Brivo Services Privacy Statement

Last Update and Effective: October 22, 2026

1. INTRODUCTION.  

This Brivo Services Privacy Statement (“Privacy Statement”) describes Brivo, Inc.’s (together with its affiliates and subsidiaries, collectively, “Brivo,” “we,” “us,” or “our”) privacy practices in relation to the data Brivo receives through the use of the Brivo Products and Services, including without limitation Customer Data (which may include “personal information” as defined under all federal, state, and international laws, rules, regulations, directives, and governmental requirements relating to the privacy, security, confidentiality, or processing of personal information that are applicable to the Brivo Products and Services, as amended, supplemented, or replaced from time to time (“Applicable Data Privacy Laws”)).  

Any capitalized terms used but not otherwise defined herein have the meaning set forth in our Brivo Terms of Service at https://www.brivo.com/service-terms (the “Brivo Terms of Service”) or relevant Applicable Data Privacy Laws.

2. OVERVIEW OF BRIVO, CUSTOMER, AND BRIVO RESELLER ROLES IN PROTECTION OF CONSUMER DATA.

Brivo provides the Brivo Products and Services to Customers via Brivo Resellers. Such Brivo Resellers selected by the Customer handle the initial setup and configuration of the Customer’s Brivo account(s). Customers can choose what data to share with the applicable Brivo Reseller and/or Brivo during the set-up process. After the initial set-up, the Customer’s access to the Brivo Products and Services is limited to its Authorized Users.  Customers are responsible for authorizing and managing access to Customer Data by their Authorized Users and any Brivo Resellers or other parties to whom Customer grants access. Customers are responsible for monitoring all access to and use of the Customer’s account and Customer Data. Brivo is not responsible for any unauthorized use or misuse of the Customer’s account access, account privileges or Customer Data by anyone using access provided by the Customer.

As described herein, Brivo may process personal information for or on behalf of our Customers. To this end, if not stated otherwise in this Privacy Statement, we process such personal information as a processor on behalf of our Customer (and its affiliates), who is the controller of the personal information. Brivo is not responsible for and has no control over the privacy and data security practices of our Customers, which may differ from those explained in this Privacy Statement. If your data has been submitted to us in our role as a processor by or on behalf of a Brivo Customer and you wish to exercise any rights you may have under Applicable Data Privacy Laws, please inquire with the Customer directly.  In some instances, we may only access certain Customer Data upon a Customer’s instruction.  If you wish to make your request directly to us, please provide us with the name of the Customer who submitted your data to us. We will refer your request to that Customer and will support them as needed in responding to your request within a reasonable time frame.

Certain Brivo employees may also have access to Customer Data, solely in connection with the provision of Brivo Products and Services and to respond to specific Customer and Brivo Reseller requests for technical support. Brivo will access Customer Data only for the purposes of providing the Brivo Products and Services, preventing, or addressing service or technical problems, in accordance with the provisions of any separate written agreement between Brivo and Customer (such as, for example, the Brivo Terms of Service), or as may be required under Applicable Data Privacy Laws.

3. COLLECTION, USE, AND SHARING OF CUSTOMER DATA.

Brivo collects and processes all Customer Data, including data that is considered personal information under Applicable Data Privacy Laws, strictly on behalf of Customers in accordance with Brivo’s contractual agreements with them and/or as defined in the Brivo Terms of Service and/or as required or permitted under such Applicable Data Privacy Laws.

Customers are responsible for ensuring that Customer Data is collected and processed in accordance with all applicable laws, including without limitation all Applicable Data Privacy Laws. Since Customer Data is managed by the Customer, the Customer is responsible for providing appropriate notice and choice regarding Brivo’s processing of Customer Data on behalf of the Customer. If an individual has any questions or concerns related to Brivo’s handling of Customer Data pertaining to them, he or she may contact us at privacy@brivo.com and we will work with the applicable Customer to address the concern.

Brivo may also collect personal information from Customer employees, contractors, or agents in order to properly manage Brivo’s business relationship with Customer. Customers will receive login credentials to manage their accounts with Brivo for the applicable Brivo Products and Services, including such personal information.

