Visitor Privacy

We are the Egress Software Technologies Group. More information about our group can be found at www.egress.com/about. For us privacy is not just about our software. It is about the experience that we give our customers, prospects, users, employees and visitors however they engage with us.

Egress Software Technologies Limited (we, us and our) based in the United Kingdom will hold your personal data for and on behalf of itself and its group companies. This policy sets out how the information that you give us and our group companies, or that we obtain from other sources, or learn about you from your visits to our group premises.

On this page you can find details of how we use the data that you provide to us when you visit, what we do with it and where it is stored.

If you have any questions we would be happy to answer them.  Just get in touch at DPO@egress.com.

This policy was last updated on 9 May 2024. 

The information we collect and how we get it

We collect information about you in a number of ways. We may combine the information that we receive from these various sources with other information that we collect or receive. We set out further below how we use this information.

Security

The security and confidentiality of your personal information is very important to us. We have implemented commercially reasonable technical and organizational safeguards to appropriately protect your personal information against accidental, unauthorized, or unlawful access, use, loss, destruction or damage. The measures that we utilize are administrative--[such as the training of employees on privacy and information security-related activities], technical--[such as pseudonymization or encryption techniques, and network firewalls], and physical--[such as locks and video surveillance].

We limit access to your personal information to those employees, agents, contractors and other third-parties who have a business need to know.  They will only process your personal data on our instructions and they are subject to a duty of confidentiality. 

Still, no system can be guaranteed to be 100% secure. If you have questions about the security of your personal information, or if you have reason to believe that the personal information that we hold about you is no longer secure, please contact us immediately as described in this Privacy Notice.

 

From	How we obtain or receive it	Examples of the types of information
You	-   filling out electronic or paper visitor records to use or our corporate landlords -   correspondence prior to your visit -   use of visitor access cards (if provided and available)	-   Personal contact information -   Photograph (in some of our premises) -   Landlord visitor records and books -   Your affirmation to certain statements (e.g. those stating that you do not have relevant health conditions on the date of your visit)
CCTV	-   Group owned CCTV systems -   Landlord owned CCTV systems	-   Visual images without audio

How we use the data that we collect

What we use it for	Our reasons	Our lawful basis	Information type
Manage and track, and ensure the security of, your visit to our premises	We have a legitimate interest in maintaining the physical security of our group’s premises and personnel in accordance with industry practice and applicable health regulations and guidance.	Legitimate interests	Personal contact information, visual images
Conduct investigations and respond to enquiries	We may use the information that we collect about visitors to our premises where necessary or appropriate in order to conduct investigations or respond to enquiries (including to comply with legal or regulatory obligations).  These enquiries may include responding to relevant health authorities (e.g. in respect of track, test and trace programmes where applicable).	Legitimate interests, Legal Obligation	Personal contact information, visual images
Manage, track and develop our relationship with you	We may use information gained from your visit or a record of your visit as part of the information that we retain and refer to in the management of our relationship with you or your business. This may include storage of information on our CRM platform or other relevant internal systems. The uses of that information are set out in our Service Privacy Policy and Website Privacy Policy.	Legitimate interests	Personal contact information, visual images
Exercising our rights	We may need to process certain information (including personal data) in order to exercise or enforce our rights under this and any other relevant policies.	Legitimate interests, Legal obligation	Personal contact information, visual images
Responding to and actioning any request by you in exercising your legal rights in relation to your personal data	Processing may be required to provide confirmation of information to you (e.g. if you make a data subject access or data portability request) or in order to action a request that you make (e.g. correction, deletion, erasure or restriction).	Legitimate Interests, Legal Obligation	Personal contact information, visual images
Contacting you in response to track, test or trace type activity	We may need to contact you in the event that an incident occurs at our premises that means that you could have potentially been impacted by it.  We will use the personal contact information that we maintain in order to let you know so that you can take appropriate steps or precautions.	Legal obligation	Personal contact information

Who we may share your information with and sending information outside the country you are located in

To operate our group effectively we use shared systems, resources and sub-processors and so the information that we collect may be transferred, shared and processed within our group and to and by these third-parties. This may involve the storage, transfer and processing of this information outside the UK, the EEA, the United States or the country where you are located. Where this happens, we will ensure that any such transfer or processing is subject to appropriate legal and technical safeguards.

Any third party sub-processors are only authorised to use your personal information as necessary to provide the services to us that we request from them have contracts in place to maintain at least the same data privacy and security obligations we adhere to.

Electronic registration: Where we use an electronic visitor system, we use a third party – Teem Technologies, Inc.. Teem, Inc. is based in the United States and more information about it can be found at https://www.teem.com/privacy/ and at www.egress.com/legal/subcontractors.

CCTV: Where we use an in-house CCTV system, we use a third party, Nest Labs, Inc.. Nest is based in the United States and more information about it can be found at https://nest.com/uk/legal/privacy-policy-for-nest-web-sites/.

Health authorities: to the extent required by relevant laws or regulations, we may share limited personal contact information with relevant health authorities or other bodies involved in track, test and trace activity to enable them to contact you through such programmes in the event of any incident at our premises or involving our personnel that you may have come into contact with.

