Last Update and Effective:<\/strong> March 29, 2024<\/p>\n\n\n\n Data Privacy Framework Standards<\/strong><\/p>\n\n\n\n This Data Privacy Framework Statement (the \u201cStatement\u201d) sets forth the privacy principles followed by Brivo, LLC and our subsidiary Brivo System B.V., (collectively \u201cBrivo\u201d) in connection with the transfer and protection of \u201cPersonal Information\u201d received from the European Union (E.U.), United Kingdom and Gibraltar the (UK) and Switzerland and supplement\u2019s Brivo\u2019s Privacy and Security Policy located at https:\/\/www.brivo.com\/privacy\/<\/a> and the Brivo Services Statement located at https:\/\/www.brivo.com\/services-privacy-statement\/<\/a> (collectively, the \u201dBrivo Privacy Policies\u201d)<\/p>\n\n\n\n About the Data Privacy Framework<\/strong><\/p>\n\n\n\n Brivo respects Consumers\u2019 concerns about privacy. As a result, Brivo complies with:<\/p>\n\n\n\n Collectively, the EU DPF, the UK Extension and the Swiss DPF are referred to as the \u201cDPF.\u201d<\/p>\n\n\n\n Brivo has certified to the U.S. Department of Commerce that (1) it adheres to the EU-U.S. Data Privacy Framework Principles (\u201cEU DPF Principles\u201d) with regard to the processing of Personal Information received from the European Union and the United Kingdom in reliance on the EU DPF and the UK Extension to the EU DPF and (2) that it adheres to the Swiss-U.S. Data Privacy Framework Principles with regard to the processing of Personal Information received from Switzerland in reliance on the Swiss-U.S. DPF (\u201cSwiss DPF Principles\u201d) the Swiss DPF Principles, together with the EU DPF Principles are referred to as the \u201cDPF Principles\u201d).<\/p>\n\n\n\n This Statement supplements the Brivo Privacy Policies, and unless specifically defined in this Statement, the terms in this Statement have the same meaning as the ones in Brivo\u2019s Privacy Policy. If there is any conflict between the terms in this Statement or the Brivo Privacy Policies and the EU DPF Principles and\/or the Swiss DPF Principles, the respective Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https:\/\/www.dataprivacyframework.gov\/<\/a>. This Statement describes how Brivo implements the DPF Principles for Consumer Personal Information.<\/p>\n\n\n\n For purposes of this Statement:<\/p>\n\n\n\n \u201cConsumer\u201d<\/strong> means any natural person who is located in the EEA, UK or Switzerland, but excludes any individual acting in his or her capacity as an Employee.<\/p>\n\n\n\n \u201cController\u201d<\/strong> means a person or organization which, alone or jointly with others, determines the purposes and means of the processing of Personal Information.<\/p>\n\n\n\n \u201cCustomer\u201d<\/strong> means any entity for which Brivo provides products and\/or services.<\/p>\n\n\n\n \u201cEEA\u201d<\/strong> means the European Union and Iceland, Liechtenstein, and Norway.<\/p>\n\n\n\n \u201cProcessor\u201d<\/strong> means any natural or legal person, public authority, agency, or other body that processes Personal Information on behalf of a Controller.<\/p>\n\n\n\n Types of Personal Information Brivo Collects<\/strong><\/p>\n\n\n\n Depending upon the context, Brivo may serve as a Controller or as a Processor of Consumer Personal Information.<\/p>\n\n\n\n Controller Activities<\/strong><\/p>\n\n\n\n As a Controller, Brivo obtains Personal Information about Consumers in various ways. For example, Brivo collects Personal Information from Consumers who visit our websites. Brivo may use Personal Information collected when the Consumer visits our websites for the purposes indicated in Brivo\u2019s Privacy Policies. The Brivo Privacy Policies may be updated from time to time as Brivo changes the types of Personal Information that it collects from Consumers. Brivo also obtains and uses Consumer Personal Information in other ways for which Brivo provides specific notice at the time of collection, such as through the Brivo Mobile Apps.<\/p>\n\n\n\n Brivo also obtains Personal Information from its vendors\u2019 and service providers\u2019 representatives. The information obtained may include contact information and payment or financial account data. Brivo uses this information to manage its relationships with its vendors and service providers, process payments, and carry out Brivo\u2019s obligations under its contracts with these parties.<\/p>\n\n\n\n Processor Activities<\/strong><\/p>\n\n\n\n As a Processor, Brivo may receive Consumer Personal Information in connection with providing services to its Customers.