Visitor privacy

What happens when you visit our premises

We are the Egress Software Technologies Group. More information about our group can be found at www.egress.com/about. For us privacy is not just about our software. It is about the experience that we give our customers, prospects, users, employees and visitors however they engage with us.

Egress Software Technologies Limited (we, us and our) based in the United Kingdom will hold your personal data for and on behalf of itself and its group companies. This policy sets out how the information that you give us and our group companies, or that we obtain from other sources, or learn about you from your visits to our group premises.

On this page you can find details of how we use the data that you provide to us when you visit, what we do with it and where it is stored.

If you have any questions we would be happy to answer them.  Just get in touch with our DPO:

Name

Richard Green

Address

12th Floor, The White Collar Factory, 1 Old Street Yard, London, EC1Y 8AF, United Kingdom

Email address

DPO@egress.com

Phone number

+44 (0)20 7624 8500

This policy was last updated on 19 October 2020.   We updated it to include information about track, test and trace activity, and details about the IPV.

Download PDF copy

The information we collect and how we get it

We collect information about you in a number of ways. We may combine the information that we receive from these various sources with other information that we collect or receive. We set out further below how we use this information.

If you have any questions we’d be happy to answer them, just get in touch at DPO@egress.com.

From

How we obtain or receive it

Examples of the types of information

You

  • filling out electronic or paper visitor records
  • correspondence prior to your visit
  • use of visitor access cards (if provided and available)
  • Personal contact information
  • Photograph (in some of our premises)
  • Landlord visitor records and books
  • You affirmation to certain statements (e.g. those stating that you do not have relevant health conditions on the date of your visit)

CCTV

  • Group owned CCTV systems
  • Landlord owned CCTV systems
  • Visual images

How we use the data that we collect

What we use it for

Our reasons

Our legal reason

Information type

Manage and track, and ensure the security of, your visit to our premises

We have a legitimate interest in maintaining the physical security of our group’s premises and personnel in accordance with industry practice and applicable health regulations and guidance.

Legitimate interests

Personal contact information, visual images

Conduct investigations and respond to enquiries

We may use the information that we collect about visitors to our premises where necessary or appropriate in order to conduct investigations or respond to enquiries (including to comply with legal or regulatory obligations).  These enquiries may include responding to relevant health authorities (e.g. in respect of track, test and trace programmes where applicable).

Legitimate interests, Legal Obligation

Personal contact information, visual images

Manage, track and develop our relationship with you

We may use information gained from your visit or a record of your visit as part of the information that we retain and refer to in the management of our relationship with you or your business. This may include storage of information on our CRM platform or other relevant internal systems. The uses of that information are set out in our Service Privacy Policy and Website Privacy Policy.

Legitimate interests

Personal contact information, visual images

Exercising our rights

We may need to process certain information (including personal data) in order to exercise or enforce our rights under this and any other relevant policies.

Legitimate interests, Legal obligation

Personal contact information, visual images

Responding to and actioning any request by you in exercising your legal rights in relation to your personal data

Processing may be required to provide confirmation of information to you (e.g. if you make a data subject access or data portability request) or in order to action a request that you make (e.g. correction, deletion, erasure or restriction).

Legitimate interests, Legal obligation

Personal contact information, visual images

Contact you and any relevant regulator in the event of a breach where we are legally required to do so.

Processing may be required to effectively respond to, and mitigate the effects of, any personal data breach that involves your personal data.

Legitimate Interests, Legal obligation

Personal contact information

Contacting you in response to track, test or trace type activity

We may need to contact you in the event that an incident occurs at our premises that means that you could have potentially been impacted by it.  We will use the personal contact information that we maintain in order to let you know so that you can take appropriate steps or precautions.

Vital interests of the data subject

Personal contact information

Who we may share your information with and sending information outside the country you are located in

To operate our group effectively we use shared systems, resources and sub-processors and so the information that we collect may be transferred, shared and processed within our group and to and by these third-parties. This may involve the storage, transfer and processing of this information outside the UK, the EEA, the United States or the country where you are located. Where this happens, we will ensure that any such transfer or processing is subject to appropriate legal and technical safeguards.

Any third party sub-processors are only authorised to use your personal information as necessary to provide the services to us that we request from them and must abide by data privacy and security obligations set out in applicable law.

Electronic registration: Where we use an electronic visitor system, we use a third party – Teem Technologies, Inc.. Teem, Inc. is based in the United States and more information about it can be found at https://www.teem.com/privacy/ and at www.egress.com/legal/subcontractors.

CCTV: Where we use an in-house CCTV system, we use a third party, Nest Labs, Inc.. Nest is based in the United States and more information about it can be found at https://nest.com/uk/legal/privacy-policy-for-nest-web-sites/.

Health authorities: to the extent required by relevant laws or regulations, we may share limited personal contact information with relevant health authorities or other bodies involved in track, test and trace activity to enable them to contact you through such programmes in the event of any incident at our premises or involving our personnel that you may have come into contact with.

Transfer of rights: We reserve the right to transfer our obligations, rights and permissions in the data that you provide or that we collect to any organisation to which we may transfer our business or assets (including if we, or a relevant part of us or our assets, are proposed to be purchased or acquired by a third party).

Selling your information: We will not, and do not, sell or rent your information to third-parties for: (i) valuable consideration (as defined in the California Consumer Privacy Act) or for their direct marketing purposes; or (ii) monetary consideration for the person to license or sell it to additional persons (as defined in Nevada Senate Bill 220). Your information may be shared with third parties as set out above for our business purposes.

Applicable law: We reserve the right to disclose the data that you provide or that we collect in order to comply with national, EU or Member State law to which we’re subject, including to meet any national security and law enforcement requirements. You can find out more on our approach here.

