Privacy Policy

1. Overview

This policy explains how teamzPass ('we', 'us') handles personal data when you use our access control platform, credentials, mobile wallet passes, or website. It applies to the organisations that deploy teamzPass (our customers) and to the people who use a teamzPass credential at a building (your employees, contractors or visitors).

Where an organisation deploys teamzPass for its own staff or visitors, that organisation is typically the data controller for its people, and teamzPass acts as a data processor on its instructions. This policy describes our processing in that role as well as our own use of data as a controller, for example for our own website and sales activity.

2. Information we collect

Depending on how teamzPass is used, we process:

• Account and contact details for administrators and billing contacts - name, work email, phone number, employer.
• Credential and access data for end users - name, employee or visitor ID, credential type, assigned zones and schedules, photo where biometric access is enabled.
• Access event data - door, time, credential used, grant or denial outcome, and any associated attendance or visitor record derived from that event.
• Device and wallet data needed to issue a credential to Apple Wallet or Google Wallet, limited to what those platforms require to provision and update a pass.
• Technical data from our website and product interfaces - IP address, browser type, pages visited, and diagnostic logs.

3. How we use information

We use personal data to:

• Operate the access control, attendance, visitor management and credential features a customer has enabled.
• Issue, update and revoke credentials, including passes delivered to Apple Wallet and Google Wallet.
• Maintain the audit trail a customer relies on for security and compliance.
• Provide support, respond to enquiries, and communicate service updates.
• Improve reliability and security of the platform, including detecting misuse.
• Meet legal, tax and regulatory obligations.

4. Legal bases for processing

Where the UK GDPR, EU GDPR or a similar law applies, we rely on: performance of a contract with the customer organisation; the customer organisation's legitimate interests in operating access control and attendance for its own premises; our legitimate interests in operating and securing the platform; and, where required, consent - for example for optional biometric features.

A customer organisation is responsible for having its own lawful basis for the access, attendance and visitor data it collects about its people, and for informing them accordingly.

5. Cookies and similar technologies

Our marketing website uses a small number of cookies for essential site function and, where enabled, aggregate analytics. It does not use third-party advertising cookies. The product itself uses session identifiers necessary to keep an administrator signed in securely.

6. How we share information

We share personal data with:

• Sub-processors who help us run the platform, such as cloud hosting, email delivery and payment providers, under written data processing terms.
• Apple and Google, solely as needed to provision and manage a wallet credential, and governed by their own respective wallet terms.
• Certified installation partners, where a customer has engaged one, limited to what that partner needs to install, configure or support the system.
• Authorities, where required by law, to protect rights, safety or property, or to investigate misuse.

7. Data retention

We retain access event, attendance and visitor data for as long as the customer's account is active and as configured by the customer, then for a limited period afterwards to allow export and to meet legal obligations, after which it is deleted or anonymised. A customer can request earlier deletion of data it controls, subject to any legal retention requirement.

8. International transfers

Where personal data is transferred outside the country or region in which it was collected, we use recognised safeguards such as Standard Contractual Clauses or an equivalent adequacy mechanism.

9. Your rights

Depending on where you are, you may have the right to access, correct, delete, restrict or port your personal data, and to object to certain processing. If teamzPass processes your data on behalf of an organisation you belong to, please contact that organisation first, since it controls the data; we will support it in responding to your request. Where teamzPass is the controller, contact us using the details below.

10. Security

We apply technical and organisational measures appropriate to the sensitivity of access control data, including encryption in transit, access controls on our own systems, and a full audit trail of administrative actions. No system is perfectly secure, and we will notify affected customers of a confirmed personal data breach without undue delay, as required by law.

11. Children's privacy

teamzPass is a business product and is not directed at children. Where a customer issues visitor or dependent access to a minor, that customer is responsible for appropriate consent under applicable law.

12. Changes to this policy

We may update this policy as the product or the law changes. We will post the revised version here with a new date, and where a change is material we will notify customer administrators directly.

13. Contact us

Questions about this policy or a data request can be sent through our contact page at teamzpass.com/contact/. If your organisation uses teamzPass and you are an end user, please also contact your own administrator, since they control your access data.