<\/p>\n\n\n\n Data Privacy Framework Policies<\/strong><\/p>\n\n\n\n The following privacy principles apply to the transfer, collection, use or disclosure of Personal Information from the E.U., UK and Switzerland by Brivo.<\/p>\n\n\n\n Notice<\/strong><\/p>\n\n\n\n Brivo provides information in this Statement and Brivo\u2019s Privacy Policies about its Consumer Personal Information practices as a Controller, including:<\/p>\n\n\n\n When a Customer transfers or authorizes the transfer of Consumer Personal Information to Brivo in the U.S as a Processor, the Customer is responsible for providing appropriate notice to Consumers and ensuring it is collecting such the Personal Information under a lawful basis such as for example, obtaining the Customer\u2019s requisite consent.<\/p>\n\n\n\n Choice<\/strong><\/p>\n\n\n\n When Brivo collects Consumer Personal Information in its role as a Controller, Brivo generally offers the relevant Consumers the opportunity to choose whether their Personal Information may be (i) disclosed to third-party Controllers or (ii) used for a purpose that is materially different from the purposes for which the information was originally collected or subsequently authorized by the relevant Consumer. Consumers may contact Brivo as indicated below regarding Brivo\u2019s use or disclosure of their Personal Information.<\/p>\n\n\n\n When Brivo obtains Consumer Personal Information in its role as a Processor for its Customers, Brivo\u2019s Customers are responsible for providing appropriate notice to its Consumers and ensuring it provides the relevant Consumers with certain choices with respect to the Customers\u2019 use or disclosure of the Consumers\u2019 Personal Information.<\/p>\n\n\n\n Brivo shares certain Consumer Personal Information with its affiliates and subsidiaries. Brivo may disclose Consumer Personal Information without offering an opportunity to opt out and may be required to disclose the Personal Information:<\/p>\n\n\n\n Brivo also reserves the right to transfer Consumer Personal Information in the event of an audit or if Brivo sells or transfers all or a portion of its business or assets (including in the event of a merger, acquisition, joint venture, reorganization, dissolution, or liquidation).<\/p>\n\n\n\n Accountability for Onward Transfer of Personal Information<\/strong><\/p>\n\n\n\n This Statement and Brivo\u2019s Privacy Policies describe Brivo\u2019s sharing of Consumer Personal Information.<\/p>\n\n\n\n To the extent Brivo acts as a Controller, except as permitted or required by applicable law, Brivo shall provide Consumers with an opportunity to opt out of sharing their Personal Information with third-party Controllers. Brivo requires third-party Controllers to whom it discloses such Consumer Personal Information to contractually agree to<\/p>\n\n\n\n (i) only process the Personal Information for limited and specified purposes consistent with then consent provided by the relevant Consumer,<\/p>\n\n\n\n (ii) provide the same level of protection for Personal Information as is required by the DPF Principles, and<\/p>\n\n\n\n (iii) notify Brivo and cease processing Personal Information (or take other reasonable and appropriate remedial steps) if the third-party Controller determines that it cannot meet its obligation to provide the same level of protection for Personal Information as is required by the DPF Principles.<\/p>\n\n\n\n With respect to transfers of Consumer Personal Information to third-party Processors, Brivo<\/p>\n\n\n\n (i) enters into a contract with each relevant Processor,<\/p>\n\n\n\n (ii) transfers Personal Information to each such Processor only for limited and specified purposes,<\/p>\n\n\n\n (iii) ascertains that the Processor is obligated to provide the Personal Information with at least the same level of privacy protection as is required by the DPF Principles,<\/p>\n\n\n\n (iv) takes reasonable and appropriate steps to ensure that the Processor effectively processes the Personal Information in a manner consistent with Brivo\u2019s obligations under the DPF Principles,<\/p>\n\n\n\n (v) requires the Processor to notify Brivo if the Processor determines that it can no longer meet its obligation to provide the same level of protection as is required by the DPF Principles,<\/p>\n\n\n\n (vi) upon notice, including under (v) above, takes reasonable and appropriate steps to stop and remediate unauthorized processing of the Personal Information by the Processor, and<\/p>\n\n\n\n (vii) provides a summary or representative copy of the relevant privacy provisions of the Processor contract to the Department of Commerce, upon request.