Yale Home Subscription - Privacy Notice – English

Personal data we require for use of the Subscription

When you purchase a Subscription, we collect and store the following:

• Your name
• Payment card details, which are securely collected and stored by our third-party payment provider on behalf of Yale
• Billing email address
• The country in which the associated product(s) are used

Depending on the level of subscription you purchase, we may also collect and store:

• Alternative contacts name and telephone number – People who you’d want us to contact in case of an emergency when you, as the primary contact, cannot be contacted
• The address at which the associated product(s) are used – so a security guard or the police can be dispatched to the property in case of an emergency
• Additional details which would assist a security guard if they were dispatched to the property in case of an emergency, such as entry codes to gates at the property boundary

Alternative contacts

When providing names and telephone numbers for alternative contacts, you must first have informed them you will provide their data to Yale and obtain their permission. You must also make them aware of this privacy notice and that their personal data will be processed in accordance with this privacy notice. If an alternative contact withdraws their permission for their data to be used in this way, you must immediately remove their details via the Yale Home App.

Personal data collected or processed based on your use of the Services

Cameras
If you use Yale cameras, you can purchase a Subscription which allows you to store recordings in the Yale cloud. This allows you to store recordings for longer than if they were only stored on the IP camera itself. The period of time the recordings are stored for will depend on which Subscription package you select.

You are always in control of who can see your recordings. In order for someone other than you to access and view your recordings, you must provide your permission, such as by providing access to an Invitee or to a third party via the ‘works with’ functionality. If you have professional monitoring included in your Subscription, Yale professional monitoring operators will be able to view limited recordings in the event of a suspected emergency. For more information, see the “Professional monitoring” section below.

We take the security of our customer’s recordings very seriously and use a range of measures to keep recordings safe, such as encrypting the recordings when they are stored and transmitted as well as using a two-step verification process when a new device is used to sign in to an account to view recordings.

A Subscription also provides access to additional camera intelligence functionality, such as detection of pets, vehicles and parcels. These detection features do not recognize individuals or specific vehicles, and as such Yale does not process personal data in order to provide these features.

In many countries there are data protection laws, such as the General Data Protection Regulation (GDPR), which may apply to your use of our IP Camera products. It is your responsibility to make sure your use of our products complies with relevant data protection laws. As an example, you should consider displaying a notice to inform visitors to your property that you are capturing visual and audio recordings, and make use of the ‘privacy zone’ feature to help you avoid capturing images of neighbouring properties or public places. You should also consider when and with whom you share recordings, and where they are shared. For example, posting a recording on social media may affect the privacy rights of individuals captured within the recording. If you are unsure whether your intended use of a camera complies with data protection laws in your country, you should refer to the data protection authority for your country. Details of data protection authorities can be found in the ‘Your rights’ section below.

24/7 Monitoring

If you purchase a Subscription which includes 24/7 monitoring, recordings from your cameras will be available to be viewed in the event of an emergency by our professional monitoring operators so they can assess whether it is a true emergency or a false alarm, to then take the appropriate action, such as call the police.

In the event of an emergency, the images for all cameras which you have registered to the relevant property on Yale Home will be available to the professional monitoring operator to view. The operator will only be able to temporarily view the images to assess whether there is a true emergency or a false alarm. The images will not be further accessed or viewed by Yale once this assessment is made at the time of the event.

The below table sets out the reasons why we process your personal data to provide the Subscription, and what our legal basis for that processing is. Please refer to the Yale Smart Products Privacy Notice for the other purposes for which Yale will process data when you use the Yale Home App.

We will transfer personal data for the purposes set out in the section entitled “How and why we use your personal data”;

• To other organisations in the ASSA ABLOY Group, whether or not going to market as ASSA ABLOY, that market, sell and support our solutions in your country. This includes ASSA ABLOY Nederland BV which provides payment and administrative support for the Subscription.
• To third parties who provide services connected to the product or its functions, but only to the extent necessary to provide these services, for example, to Amazon Web Services who may store your personal data on our behalf or third-party payment providers which manage and collect your Subscription payments on our behalf.
• With third parties that provide support services for some existing Yale Home products and Services, such as for customer support purposes.
• To third party security partners, which support us to provide 24/7 monitoring of your property, if you have selected this option as part of your Subscription.
• When required by law, including to government agencies and institutions, where legally required.
• To a buyer or a potential future buyer of our business. We do not sell or rent your personal data to third parties.

