1. SCOPE AND SUBJECT OF THIS PRIVACY STATEMENT

1.1. dormakaba resivo is a cloud-based software-as-as-service solution for the planning, management, maintenance and surveillance of digital access systems to apartment buildings, i.e. residential estates with multiple apartments, users and residents (“resivo Access Solution”). The resivo Access Solution combines three applications:

a) dormakaba resivo Admin Portal (“resivo Admin Portal”) designed for the use by real estate managers (“REM”)

b) dormakaba resivo utility application (“resivo Utility App”) designed for the use by REMs

c) dormakaba resivo home application (“resivo Home App”) designed for Tenants and co-habitants of Tenants. “Tenant” means an owner, resident or tenant of a confined space which may be rented or is owned by such Tenant as a single rental unit (e.g., an apartment together with an assigned compartment in the basement) (“Rental Property”) within a real estate.

“You” are an individual person using the resivo Admin Portal, the resivo Utility App or the resivo Home App.

1.2. This Privacy Statement gives You an overview of what types of personal data we collect from You in connection with the scope described above, for what purposes this data is processed and what rights You have in relation to the processing of Your data.

1.3. Out-of-scope: The resivo Admin Portal and resivo Home App, as applicable, provide functionalities that may allow You to request, grant or revoke access of third parties (e.g., service personnel) to specific doors. Please be aware that we will collect and process data of such third party access recipients (e.g., e-mail, name, mobile number, additional information in a free text field) which You provide to us within the resivo Access Solution, as well as statistical data related thereto (e.g., type of mobile device, version OS). Such third party access recipients will however not be using any resivo application and therefore this Privacy Statement does not apply to them directly. If you send us personal data from third parties, we ask you to inform such third parties about this resivo Privacy Statement. You may be authorised to send digital keys to such third party access recipients, who can receive such key on the dormakaba Mobile Access application or REM’s own tenant application. In such case, the key recipient may get additional information from the dormakaba mobile access app privacy statement or the privacy statement of REM’s own tenant application.

1.4. Country Specific Terms. In addition, deviation or replacement of the general terms set out herein, there may be country specific terms which apply to You. Such country specific terms, if any, are set out in clause 10 – Country Specific Terms or in a country specific Privacy Statement for resivo.

2. CONTROLLER, CONTACT INFORMATION, EU REPRESENTATIVE

2.1. The data controller responsible for processing Your personal data in connection with the resivo Access Solution is

(i) the company that designates You as authorised user of the resivo Admin Portal and/or the resivo Utility App, or

(ii) the company that designates You as Tenant of a Rental Property within a specific real estate and sends You the activation code to enable You the use the resivo Home App.

2.2. The data controller may be Your employer, account owner, property manager, administrator or another company.

2.3. When that company is dormakaba then the data controller is dormakaba Switzerland Ltd., Mühlebühlstrasse 23, 8620 Wetzikon, Switzerland ("we"). dormakaba Switzerland Ltd. is also the data controller for the processing of your personal data, insofar as the analysis tools mentioned in clause 5 - Use of Analysis Tools are used.

2.4. The competent supervisory authority in Switzerland for dormakaba as data controller is the Federal Data Protection and Information Commissioner, Feldeggweg 1, CH-3003 Bern, Switzerland (http://www.edoeb.admin.ch).

2.5. As dormakaba’s data protection representative in the European Union within the meaning of Art. 27 GDPR we have designated dormakaba Deutschland GmbH, DORMA Platz 1, 58256 Ennepetal, Germany ("EU Representative").

2.6. You can reach dormakaba’s data protection officer at data.protection@dormakaba.com or at the above postal address of the EU Representative, with the addition of "the data protection officer".

2.7. When the data controller is not dormakaba Switzerland Ltd., then, in this case, You should contact the data controller to obtain additional and detailed information on its privacy declaration.

2.8. When a user of the resivo Home App (generally the Tenant) designates You as co-habitant within the resivo Home App, the Tenant controls which data about You (name, mobile number, additional information in a free text field) Tenant enters into the resivo Home App; upon Your registration in the resivo Home App, this Privacy Statement applies to You in the same manner as for the Tenant.

3. OUR DATA PROCESSING PRINCIPLES

We process personal information in accordance with the applicable data protection laws and regulations, as amended from time to time (“Applicable Data Protection Laws”). Applicable Data Protection Laws include but are not limited to the Swiss Federal Act on Data Protection Act (“FADP”) and the EU General Data Protection Regulation (“GDPR”).

