of passwords, separation between clients' data, access permissions limited to what each person needs, protection against repeated failed sign-ins, and records of activity in the Service. No system is completely secure, so please keep your password private and tell us straight away if you think your account has been misused.

If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

The Service is a business tool and is not intended for anyone under 18. We do not knowingly process information about children. If you believe we have, please contact us at <%contact%> and we will delete it.

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• ask us to erase your information;
• ask us to restrict how we use your information;
• object to our use of your information where we rely on legitimate interests; and
• ask us to transfer information you gave us to you or to another organisation (data portability).

Some of these rights apply only in certain circumstances. To exercise any of them, email us at <%contact%>. We will not charge you, and we will respond within one month, which we may extend by up to two further months for complex requests, in which case we will tell you why. We may need to confirm your identity first. If your account was set up by your employer or one of our clients, we may pass your request to them where they are the right party to answer it.

If you are unhappy with how we have used your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. If you are in the European Economic Area, you may instead complain to the data protection authority where you live or work.

We will update this notice when how we process personal information changes, or when the law requires it. The date at the top shows when it was last updated. If a change materially affects you, we will tell you by a notice in the Service or by email before it takes effect.

If you have questions about this notice or about your information, email us at <%contact%> or write to us at:

<%address%>