1. SCOPE AND SUBJECT OF THIS PRIVACY STATEMENT

1.1. General. This privacy statement applies to a dormakaba SaaS Service which consists of or combines the following types of components (including their related documentation and updates):

(i) a web portal or cloud service which is accessible – directly or indirectly - via a web browser (“Web Portal”), and/or

(ii) mobile applications (“Mobile Apps”).

1.2. Specific. dormakaba resivo is a cloud-based software-as-as-service access solution for the planning, operation, management, maintenance and surveillance of estates (sites). The access solution (“Access Solution”) is available in two flavors / variants:

· resivo residential: Designed for apartment buildings, i.e. real estates with multiple apartments, users and residents.

· resivo business: Designed for Small and Medium Sized Businesses, that require a secure and flexible access solution for commercial spaces, i.e. sites.

The SaaS Service combines three applications (“SaaS Software”):

The Cloud Access Portal and the resivo Utility App, including related documentation and updates thereto, are components of the dormakaba resivo SaaS Service and are individually and collectively also referred to as “Service”. The resivo Home App is not the subject of this privacy statement.

1.3. dormakaba or one of its affiliated companies is providing the Services to its business customers (each a “Customer”). A Customer may grant access for the use of the Services to natural persons.

1.4. This Privacy Statement informs natural persons using the Service (“You”) of the types of personal data we collect from You in connection with the provision of the Service, the purposes this data is processed for and the rights You have in relation to the processing of Your data.

1.5. Country Specific Information. In addition, deviation or replacement of the data protection information set out herein, there may be country specific information which apply to You. Such country specific information, if any, are set out in section 11 – Country Specific Information or in a country specific annex or in a country specific Privacy Statement for resivo Services.

2. CONTROLLER, CONTACT INFORMATION, DATA PROTECTION REPRESENTATIVE

2.1. dormakaba Switzerland Ltd., Mühlebühlstrasse 23, 8620 Wetzikon, Switzerland is the operator of the Service ("we", “us” or “our”). We are the controller for the processing of the personal data described in

· Section 4 - Data Collected, Processing Purposes and Legal Bases

· Section 5 - Use of Analytics Tools; Cookies

2.2. Further, we process certain personal data on behalf of  Customer. Customer may be Your employer, account owner, account manager, property manager, administrator, or another company or an individual. Please note that where we process personal data on behalf of Customer, we are not the controller for the processing of personal data. For your convenience, we inform you of personal data that we might, if applicable, process on behalf of Customer, in

· Section 6 – Personal Data Processed by us on behalf of our Customer.

For further information please contact the data controller for the respective processing.

2.3. Data of third parties provided by You. The Service provides functionalities that may allow You to enter personal data of third parties within the Service who are not users of the Service (e.g. to get access by receiving a digital key). We will collect and process data of such third parties which You provide to us within the Service (e-mail, name, mobile number, additional information in a free text field), as well as statistical data related thereto (e.g., type of mobile device, version OS). You are responsible to comply with the related legal obligations regarding data protection.

2.4. dormakaba Data Protection Representatives.

a) General (for all countries): You can reach our Group Data Protection Officer at data.protection@dormakaba.com .

b) Specific (European Union): As our data protection representative in the European Union within the meaning of Art. 27 GDPR we have designated dormakaba Deutschland GmbH, DORMA Platz 1, 58256 Ennepetal, Germany, ("EU Representative")   data.protection@dormakaba.com .

3. OUR DATA PROCESSING PRINCIPLES

We process personal data in accordance with the applicable data protection laws and regulations, as amended from time to time (“Applicable Data Protection Laws”).

4. DATA COLLECTED, PROCESSING PURPOSES AND LEGAL BASES

4.1. Download of the app. When the resivo Utility App or the resivo Home App is downloaded from the app store, the information required for the transaction is transferred to the app store, i.e., in particular the username, e‑mail address and customer number for Your app store account, time of the download, payment information, if any, and individual device code. We have no influence over these data collections, nor are we responsible for them. We only process this data if necessary for downloading the resivo Utility App or the resivo Home App to Your mobile device.

4.2. Registration and Information. When You register in the Cloud Access Portal, the resivo Utility App or the resivo Home App, as applicable, You need to enter Your email address and define a password. To continue with the registration process, you have to use the service from amazoncognito.com. Your registration data will be shared with amazoncognito.com. Also, the Access Solution may use Your mobile phone number to send You an activation code to be able to use the app. We also process your contact data to provide you information about the Access Solution (e.g. release notes).