Types of Customer Data Collected Related to the Brivo System

Brivo collects the following types of Customer Data:

• Information provided by Customers:  Customers may provide certain personal information, such as contact information including email addresses and phone numbers, names of Authorized Users, and payment details, when registering an account with Brivo for certain Brivo Products and Services. Certain Brivo Products and Services provide the capability for Customers to store personal information in the nature of identifiers such as an individual’s first and last name and credential number.  We may also offer informational materials from time-to-time in connection with the Brivo Products and Services, and we may collect personal information when you sign up or register for such materials.. Certain Brivo Products and Services may include features which allow Customers to collect additional categories of information used to correlate events to a specific individual, or to enable notifications and mobile application functionality, such as photographs used as biometric identifiers.. The Customer is solely responsible for determining if storage of this data is appropriate and permitted in the context of Applicable Data Privacy Laws, and for obtaining all relevant consent from data subjects.  

• Generated Information:  Certain Brivo Products and Services, including cameras and sensors, enable the recording and archiving of certain information such as video and audio information, individuals’ access to certain locations and timestamps for the same, etc. This data might contain images of people, vehicles, or events. Furthermore, this data is often analyzed with the purpose of providing Customers with certain analytics about their data and to provide configurable alerts.   Certain personal information, including face-related data obtained through the Brivo Products and Services, is processed only when a Customer enables certain product features. Customers configure the Brivo Products and Services they use as well as the retention settings for video, images, and recordings. Brivo Products and Services may be used by Customers to collect activity and event data, for example, to  to record that an access credential was used at a particular door at a certain time. Through correlation with the information a Customer provides, Brivo may be able to tie an access event to a particular individual’s credential number.

• Device/Log Information: Brivo Products and Services may record the actions of Authorized Users, as well as the status and the settings of various devices that have been configured to operate with relevant Brivo Products and Services. Log information may be used by the Customer to review the activity of Authorized Users.

• Mobile Applications: Brivo provides mobile applications which include and can be used with other Brivo Products and Services by Authorized Users. For example, Brivo’s mobile application provides administrative access to Brivo’s services and certain other Brivo Products and Services. Such mobile applications include Brivo Mobile Key, which is a form of digital credential used, for example, to authorize physical access to a building. Brivo uses Wi-Fi and Bluetooth to identify when the device is within proximity to applicable available Brivo readers to open the proper lock or door. In order to use the services offered through Brivo’s mobile application, various features such as location services, Wi-Fi and Bluetooth communication must be activated on the mobile device. 

In connection with the above, Brivo may collect Customer Data that constitutes “sensitive” personal information under Applicable Data Privacy Laws, including social security numbers, driver’s license/passport numbers, account login credentials, precise geolocation, racial/ethnic origin, biometric information, and health information, as applicable to Brivo’s Products and Services. Precise geolocation data may include real-time latitude and longitude coordinates and movement patterns over time.  Customers agree to obtain all required consents from Authorized Users of Brivo Products and Services as required under Applicable Data Privacy Law and hereby consent to Brivo’s use of sensitive personal information as described herein. Brivo only uses sensitive personal information as described in this and other applicable privacy notices and as permitted under Applicable Data Privacy Laws. 

Customer Data may be used or disclosed by Brivo for business purposes to:

• Provide and maintain Brivo Products and Services, including our physical access control and smart building services.
• To fulfill or meet the reason a Customer or Authorized User provided the information (e.g., to set up and manage relevant Brivo accounts and provide access control services).
• To provide, support, personalize, and develop our products, services, and related operations, including a Customer’s account. 
• To process your requests, transactions, and payments.
• To provide you with support and to respond to your inquiries, including investigating and addressing your concerns and monitoring and improving our responses.
• To help maintain the safety, security, and integrity of our products, services, databases, technology assets, and business.
• For testing, research, analysis, and product development, including to develop and improve our products and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• Enable event notifications and functionality to Brivo’s mobile application, include Brivo Mobile Key.
• Contact Customers to inform them of product and service enhancements that Brivo thinks may be of interest to them.
• Provide important service notices regarding the Brivo Products and Services (while Customers use Brivo Products and Services, it will not be possible to opt out of communications specifically regarding the Brivo Products and Services, though Customers may opt-out of marketing communications.)
• Ask the Customer to participate in surveys that help Brivo better understand the Customer’s needs in order to improve Brivo Products and Services.
• To verify and authenticate user identity and access credentials.
• To comply with federal, state, or local laws and regulations.
• To detect and prevent security incidents and fraud.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at the business.