4. DATA COLLECTED, PROCESSING PURPOSES AND LEGAL BASES

4.1. Download of the app. When the resivo Utility App or the resivo Home App is downloaded from the app store, the information required for the transaction is transferred to the app store, i.e., in particular the username, e‑mail address and customer number for Your account, time of the download, payment information, if any, and individual device code. We have no influence over these data collections, nor are we responsible for them. We only process this data if necessary for downloading the resivo Utility App or the resivo Home App to Your mobile device.

4.2. Registration. When You register in the resivo Admin Portal, the resivo Utility App or the resivo Home App, as applicable, You need to enter Your email address and define a password. To continue with the registration process, you have to use the service from amazoncognito.com. Your registration data will be shared with amazoncognito.com. Also, the resivo Access Solution may use Your mobile phone number to send You an activation code to be able to use the app.

We process Your email address and the data entered by You into the resivo Access Solution (access profiles) to permit us to provide the service offered and / or to perform a contract with You.

4.3. Requests / queries through the resivo Access Solution. We also process the data You provide in the resivo Admin Portal, the resivo Utility App or the resivo Home App, as applicable, to send requested information or respond to queries raised. The legal basis for this processing is to permit us to provide the service offered and/or to perform a contract with You.    

We may further process Your personal information which You have provided in the resivo Admin Portal, the resivo Utility App or the resivo Home App, as applicable, to contact You to carry out satisfaction surveys or to improve our services on the basis of our legitimate interest, where those legitimate interests are not overridden by Your rights or interests.

4.4. Real Estate Management and Tenant Management. The REM or authorised user of the resivo Admin Portal and/or the resivo Utility App (“Authorised User”) will enter into the resivo Access Solution the address of the real estate, the Rental Properties within such real estate, and the access profiles and tenant management data (meaning in particular names and contact details of individuals with allocated access rights to such real estate and/or to individual Rental Properties). The REM and its Authorised Users will see in the resivo Admin Portal and/or the resivo Utility App if the Tenant has activated the invitation code with the resivo Home App, or, which RFID keys are activated. We process the personal data entered by the REM or any Authorised Users to permit us or one of our affiliates to provide the service offered and/or to perform a contract with (i) You and/or (ii) the REM. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests.

4.5. Designation of Co-habitant. When a Tenant designates You as co-habitant within the resivo Home App, we process Your email address and the data entered by the Tenant into the resivo Home App (e.g., name, mobile number, additional information in a free text field) to permit us to provide the service offered and/or to perform a contract with You. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. With regard to You as co-habitant, we will further process the same categories of data, for the same purposes and on the same legal bases as we do with regard to the Tenant.

4.6. Access Log Data for Common Doors. With regard to common doors (such as building entrance doors), the REM and Authorised Users have the technical possibility to see in the resivo Admin Portal when and which RFID access medium, digital key or physical key, including the name and/or mobile phone number of the respective key issuer and/or key holder, has accessed a Common Door and/or whether a RFID medium, digital key or physical key has been rejected by the lock of a specific Common Door. If the REM or Authorised User activates this technical functionality, the data controller will inform you in advance. For questions relating to the processing of such access log data by REM or Authorised Users, You should contact the data controller (as per clause 2 – Controller, Contact Information, EU Representative) to obtain additional and detailed information on its privacy declaration.

We process such access log data to the extent required to provide technical support to a user of such door and/or to permit us or one of our affiliates to provide the service offered and/or to perform a contract with (i) You and/or (ii) the REM. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests.

4.7. Access Log Data for Rented Rental Units. You as Tenant (or co-habitant) can see within the resivo Home App, when which key has accessed the door to Your Rental Property. Neither the REM, nor Authorised Users, nor any technical support staff, nor dormakaba developers will see or have access to access log data of doors to rented Rental Properties, unless You, as Tenant (or co-habitant), actively provide it to a technical support function.

We process such access log data to the extent required to provide technical support and/or to permit us to provide the service offered and / or to perform a contract with You. We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests.

4.8. Digital Billing. If You are receiving and handling automated digital invoices for payment on behalf of REM, we process Your name, contact information and further information required for the invoicing and payment. The legal basis for this processing is to permit us to provide the service offered and/or to perform a contract with You.  We may further process Your personal information, where processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. 

4.9. The resivo Utility App and/or the resivo Home App is loaded onto Your mobile device and can be used - with limited functionality - without access to the Internet. Apart from the data described in clauses 4.1 to 4.8 above, no further personal data is collected during its use.