We process Your email address and the data entered by You into the Access Solution (access profiles) to permit us to provide the service offered and / or to perform a contract with You.

4.3. Digital Billing. If You are receiving and handling automated digital invoices for payment on behalf of Customer, we process Your name, contact information and further information required for the invoicing and payment. The legal basis for this processing is to permit us to provide the service offered and/or to perform a contract with You. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. 

4.4. The resivo Utility App and/or the resivo Home App is loaded onto Your mobile device and can be used - with limited functionality - without access to the Internet. Apart from the data described in clauses 1.1 to 3 above, no further personal data is collected during its use.

4.5. If You contact us by email, Your email address, including the information provided by You, will be stored by us for the purposes of processing the request and in case of follow-up questions. The data transmitted by You by email is processed on the basis of Your consent. You may withdraw this consent at any time. An informal notification to us by email suffices for such purposes. If the aim of the contact request is to clarify problems with the Access Solution or to provide other services as part of the customer service provided by us, the legal basis for the processing of Your personal data is the performance of our contractual obligation.

5. USE OF ANALYSIS TOOLS; COOKIES

5.1. The Cloud Access Control Portal, resivo Utility App and/or resivo Home App, as applicable, uses the analysis tools Google Analytics for Firebase, and Firebase Crashlytics (“Google Analysis Tools”) from Google Ireland Ltd., as described in more detail below, to analyse user behavior and to report on the stability and improvement of the Cloud Access Portal, resivo Utility App and/or resivo Home App, as applicable.

We use these tools to permit us to provide the service offered and / or to perform a contract with You and for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. The information generated with the aid of the Google Analysis Tools is transmitted to a server operated by Google in Ireland and stored there. In individual cases, personal data may also be transmitted to Google LLC in the USA, and we have no influence over this. Google LLC has agreed to ensuring compliance with European data protection law (https://policies.google.com/privacy/frameworks?hl=en-US).

More information about both Google Analytics Tools may be found at: Privacy and Security in Firebase (google.com) (https://firebase.google.com/support/privacy?hl=en ) as well as in Google’s privacy statement.

Google is also certified according to the DATA PRIVACY FRAMEWORK (DPF) PROGRAM (The EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF were respectively developed by the U.S. Department of Commerce and the European Commission, UK Government, and Swiss Federal Administration to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Union, United Kingdom, and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.)

5.2. Enabling Google Analytics for Firebase permits data about the user of the Cloud Access Portal, resivo Utility App and/or resivo Home App, as applicable, to be collected for the purposes of analysis.

Through Google Analytics for Firebase, Google collects data on the device, IP addresses, type of mobile device, version OS and app activities on our behalf to evaluate the use of the Cloud Access Portal, resivo Utility App and/or resivo Home App, as applicable, to compile reports on the activities performed within the Cloud Access Portal, resivo Utility App and/or resivo Home App, as applicable, and to permit it to offer us other services related to the use of the Access Solution.

Google Analytics for Firebase automatically uses IP anonymisation. This means that the IP address of Google users within the member states of the European Union or in other signatory states to the Agreement on the European Economic Area are abbreviated. Only in exceptional cases will the full IP address be transmitted to a server of Google in the USA and abbreviated there.

You can find more information on data protection, in particular on the personal data involved in specific cases, at: https://support.google.com/firebase/answer/6318039?hl=en .

The personal data will be deleted after 14 months.

5.3. We use the Firebase Crashlytics to receive error reports following any crash of the Access Solution and to measure and improve the performance of the Access Solution. If the Access Solution, or part thereof, crashes, information about the crash, such as device type, operating system version and some technical data, is sent to Google via the mobile device, which enables us to diagnose and solve problems (so-called crash reports). We use these tools to permit us to provide the service offered and/or to perform a contract with You and for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. The data is stored anonymously.

More information about Firebase Crashlytics can be found at: https://firebase.google.com/docs/crashlytics?hl=en.

5.4. We use strictly necessary cookies, which are essential for the Application to function. You can not deactivate these cookies, but you can use your browser settings to block such cookies. In such case some or part of the Application may not function. More information about the cookies we use can be found at: https://resivo.dormakaba.com/saas/cookies.

6. PERSONAL DATA PROCESSED BY US ON BEHALF OF OUR CUSTOMER

We process certain personal data on behalf of our Customer. For example, our Customer may be the property management company responsible for the building where you rent an apartment. For your convenience, we would like to inform you of personal data that we might, if applicable, process on behalf of Customer. Please note that we are not the controller for the processing of personal data mentioned in this section 6 – Personal Data Processed by us on behalf of our Customer. For further information please contact the data controller for the respective processing.