Transfer of rights: We reserve the right to transfer our obligations, rights and permissions in the data that you provide or that we collect to any organisation to which we may transfer our business or assets (including if we, or a relevant part of us or our assets, are proposed to be purchased or acquired by a third party).

Selling your information: We will not, and do not, sell or rent your information to third-parties for: (i) valuable consideration (as defined in the California Consumer Privacy Act) or for their direct marketing purposes; or (ii) monetary consideration for the person to license or sell it to additional persons (as defined in Nevada Senate Bill 220). Your information may be shared with third parties as set out above for our business purposes.

Applicable law: We reserve the right to disclose the data that you provide or that we collect in order to comply with national, EU or Member State law to which we’re subject, including to meet any national security and law enforcement requirements. You can find out more on our approach here.

How long we will keep your information for

Type of Data	How long we will retain it
Electronic personal contact information	Digital records using Teem are kept for 12 months.
CCTV	CCTV images are kept for a limited period of time but may be kept for longer for the investigation of an incident, retention of evidence or when competent authorities request us to retain them.

Your rights as an individual

As an individual you may have certain rights by law in respect of the personal data that we hold about you. These rights may not always apply as your location and the basis on which we are processing your personal data may affect their availability. You can find out more information about them and our Data Protection Officer at https://www.egress.com/legal/your-rights.

If you ever have a complaint relating to the delivery of our services, or our processing of your personal information, you can find details on how to raise this in our Complaints Policy at www.egress.com/legal.

Data Privacy Framework

Egress Software Technologies Limited complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Egress Software Technologies Limited has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Egress Software Technologies Ltd has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

The Federal Trade Commission has jurisdiction over Egress Software Technology’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Egress Software Technologies Ltd commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship. This is provided at no cost to you.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Egress Software Technologies Ltd commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to PrivacyTrust, an alternative dispute resolution provider based in the United Kingdom.  If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://privacytrust.com/services/data-privacy-framework/dispute-resolution/ for more information or to file a complaint.  The services of Privacy Trust are provided at no cost to you.

You have the right, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. Further details may be found in the DPF Annex I.

Egress Software Technologies Limited shall remain liable under the DPF Principles if we or our third parties transfer or process such personal information in a manner inconsistent with the DPF Principles.

Changes to this policy

We can change this policy from time to time. You (and, if you are a business, your users) should check the website periodically to make sure that you, or they, have read our most recent policy. When we do make changes, we will change the date at the top of this document.

EU Representative

Egress Software Technologies Limited (a foreign company registered on the Dutch Chamber of Commerce) further identified in the section below is our EU representative.

About us and applicable law

We are the Egress Software Technologies Group. You can find out more details about us at www.egress.com/about and you can contact us at info@egress.com. When contacting us we strongly recommend you don't email us confidential or personal information. If you do, it is at your own risk although the terms of this policy will apply to our use of that information.

Where you are resident	Who we are	Governing law	Courts with exclusive jurisdiction	Special Terms
United States	Egress Software Technologies, Inc., a Massachusetts corporation. Office: Level 7, Industrious, 22 Boston Wharf Road, Boston, 02210, United States	State of Delaware (without regard to its conflict of law principles).	State or federal courts in and for Boston, Massachusetts	Where applicable, each of us hereby waives its respective rights to a jury trial of any claim or cause of action relating to or arising out of this policy. This waiver is intended to encompass all disputes that may be filed in any court and that relate to the subject matter of this policy (including contract, tort, breach of duty and all other common law and statutory claims).
Canada	Egress Software Technologies Inc., an Ontario corporation Office: 30 Via Renzo Drive, Suite 200, Richmond Hill, ON L4S, 0B8, Canada	Province of Ontario	Province of Ontario	N/A
European Union or European Economic Area	Egress Software Technologies Limited. A Foreign Entity registered on the Dutch Chamber of Commerce (number 74110462) Office: Herengracht 420, 1017 BZ, The Netherlands	Dutch Law	NCC District Court and NCC Court of Appeal Chamber	All proceedings will be in English.  In the event that the NCC District Court and/or the NCC Court of Appeal Chamber are incompetent for any reason, the Courts of Amsterdam, The Netherlands shall have exclusive jurisdiction.
Australia, New Zealand, and Singapore	Egress Software Technologies Pty Ltd (CAN: 557 428 971). Suite 902, Level 9, 146 Arthur Street, North Sydney, NSW 2060	Federal laws of Australia and the State of NSW	Sydney, NSW, Australia	N/A
UK and Rest of the World	Egress Software Technologies Limited. Registered in England and Wales (number 06393598). Registered office: 12th Floor, The White Collar Factory, 1 Old Street Yard, London, EC1Y 8AF, United Kingdom. VAT number: 921 4606 46.	England and Wales (except if you're a consumer resident of Northern Ireland or Scotland when you may bring proceedings there)	Courts of England and Wales (except if you're a consumer resident of Northern Ireland or Scotland and have brought proceedings there when the Northern Irish or Scottish Courts will have jurisdiction).	N/A

Glossary

Legitimate Interest means our interest in conducting and managing our business to enable us to give you the best service and experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Vital interests of the data subject means that the processing is necessary in order to protect your interests, or those of another natural person (e.g. track, test and trace information)