4.10. If You contact us by email, Your email address, including the information provided by You, will be stored by us for the purposes of processing the request and in case of follow-up questions. The data transmitted by You by email is processed on the basis of Your consent. You may withdraw this consent at any time. An informal notification to us by email suffices for such purposes. If the aim of the contact request is to clarify problems with the resivo Access Solution or to provide other services as part of the customer service provided by us, the legal basis for the processing of Your personal data is the performance of our contractual obligation.

5. USE OF ANALYSIS TOOLS

5.1. The resivo Admin Portal, resivo Utility App and/or resivo Home App, as applicable, uses the analysis tools Google Analytics for Firebase, and Firebase Crashlytics (“Google Analysis Tools”) from Google Ireland Ltd., as described in more detail below, to analyse user behavior and to report on the stability and improvement of the resivo Admin Portal, resivo Utility App and/or resivo Home App, as applicable.

We use these tools to permit us to provide the service offered and / or to perform a contract with You and for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. The information generated with the aid of the Google Analysis Tools is transmitted to a server operated by Google in Ireland and stored there. In individual cases, personal data may also be transmitted to Google LLC in the USA, and we have no influence over this. Google LLC has agreed to ensuring compliance with European data protection law (https://policies.google.com/privacy/frameworks?hl=en-US).

More information about both Google Analytics Tools may be found at: Privacy and Security in Firebase (google.com) (https://firebase.google.com/support/privacy?hl=en) as well as in Google’s privacy statement.

5.2. Enabling Google Analytics for Firebase permits data about the user of the resivo Admin Portal, resivo Utility App and/or resivo Home App, as applicable, to be collected for the purposes of analysis.

Through Google Analytics for Firebase, Google collects data on the device, IP addresses, type of mobile device, version OS and app activities on our behalf to evaluate the use of the resivo Admin Portal, resivo Utility App and/or resivo Home App, as applicable, to compile reports on the activities performed within the resivo Admin Portal, resivo Utility App and/or resivo Home App, as applicable, and to permit it to offer us other services related to the use of the resivo Access Solution.

Google Analytics for Firebase automatically uses IP anonymisation. This means that the IP address of Google users within the member states of the European Union or in other signatory states to the Agreement on the European Economic Area are abbreviated. Only in exceptional cases will the full IP address be transmitted to a server of Google in the USA and abbreviated there.

You can find more information on data protection, in particular on the personal data involved in specific cases, at: https://support.google.com/firebase/answer/6318039?hl=en.

The personal data will be deleted after 14 months.

5.3. We use the Firebase Crashlytics to receive error reports following any crash of the resivo Access Solution and to measure and improve the performance of the resivo Access Solution. If the resivo Access Solution, or part thereof, crashes, information about the crash, such as device type, operating system version and some technical data, is sent to Google via the mobile device, which enables us to diagnose and solve problems (so-called crash reports). We use these tools to permit us to provide the service offered and/or to perform a contract with You and for the purposes of the legitimate interests pursued by us or by a third party, where those legitimate interests are not overridden by Your rights or interests. The data is stored anonymously.

More information about Firebase Crashlytics can be found at: https://firebase.google.com/docs/crashlytics?hl=en.

6. LOCATION OF DATA PROCESSING AND THIRD COUNTRY TRANSFERS

The data that we collect from You may be processed in, transferred to, and/or stored in:

- Switzerland: dormakaba Schweiz AG (for development, operation and support of the resivo Access Solution)

- Location of the dormakaba entity which has concluded the resivo software-as-a-service agreement with REM (which will generally be the country where the real estate managed by the REM is located; you may request further information on such location from REM)

-Location of dormakaba affiliates used as sub-processors, provided we comply with all requirements of Applicable Data Protection Laws with regard to such sub-processing

Location of sub-processors (sub-processing being understood as relating directly to the performance of the contract between us or the dormakaba entity referred to in the previous alinea with (i) You and/or (ii) the REM):

Applicable Data Protection Laws may contain restrictions for the transfer of personal data to third countries. Where we transfer Your personal data to a third country, we must comply with the Applicable Data Protection Laws and implement data transfer mechanisms and safeguards in accordance with such Applicable Data Protection Laws, if and to the extent required for such cross-border transfer. With regard to a transfer of personal data from the EU to Switzerland, the EU Commission has decided that Switzerland offers an adequate level of data protection. A copy of the documentation on the measures taken by us is available from us on request.