6.1. Requests / queries through the Access Solution. We also process the data You provide in the Cloud Access Portal, the resivo Utility App or the resivo Home App, as applicable, to send requested information or respond to queries raised. The legal basis for this processing is to permit us to provide the service offered and/or to perform a contract with You.

We may further process Your personal information which You have provided in the Cloud Access Portal, the resivo Utility App or the resivo Home App, as applicable, to contact You to carry out satisfaction surveys or to improve our services on the basis of our legitimate interest, where those legitimate interests are not overridden by Your rights or interests.

6.2. Real Estate Management and Tenant Management (Resivo residential only). The Customer or authorised user of the Cloud Access Portal and/or the resivo Utility App (“Authorised User”) will enter into the Access Solution the address of the real estate/site, the Rental Properties within such real estate, and the access profiles and tenant management data (meaning in particular names and contact details of individuals with allocated access rights to such real estate/site and/or to individual Rental Properties). The Customer and its Authorised Users will see in the Cloud Access Portal and/or the resivo Utility App if the Tenant has activated the invitation code with the resivo Home App, or, which RFID keys are activated.

We process the personal data entered by the Customer or any Authorised Users to permit us or one of our affiliates to provide the service offered and/or to perform a contract with (i) You and/or (ii) the Customer. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests.

6.3. Designation of Co-habitant. When a Tenant designates You as co-habitant within the resivo Home App, we process Your email address and the data entered by the Tenant into the resivo Home App (e.g., name, mobile number, additional information in a free text field) to permit us to provide the service offered and/or to perform a contract with You. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. With regard to You as co-habitant, we will further process the same categories of data, for the same purposes and on the same legal bases as we do with regard to the Tenant.

6.4. Access Log Data for Common Doors/Doors and non-rented Rental Property doors. With regard to common doors/doors (such as building entrance doors) and non-rented Rental Property doors, the Customer and Authorised Users have the technical possibility (i) to see in the Cloud Access Portal access log data for common doors/doors, and (ii) to see in and export via the resivo Utility App access log data for common doors/doors and non-rented Rental Property doors. Such access log data are data on when and which RFID access medium, digital key or physical key, including the name and/or mobile phone number of the respective key issuer and/or key holder, has accessed a common door/door or non-rented Rental Property door and/or whether a RFID medium, digital key or physical key has been rejected by the lock of a specific common door/door or a specific non-rented Rental Property door. If the Customer or Authorised User activates or uses this technical functionality for a common door/door or a non-rented Rental Property door, the data controller will be responsible to inform you in advance. For questions relating to the processing of such access log data by Customer or Authorised Users, You should contact the data controller (as per clause 2 – Controller, Contact Information, EU Representative) to obtain additional and detailed information on its privacy declaration.

We process such access log data to the extent required to provide technical support to a user of such door and/or to permit us or one of our affiliates to provide the service offered and/or to perform a contract with (i) You and/or (ii) the Customer. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests.

6.5. Access Log Data for Rented Rental Properties. Neither You as Tenant nor co-habitant can see within the resivo Home App, when which key has accessed the door to Your Rental Property. Futhermore, neither the Customer, nor Authorised Users, nor any technical support staff, nor dormakaba developers will see or have access to access log data of doors to rented Rental Properties, unless You, as Tenant (or co-habitant), actively provide it to a technical support function.

We process such access log data to the extent required to provide technical support and/or to permit us to provide the service offered and / or to perform a contract with You. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests.

7. RECIPIENTS; LOCATION OF DATA PROCESSING

We may transfer Your personal data to processors engaged by us, including the following:

- the provider(s) of analysis tools mentioned in Section 5 – Use of Analysis Tools; Cookies may receive limited personal data as further set out in that section;

- dormakaba Group: our affiliated companies may receive or have access to Your personal data if they provide internal group services centrally and on our behalf;

- third-party service provider: we may engage third-party service providers to process personal data on our behalf, e.g. for hosting services.

Applicable Data Protection Laws may contain restrictions for the transfer of personal data to third countries or jurisdictions. Where we transfer Your personal data to a third country or jurisdictions, we shall comply with the Applicable Data Protection Laws and implement data transfer mechanisms and safeguards in accordance with such Applicable Data Protection Laws, if and to the extent required for such cross-border transfer. As a result, when your personal data is processed in a country or jurisdiction other than where you are residing, it may be subject to the law of this foreign country or jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that country or jurisdiction.