How long we will keep your information for

Type of data

How long we will retain it

Electronic personal contact information

Digital records using Teem are kept for 12 months.

CCTV

CCTV images are kept for a limited period of time but may be kept for longer for the investigation of an incident, retention of evidence or when competent authorities request us to retain them.

Your rights as an individual

As an individual you may have certain rights by law in respect of the personal data that we hold about you. These rights may not always apply as your location and the basis on which we are processing your personal data may affect their availability. You can find out more information about them and our Data Protection Officer at http://www.egress.com/legal/your-rights.

If you ever have a complaint relating to the delivery of our services, or our processing of your personal information, you can find details on how to raise this in our Complaints Policy at www.egress.com/legal.

Privacy Shield

We participate in the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and have self-certified to the U.S. Department of Commerce our adherence to the Privacy Shield Principles for all personal information received from countries in the European Economic Area, Switzerland, and the United Kingdom in reliance on the Privacy Shield. To learn more about Privacy Shield, visit the Privacy Shield website at www.privacyshield.gov/list.

Under Privacy Shield, we are responsible for the processing of personal information we receive and subsequently transfer to a third party acting for or on our behalf. We are liable for ensuring that the third parties we engage support our Privacy Shield commitments. The U.S. Federal Trade Commission has regulatory enforcement authority over our processing of personal information received or transferred pursuant to Privacy Shield. We commit to cooperate and comply with the advice of the regulatory authorities to whom you may raise a concern about our processing of personal information about you pursuant to Privacy Shield, including to the panel established by the EU authorities and the Swiss FDPIC. This is provided at no cost to you.

If you do not feel that we’ve resolved your complaint or concern satisfactorily you can contact our U.S. based third-party dispute provider (free or charge) at https://feedback-form.truste.com/watchdog/request. Under certain conditions, more fully described on the Privacy Shield website, you may invoke binding arbitration when other dispute resolution procedures have been exhausted.

TRUSTe

International Privacy Verification

Whilst the Court of Justice of the European Union (CJEU) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) ruled the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks invalid in the summer of 2020, we remain committed to the Privacy Shield Principles.  In recognition of our continued commitment, in October 2020 we self-certified with the International Privacy Verification programme (IPV). The IPV’s assessment criteria are aligned with those of the Privacy Shield and therefore by certifying with the IPV we are able to continue to demonstrate our compliance with the core Privacy Shield Principles in relation to the protection of personal data transferred outside of the UK and EU.

If you do not feel that we have resolved your complaint or concern satisfactorily you can contact our U.S based third-party dispute provider (free or charge) at https://feedback-form.truste.com/watchdog/request.

TRUSTe

Changes to this policy

We can change this policy from time to time. You (and, if you are a business, your users) should check the website periodically to make sure that you, or they, have read our most recent policy. When we do make changes, we will change the date at the top of this document.

EU Representative

If the Brexit Transition period ends and the United Kingdom leaves the European Union and/or the European Economic Area: (i) without a formal trade deal; or (ii) with a deal that does not remove any obligation on Us to appoint a representative within the European Union; or (iii) without an adequacy decision having been granted by the European Commission, then in accordance with Article 27 of the General Data Protection Regulation, Egress Software Technologies Limited (a foreign company registered on the Dutch Chamber of Commerce) further identified in the section above is our EU representative.

About us and applicable law

We are the Egress Software Technologies Group. You can find out more details about us at www.egress.com/about and you can contact us at info@egress.com. When contacting us we strongly recommend you don't email us confidential or personal information. If you do, it is at your own risk although the terms of this policy will apply to our use of that information.

Where you’re resident

Who we are

Governing law

Courts with exclusive jurisdiction

Special terms

United States

Egress Software Technologies, Inc., a Massachusetts corporation.

Office: Suite 2, Level 3, 268 Summer Street, Boston, MA 02110, United States

State of Delaware (without regard to its conflict of law principles)

State or federal courts in and for Boston, Massachusetts

Where applicable, each of us hereby waives its respective rights to a jury trial of any claim or cause of action relating to or arising out of this policy. This waiver is intended to encompass all disputes that may be filed in any court and that relate to the subject matter of this policy (including contract, tort, breach of duty and all other common law and statutory claims).

Canada

Egress Software Technologies Inc., an Ontario corporation

Office: Suite A304, 11685 Yonge Street, Richmond Hill, L4E 0K7, Canada

Province of Ontario

Province of Ontario

N/A

Netherlands, Belgium and Luxembourg

Egress Software Technologies Limited.

A Foreign Entity registered on the Dutch Chamber of Commerce (number 74110462)

Office: Oval Tower, De Entrée 99-19, Amsterdam, 1101 HE, The Netherlands

Dutch Law

NCC District Court and NCC Court of Appeal Chamber)

All proceedings will be in English. In the event that the NCC District Court and/or the NCC Court of Appeal Chamber are incompetent for any reason, the Courts of Amsterdam, The Netherlands shall have exclusive jurisdiction.

Rest of the World

Egress Software Technologies Limited.

Registered in England and Wales (number 06393598).

Registered office: 12th Floor, The White Collar Factory, 1 Old Street Yard, London, EC1Y 8AF, United Kingdom.

VAT number: 921 4606 46.

England and Wales (except if you’re a consumer resident of Northern Ireland or Scotland when you may bring proceedings there)

Courts of England and Wales (except if you’re a consumer resident of Northern Ireland or Scotland and have brought proceedings there when the Northern Irish or Scottish Courts will have jurisdiction)

N/A

Glossary

Legitimate Interest means our interest in conducting and managing our business to enable us to give you the best service and experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Vital interests of the data subject means that the processing is necessary in order to protect your interests, or those of another natural person (e.g. track, test and trace information)

View our legal hub

Click here