7. STORAGE DURATION AND DELETION

We store Your personal data in accordance with the applicable data protection laws if and for as long as this is required for the processing purposes referred to in this Privacy Statement. We then delete Your personal data in accordance with our data retention and deletion policies or take measures to properly anonymise the data. An exception to this is where we are legally obliged to keep Your personal data longer (e.g., for tax, accounting and auditing purposes). The data transmitted by You by email is kept by us until the purpose for the data storage ceases to apply (e.g., once Your request has been processed).

8. YOUR RIGHTS

As a data subject, You have the rights vis-à-vis the data controller (see clause 2 – Controller, Contact Information, EU Representative). When the data controller is us, You have the following rights vis-à-vis us or our EU Representative regarding Your personal data by sending an email to data.protection@dormakaba.com:

8.1. You may at any time withdraw any consent once given by You to the processing by us of Your personal data. As a result, we may in future no longer process Your personal data on the basis of Your consent. The withdrawal will not affect the lawfulness of any processing done on the basis of the consent up until the said withdrawal.

8.2. You can request information about Your personal data as processed by us. In particular, You can request information about the purposes of processing, the category of personal data, the categories of recipients to whom Your data was or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of Your data if it was not collected directly from You, and the existence of automated decision-making including profiling and, if necessary, meaningful information on the details of the same.

8.3. If and to the extent, as part of Your use of the resivo Admin Portal, the resivo Utility App and/or the resivo Home App, as applicable, You may input, retrieve, correct or delete Your personal data, You are responsible for the correction, retrieval or deletion of Your data in or from the resivo Access Solution. In any other cases:

a) You can request the immediate rectification of inaccurate personal data or the completion of Your personal data as stored by us and You also have the right, taking into consideration the purposes of the processing, to request the completion of incomplete personal data - including by means of an additional declaration.

b) You can request the erasure of Your personal data as stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims, whereby the right to erasure may be limited by national law.

c) You can request the restriction of the processing of Your personal data insofar as You contest the accuracy of the data, the processing is unlawful, but You object to its erasure and we no longer need the data, but it is required by You for the establishment, exercise or defence of legal claims, or You have objected to the processing.

d) You have the right to receive Your personal data that You have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller ("Right to data portability").

8.4. You can complain to a supervisory authority. As a rule, You may for such purposes contact the supervisory authority at Your usual place of residence, Your place of work or the headquarters of our EU Representative.

If Your personal data is processed on the basis of legitimate interests, You also have the right to object to the processing of Your personal data, provided there are grounds for this arising from Your particular situation. If personal data is processed for direct marketing purposes, You have the right to object at any time to the processing of Your personal data for such marketing, which includes profiling insofar as it is related to such direct marketing.

9. CHANGES OF THIS PRIVACY STATEMENT

We may amend this Privacy Statement from time to time for any reason. We will notify You of any changes by posting the new Privacy Statement in the resivo Admin Portal, the Utility App and the resivo Home App and changing the “Version” date. You should consult this Privacy Statement regularly for any changes. In case of relevant amendments, we may further notify You by email or other appropriate means.

10. COUNTRY SPECIFIC TERMS

10.1. Austria. You can reach dormakaba Austria’s data protection officer at dsgvo.at@dormakaba.com.

10.2. Australia. Where the location of the dormakaba entity which has concluded the resivo software-as-a-service agreement with REM is Australia, or dormakaba Australia Pty Ltd (dormakaba Australia) is otherwise involved in the collection, disclosure, storage or use of personal information, the following applies in addition to the clauses above:

a) “Applicable Data Protection Laws” includes the Privacy Act 1988 (Cth) and the Australian Privacy Principles, as applicable;

b) If we do not collect, hold, use or disclose Your personal information, or if You do not consent, then we may not be able to answer Your enquiry, complete the agreement or transaction into which You have entered, or provide access to the resivo Admin Portal, the resivo Utility App or the resivo Home App as applicable;

c) You can reach dormakaba Australia’s Privacy Officer at 12-13 Dansu Court, Hallam, Victoria, 3803 or at the following email address: Privacy.AU@dormakaba.com;

d) dormakaba Australia is affiliated with organisations located overseas and is likely to or will disclose some of Your personal information to overseas recipients, but will only do so where: (i) it is necessary for the purposes of giving effect to an agreement with You; and (ii) where You have provided consent or we believe on reasonable grounds that the overseas recipient is required to deal with Your personal information by enforceable laws similar to the requirements under the APPs or where it is otherwise permitted by law.  Our overseas affiliates are located in Germany and Switzerland; and

e) dormakaba Australia’s privacy policy is located here: https://www.dormakaba.com/au-en/privacy-policy.