Some recipients are located in countries outside of Africa. For personal data transferred outside of South Africa, we will ensure that the recipient is, where applicable, subject to a law, binding corporate rules or binding agreement which provides an adequate level of protection that: (i) effectively upholds principles for the reasonable processing of your personal data that are substantially similar to the conditions for the lawful processing of personal data in terms of the Protection of Personal Information Act, 2013 ("POPIA"); and (ii) includes provisions, that are substantially similar to POPIA, relating to the further transfer of personal data from the recipient to third parties who are in a foreign country. Alternatively, we will only transfer your personal data outside of South Africa if:

• you consent to the transfer;
• the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in response to your request;
• the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party; or
• the transfer is for your benefit, and (i) it is not reasonably practicable to obtain your consent to that transfer; and (ii) if it were reasonably practicable to obtain such consent, you would be likely to give it.

Given the types of personal data we will collect, transfer and store, including, unique identifiers (i.e. usernames and passwords), special personal data (i.e. CCTV/IP camera recordings) and personal data of children (i.e. persons under the age of 18 who may be captured on the CCTV/camera recordings),  we shall ensure, in accordance with Section 57 of POPIA that we obtain the necessary authorisations from the Information Regulator before we:

• process any unique identifiers (i) for a purpose other than the one for which the identifier was specifically intended at collection; and (ii) with the aim of linking the information together with information processed by other responsible parties; or
• transfer special personal data or the personal data of children to a third party in a foreign country that does not provide an adequate level of protection for the processing of personal data.

We take measures to protect all personal data transferred to a third party, or to other countries, in accordance with applicable data protection laws.

We store personal data for as long as necessary to fulfil the purpose for which the data has been collected, and in accordance with our internal record retention schedule. This means that we delete your personal data when such data is no longer necessary to process a request, or to manage your account or our client relationship. Statistics which have been anonymised may be saved for longer.

If you have cameras, you can purchase a Subscription which allows you to store recordings in the Yale cloud. This allows you to store recordings for longer than if they were only stored on the camera itself, without a Subscription. The period of time the recordings are stored for will depend on which Subscription package you select.

If you unsubscribe, new recordings will no longer be stored in the Yale cloud, however you will still be able to view existing recordings until they are deleted in accordance with the storage period of your Subscription.

In relation to the personal data that we hold about you, you have the right to:

• Request a copy of your personal data from our records;
• Ask that we correct or erase your personal data (though this may mean that we cannot process requests, or that your account expires);
• Ask us to stop processing your personal data (for example as regards the use of the data to improve our product);
• Ask us to restrict how we process your personal data (for example if you deem the data to be incorrect);
• Request the personal data used to provide you with information you requested or manage your account or our relationship, in a machine-readable format, which you are entitled to transfer to another data controller; and
• Withdraw your consent where you have consented to us processing your data at any time.

We may not accept a request to erase your personal data where we require it to comply with a legal obligation or in relation to a legal claim.

For information about how to requests to exercise your rights, see Contact Us below.

If you have a complaint regarding our processing of your personal data you are entitled to report this to the supervisory authority for the personal information processing of ASSA ABLOY, including the Information Regulator’s established under POPIA or other African data protection law.

We may update this privacy notice from time to time in response to changing legal, regulatory or operational requirements. If we make any material changes to this Privacy Notice, we will notify you by placing a prominent notice on our website or in the app.

If you have any questions about this Privacy Notice or our processing of your personal data, please contact us at privacy@yale.co.uk

South African Information Officer:

• Email address: privacy.za.openingsolutions@assaabloy.com
• Postal address: Attn: ASSA ABLOY Information Officer at P.O. Box 146, Roodepoort, South Africa, 1725

Notice version 1.0 November 2023