Brivo also shares data with relevant third-party service providers when explicitly authorized by Customers, Authorized Users, and as permitted under Applicable Data Privacy Laws.

Brivo does not sell or share Customer Data collected or processed in connection with the Brivo Products and Services for monetary consideration. Brivo has not shared personal information for cross-context behavioral advertising in the preceding twelve (12) months for Brivo’s Products and Servies unless described otherwise in Brivo’s Website Privacy Policy, which solely applies to Brivo’s website at www.brivo.com and other websites controlled by Brivo upon which it is posted.

Brivo may utilize Customer Data containing personal information to personalize your experience using the Brivo Products and Services and to deliver content and product and service offerings relevant to your interests, specifically, to suggest additional Brivo Products and Services if you are an existing Customer.

Additionally, in the event of a merger, acquisition, reorganization, sale of assets, or similar transaction involving Brivo, personal information may be transferred as part of that transaction.

By using the Brivo Products and Services, Customer agrees and hereby opts-in to the uses and sharing for business purposes of personal information as described herein, and represents and warrants that it will obtain all required permissions prior to collecting and using any Authorized User data to comply with Applicable Data Privacy Laws.  

4. YOUR RIGHTS

You may request access to, correction of, or deletion of the personal information you have provided to us by contacting us at privacy@brivo.com or the mailing address below. You may also opt out of receiving non-essential communications from us at any time. We will respond to reasonable requests in a manner consistent with Applicable Data Privacy Laws.

Please note that we may need to retain certain information for legitimate business, legal, or regulatory purposes, and that some requests may be subject to verification of your identity. We reserve the right to deny requests that are unreasonable, repetitive, or otherwise inconsistent with applicable law.

Certain states may provide (now or in the future) their residents with additional rights and choices with respect to their personal information, including allowing consumers to opt-out of certain sales or uses of their personal information. However, the exact scope of these rights varies by state. To exercise any of these rights or if you have any questions, please contact us at the address below. 

This Privacy Statement is not intended to create rights or obligations beyond those required by Applicable Data Privacy Laws. 

To exercise your rights described above, please submit a verifiable consumer request to us by any of the following methods:

• Email: Send a request to privacy@brivo.com.
• Mail: Brivo Privacy Officer, Brivo, Inc., 
  3001 Bee Caves Rd

  Austin, TX 78746 USA.

As described in Section 2 above, Brivo may process personal information for or on behalf of a Customer who acts as the controller of the relevant personal information. If your personal information has been submitted to us in our role as a processor by or on behalf of a Brivo Customer and you wish to exercise any rights you may have under Applicable Data Privacy Laws, please inquire with the Customer directly.  In some instances, we may only access certain Customer Data upon a Customer’s instruction.  If you wish to make your request directly to us, please provide us with the name of the Customer who submitted your data to us. We will refer your request to that Customer and will support them as needed in responding to your request within a reasonable time frame or as required under Applicable Data Privacy Laws. 

Brivo will not discriminate or retaliate against you for exercising any of the rights described above. 

California Residents:

This Section applies to California residents and describes how we collect, use, disclose, and otherwise process those residents’ personal information, and explains the rights California residents may have available under the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”) (collectively, the “CCPA/CPRA”). 

Information We Collect

Brivo collects or processes in connection with the Brivo Products and Services the following categories of personal information from California consumers within the last twelve (12) months.