<\/p>\n\n\n\n Brivo remains liable under the DPF Principles if Brivo\u2019s third-party Processor onward transfer recipients process relevant Personal Information in a manner inconsistent with the DPF Principles, unless Brivo proves that it is not responsible for the event giving rise to the damage.<\/p>\n\n\n\n Security<\/strong><\/p>\n\n\n\n Brivo takes reasonable and appropriate measures to protect Consumer Personal Information in its possession from loss, misuse and unauthorized access, disclosure, alteration, and destruction.<\/p>\n\n\n\n Data Integrity and Purpose Limitation<\/strong><\/p>\n\n\n\n Brivo seeks to ensure that any Personal Information held about E.U., UK and Swiss individuals is accurate, complete, current, and otherwise reliable in relation to the purposes for which the information was obtained. Brivo collects Personal Information that is adequate, relevant, and not excessive for the purposes for which it is to be processed. E.U., UK and Swiss individuals are responsible for assisting Brivo in maintaining accurate, complete, and current Personal Information about them. Subject to applicable law, Brivo retains Consumer Personal Information in a form that identifies or renders identifiable the relevant Consumer only for as long as it serves a purpose that is compatible with the purposes for which the Personal Information was collected or subsequently authorized by the Consumer.<\/p>\n\n\n\n Access and Correction<\/strong><\/p>\n\n\n\n To the extent Brivo acts as a Controller, and upon written request to Brivo as set forth below, Brivo will (i) provide E.U., UK and Swiss individuals with reasonable access to their Personal Information and (ii) will take reasonable steps to allow E.U., UK and Swiss individuals to review their information for the purposes of correcting their information. There are certain limitations to the Access and Correction right, as set forth on the DPF website.<\/p>\n\n\n\n When Brivo obtains Consumer Personal Information in its role as a Processor for its Customers, Brivo\u2019s Customers are responsible for providing Consumers with access to the Personal Information and the right to correct, amend or delete the information where it is inaccurate or has been processed in violation of the DPF Principles, as appropriate. In such circumstances, Consumers should direct their questions to the appropriate Brivo Customer. When a Consumer is unable to contact the appropriate Customer, or does not obtain a response from the Customer, Brivo will provide reasonable assistance in forwarding the Consumer\u2019s request to the Customer.<\/p>\n\n\n\n Recourse, Enforcement and Liability<\/strong><\/p>\n\n\n\n Brivo has developed internal mechanisms in order to adhere to the DPF Principles.<\/p>\n\n\n\n In compliance with the EU DPF and the UK Extension to the EU DPF and the Swiss DPF, Brivo commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of Personal Information received in reliance on the EU DPF and the UK Extension to the EU DPF, and the Swiss DPF should first contact Brivo using the contact information in the \u201cHow to Contact Brivo\u201d section of this Statement.<\/p>\n\n\n\n If a Consumer\u2019s complaint cannot be resolved through Brivo\u2019s internal processes, Brivo will cooperate with JAMS pursuant to the JAMS DPF Program, which is described on the JAMS website at https:\/\/www.jamsadr.com\/DPF-Dispute-Resolution<\/a>. JAMS mediation may be commenced as provided for in the JAMS rules. Following the dispute resolution process, the mediator or the Consumer may refer the matter to the U.S. Federal Trade Commission, which has DPF investigatory and enforcement powers. Under certain circumstances, Consumers also may be able to invoke binding arbitration to address complaints about Brivo\u2019s compliance with the DPF Principles.<\/p>\n\n\n\n When Brivo obtains Consumer Personal Information in its role as a Processor for its Customers, Consumers may submit complaints concerning the processing of their Personal Information to the relevant Customer, in accordance with the Customer\u2019s dispute resolution process. Brivo will participate in this process at the request of the Customer or the Consumer.<\/p>\n\n\n\n How to Contact Brivo<\/strong><\/p>\n\n\n\n To contact Brivo with questions or concerns about this Statement or Brivo\u2019s Consumer Personal Information practices or to file a complaint:<\/p>\n\n\n\n Write to:<\/p>\n\n\n\n\n
\n
\n