With regards to a transfer of personal data from the EU to Switzerland, the EU Commission has decided that Switzerland offers an adequate level of data protection. A copy of the documentation on the measures taken by us is available from us on request.

8. STORAGE DURATION AND DELETION

We store Your personal data in accordance with the Applicable Data Protection Laws if and for as long as this is required for the processing purposes referred to in this Privacy Statement. We then delete Your personal data in accordance with our data retention and deletion policies or take measures to properly anonymize the data. An exception to this is where we are legally obliged to keep Your personal data longer (e.g. for tax, accounting and auditing purposes). The data transmitted by You by email is kept by us until the purpose for the data storage ceases to apply (e.g. once Your request has been processed).

9. YOUR RIGHTS

As a data subject, You have the rights vis-à-vis the data controller (see section 2 – Controller, Contact Information, Data Protection Representative). When the data controller is us, and depending on the country or jurisdiction in which You reside, You may have the following rights vis-à-vis us or our respective Data Protection Representative regarding Your personal data by sending an email to our respective Data Protection Representative (as listed in section 2.4 – dormakaba Data Protection Representative).

9.1. You may at any time withdraw any consent once given by You to the processing by us of Your personal data. As a result, we may in future no longer process Your personal data on the basis of Your consent. The withdrawal will not affect the lawfulness of any processing done on the basis of the consent up until the said withdrawal.

9.2. You can request information about Your personal data as processed by us. In particular, You can request information about the purposes of processing, the category of personal data, the categories of recipients to whom Your data was or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of Your data if it was not collected directly from You, and the existence of automated decision-making including profiling and, if necessary, meaningful information on the details of the same.

9.3. If and to the extent, as part of Your use of the Service You may input, retrieve, correct or delete Your personal data, You are responsible for the correction, retrieval or deletion of Your data in or from the Service. In any other cases:

a) You can request the immediate rectification of inaccurate personal data or the completion of Your personal data as stored by us and You also have the right, taking into consideration the purposes of the processing, to request the completion of incomplete personal data - including by means of an additional declaration.

b) You can request the erasure of Your personal data as stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims, whereby the right to erasure may be limited by national law.

c) You can request the restriction of the processing of Your personal data insofar as You contest the accuracy of the data, the processing is unlawful, but You object to its erasure and we no longer need the data, but it is required by You for the establishment, exercise or defense of legal claims, or You have objected to the processing.

d) You have the right to receive Your personal data that You have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller ("Right to data portability").

9.4. You can complain to a supervisory authority. As a rule, You may for such purposes contact the supervisory authority at Your usual place of residence, Your place of work or the headquarters of our EU Representative.

10. CHANGES TO THIS PRIVACY STATEMENT

We may amend this Privacy Statement from time to time for any reason. We will notify You of any changes by posting the new Privacy Statement in the Service and changing the “Version” date. You should consult this Privacy Statement regularly for any changes. In case of relevant amendments, we may further notify You by appropriate means.

11. COUNTRY SPECIFIC INFORMATION

11.1. Austria. You can reach dormakaba Austria’s data protection officer at dsgvo.at@dormakaba.com.

11.2. Australia. Where the location of the dormakaba entity which has concluded the resivo software-as-a-service agreement with REM is Australia, or dormakaba Australia Pty Ltd (dormakaba Australia) is otherwise involved in the collection, disclosure, storage or use of personal information, the following applies in addition to the clauses above:

a) “Applicable Data Protection Laws” includes the Privacy Act 1988 (Cth) and the Australian Privacy Principles, as applicable;

b) If we do not collect, hold, use or disclose Your personal information, or if You do not consent, then we may not be able to answer Your enquiry, complete the agreement or transaction into which You have entered, or provide access to the resivo Admin Portal, the resivo Utility App or the resivo Home App as applicable;

c) You can reach dormakaba Australia’s Privacy Officer at 12-13 Dansu Court, Hallam, Victoria, 3803 or at the following email address: Privacy.AU@dormakaba.com;

d) dormakaba Australia is affiliated with organisations located overseas and is likely to or will disclose some of Your personal information to overseas recipients, but will only do so where: (i) it is necessary for the purposes of giving effect to an agreement with You; and (ii) where You have provided consent or we believe on reasonable grounds that the overseas recipient is required to deal with Your personal information by enforceable laws similar to the requirements under the APPs or where it is otherwise permitted by law.  Our overseas affiliates are located in Germany and Switzerland; and

e) dormakaba Australia’s privacy policy is located here: https://www.dormakaba.com/au-en/privacy-policy.