Category	Examples	Collected	Retention
A. Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES	As long as the account is active, plus up 90 days after account termination, or as required by law.
B. California Customer Records (Cal. Civ. Code § 1798.80(e))	Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES	As long as the account is active, plus up to 90 days after account termination, or as required by law.
C. Protected Classification Characteristics	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES	As long as the account is active, plus up 90 days after account termination, or as required by law.
D. Commercial Information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES	As long as the account is active, plus up 90 days after account termination, or as required by law.
E. Biometric Information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	YES	As long as the account is active, plus up 90 days after account termination, or as required by law
F. Internet or Similar Network Activity	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES	As long as the account is active, plus up 90 days after account termination, or as required by law
G. Geolocation Data	Physical location or movements. This may include precise geolocation data.	YES	As long as the account is active, plus up 90 days after account termination, or as required by law
H. Sensory Data	Audio, electronic, visual, thermal, olfactory, or similar information.	YES	As long as the account is active, plus up 90 days after account termination, or as required by law
I. Professional or Employment-Related Information	Current or past job history or performance evaluations.	NO	N/A
J. Non-Public Education Information (per 20 U.S.C. § 1232g; 34 C.F.R. Part 99)	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO	N/A
K. Inferences	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO	N/A
L. Sensitive Personal Information	See below for detailed categories. Includes SSN/driver’s license/passport numbers, account login credentials, precise geolocation, racial/ethnic origin, biometric information, and health information, as applicable to Brivo’s Products and Services.	YES (certain categories)	See below for category-specific retention.

As described above, these categories of information may be collected by a Customer using the Brivo Products and Services, and the Customer is solely responsible for ensuring that the collection and use of the personal information complies with the CCPA/CPRA.  Unless otherwise prohibited by applicable law, Brivo deletes all information stored by Customers ninety (90) days after your agreement to use Brivo Products or Services expires, is terminated, is not renewed, is otherwise discontinued for any reason, as described in greater detail in the Brivo Terms of Service. 

Brivo obtains the categories of personal information listed above (i) directly from you (for example, from forms you complete or products and services you purchase); (ii) indirectly from you (for example, through observing your actions through the Brivo Products and Services); (iii) from third-party business partners and service providers; and (iv) from your employer or the entity that manages the Brivo-enabled property you access.

Sensitive Personal Information

The CPRA establishes the category of “sensitive personal information,” which may be subject to additional consumer rights and business obligations. Customers may elect to collect certain sensitive personal information from Authorized Users, including social security numbers, driver’s license numbers, passport numbers, account credentials along with any required passwords or codes, precise geolocation data, and biometric information for unique identification, which would be stored by Brivo in the applicable Brivo Products and Services as long as the account is active, plus up 90 days after account termination, or as required by law.  Customers are responsible for obtaining all required consents, including opt-in consent, for the collection, processing, and other use of sensitive personal information required under Applicable Data Privacy Laws. 

Brivo may collect and use  the sensitive personal information identified above for the following purposes:

• To provide and maintain our physical access control, video recording and smart building services.
• To verify and authenticate user identity and access credentials.
• To comply with federal, state, or local laws and regulations.
• To detect and prevent security incidents and fraud.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at the business.

Brivo uses sensitive personal information only for the purposes described above or for purposes expressly permitted by the CCPA/CPRA under Cal. Civ. Code § 1798.121(a). Brivo does not use or disclose sensitive personal information for the purpose of inferring characteristics about a consumer. 

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the business or commercial purposes described in Section 3 above. Brivo will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you with notice.

Sharing Personal Information

Brivo may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. We share your personal information with the following categories of third parties: (i) Service providers; (ii) Law enforcement; and (iii) Third party applications and devices that you connect to your Brivo Account.

In the preceding twelve (12) months, Brivo has disclosed all of the categories of personal information it described as a “YES” in the above chart for a business purpose to service providers, law enforcement, and/or third party applications and devices that you connect to your Brivo Account. Brivo has not sold personal information of California consumers in the preceding twelve (12) months. Brivo has not shared personal information for cross-context behavioral advertising in the preceding twelve (12) months.

Brivo does not have actual knowledge that it sells or shares the personal information of minors under 16 years of age.

Your Rights and Choices  

The CCPA/CPRA provide California residents with the following specific rights regarding their personal information:

• Right to Know/Right to Access: You have the right to request that we disclose certain information to you about our collection and use of your personal information. Once we receive and confirm your verifiable consumer request, we will disclose to you: (i) the categories of personal information we collected about you; (ii) the categories of sources from which the personal information is collected; (iii) our business or commercial purpose for collecting, selling, or sharing that personal information; (iv) the categories of third parties to whom we disclose, sell, or share that personal information; (v) the specific pieces of personal information we collected about you; and (vi) If we sold or shared your personal information, two separate lists disclosing: (a) sales, identifying the personal information categories that each category of recipient purchased; and (b) disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• Right to Delete: You have the right to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers, contractors, and any third parties who have received your personal information to delete) your personal information from our records, unless an exception applies. We may deny your deletion request in certain circumstances. If we deny your request, we will explain to you why retaining the information is necessary to us or our service providers/third parties and allowable under the CCPA/CPRA. 
• Right to Correct Inaccurate Personal Information: You have the right to request that Brivo correct inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing. Upon receiving a verified request to correct inaccurate personal information, we will use commercially reasonable efforts to correct the information as directed by you. For requests to correct personal information, we may also require you to provide documentation or a detailed explanation supporting the claim that the personal information is inaccurate.
• Right to Opt Out of Sale or Sharing:  You have the right to direct us to not sell or share your personal information. Although Brivo does not currently sell or share personal information, we respect your right to opt out. To exercise your right to opt out, you or your authorized agent may contact us at privacy@brivo.com or at the mailing address included below. We currently do not respond to DNT signals. 
• Disclosure of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information to only those uses that are necessary to perform or provide the goods and services reasonably expected by an average consumer who requests such goods or services, and as otherwise authorized under the CCPA/CPRA.  To exercise this right, you may contact us at privacy@brivo.com or at the mailing address included below.

As noted above, Brivo uses sensitive personal information only for the purposes described herein and does not use such information for the purpose of inferring characteristics about consumers.

To exercise your rights, please submit a verifiable consumer request to us as described above.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must: (i) provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and (ii) describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We must verify your identity before fulfilling your request to know, delete, or correct personal information. The verification process may vary depending on the nature and sensitivity of the request.  We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. 

Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. 

Brivo will not discriminate or retaliate against you for exercising any of your CCPA/CPRA rights. 

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 more days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. 

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. 

Other State Data Privacy Laws:

Certain states may provide their residents with additional rights and choices with respect to their personal information. However, the exact scope of these rights varies by state. To exercise any of these rights or if you have any questions, please contact us. 

Numerous states have implemented laws that allow consumers to opt-out of certain sales or uses of their personal information. As mentioned above, we do not sell personal information for monetary consideration.

Restrictions:

Where this Privacy Policy describes any jurisdiction-specific rights, including rights under the GDPR or CCPA/CPRA, the descriptions are provided only to meet the requirements of the Applicable Data Privacy Laws. They apply only to individuals who reside in a covered jurisdiction and are entitled to those rights under its laws. This Privacy Policy does not create, expand, or extend any right, remedy, or cause of action to any individual beyond what Applicable Data Privacy Laws require. 

5. GENERAL DATA PROTECTION REGULATION (“GDPR”):

In the context of the European Union’s GDPR, individual residents in the European Economic Area with data stored in the Brivo System or using Brivo applications are considered “Data Subjects.” Customers (and in some cases Brivo Resellers or Brivo API partners) are considered “Data Controllers.” Brivo is generally a “Data Processor,” but can also be a sub-Processor with respect to Customer Data. 

Brivo is a Data Controller with respect to certain personal information provided directly to Brivo or that is made available to Brivo through Customer’s or another User’s interaction with the Brivo Productors of Services, such as device information, etc.

In Brivo’s role as a Data Processor, Brivo is the responsible custodian of the Data Subject’s data, performing this role on behalf of the Data Controller. The Data Controller is completely responsible for determining what data is captured, stored, and processed within the Brivo System. Brivo does not share, sell, rent or trade personally identifiable information with third parties unless directed by a Data Controller.

Within Brivo’s service model, most Data Subjects will have limited direct interaction with the Brivo System applications that capture and store their data. This interaction by Data Subjects will primarily be via the Brivo Mobile Key application. Most Data Subjects will be employees, visitors, or contractors of the Data Controller. Data is captured based on their relationship with the Data Controller. The Data Controller is responsible for gaining necessary consent from the Data Subject regarding the data to be stored. In cases where a Data Subject requests Customer Data to be deleted from the Brivo System, Brivo will refer such request to the Data Controller for adjudication.

The GDPR includes provisions that grant Data Subjects portability rights in their personal data. Brivo will coordinate with Data Controllers and, as applicable Data Subjects, when requested to delete or port data. Brivo provides portability and is continually working to enhance its data export capabilities.

GDPR Right of Individual Access and Limited Use

Those residing within the European Economic Area may request access, correct or to limit the use of their personal information within the Brivo System by submitting a request to Brivo at privacy@brivo.com or by contacting us as set forth below.

6. INFORMATION SECURITY

Brivo maintains a comprehensive, written information security program that contains industry standard, administrative, technical, and physical safeguards designed to prevent unauthorized access to Customer Data.

Brivo has the distinction of being one of the first building security platforms to be SOC 2 audited and being the first physical security software-as-a-service (SaaS) company to utilize the SSAE 16/18 framework to provide security review. Brivo undertakes an independent third-party annual SOC 2 audit that reviews certain of its internal controls and processes. Brivo also is certified under ISO27001. 

Despite our efforts, however, Brivo cannot and does not guarantee the security of the information Brivo collects from you or that such information will not be accessed, disclosed, altered, or destroyed by breach or other failure of any of our physical, technical, or administrative safeguards. By using or accessing the Brivo Products and Services, you acknowledge that all personal information is being provided at your own risk.

7. CHILDREN’S PRIVACY

Persons under the age of sixteen (16), or any higher minimum age in the jurisdiction where that person resides, are not permitted to create accounts or use the Brivo Products and Services unless their parent has consented in accordance with applicable law. If we learn that we have collected the personal information of a child under the relevant minimum age without parental consent, we will take steps to delete the information as soon as practicable. Parents who believe that their child has submitted personal information to us and would like to have it deleted may contact us at the email or mailing address provided below. 

8. OTHER 

Law Enforcement Requests:

Brivo may be required to disclose an individual’s personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.

Data Location & Transfer of Information:

Brivo stores all Customer Data in the continental United States or Europe depending on the instance you use. To facilitate Customers’ global operations, Brivo transfers some information to the United States and provides access to that information to Customers around the world. If you use the Brivo Products and Services from outside of the United States, then you understand and consent to the transfer of information outside of those jurisdictions to the United States or other jurisdictions for the uses identified above in accordance with this Privacy Statement. You acknowledge and understand that each region outside of the United States may have its own privacy and data security laws, which may differ from the applicable laws and regulations of the United States.

Accountability for Onward Transfer of Personal Information:

Except as otherwise provided herein, Brivo may share personal information with third parties in connection with the operation of our business and consistent with the purpose for which the personal information was collected.

Data Retention:

Brivo retains Customer Data according to the time frames set forth in the Brivo Terms of Service or as otherwise specified in specific agreements between the Customer and Brivo. 

Third-Party Links:

Brivo Products and Services may contain links to third-party websites, services, or content that are not owned or controlled by Brivo. We are not responsible for the privacy practices, content, or security of any third-party websites or other materials.  

Data Incidents:

If Brivo becomes aware of any improper access, unauthorized use, or disclosure of Customer Data (a “Data Breach”), Brivo will analyze the facts of the Data Breach in the context of Applicable Data Privacy Laws, policies, and contractual obligations to determine the appropriate notification process. Brivo will conduct notifications in a timely manner after becoming aware of a Data Breach and take reasonable steps to minimize harm and mitigate further risks to Customer Data.

For data transfers to the U.S. from the European Union, the UK (and Gibraltar) or Switzerland, Brivo adheres to the Data Privacy Framework Principles. Our Data Privacy Framework Statement is available at: https://www.brivo.com/data-privacy-framework/.

Contacting Us:

If you have questions regarding this Privacy Statement or if you need to submit a request with respect to your personal information, you can do so by contacting us at the following:

• Email: privacy@brivo.com.
• Mail: Brivo Privacy Officer, Brivo Inc., 3001 Bee Caves Rd

  Austin, TX 78746 USA.
• Phone: + 1 301 664 5242

Governing Law:

The governing law and choice of forum provisions set forth in the applicable Brivo Terms of Service to which this Privacy Statement is incorporated by reference apply unless stated otherwise.  

9. CHANGES TO THIS PRIVACY STATEMENT

Brivo reserves the right to change this Privacy Statement from time to time but will alert you that material changes have been made by indicating on this Privacy Statement the date it was last updated. We encourage you to periodically review this Privacy Statement for updates, which you agree are binding upon you once posted if you continue to use the Brivo Products and Services thereafter.