Yale Smart Products - Privacy Notice - English

• What personal data do we collect for Yale Home products/Services?
• Who and where will your personal data be transferred to?
• Invitees

What personal data do we collect for Yale Home products/Services?

Personal data we require for use of the Services

When you download the App and in order to use the Services, we require you to establish an account and collect and store the following:

• Name
• Email address – This is optional, but we recommend you provide your email address which allows a second way to verify your identity, helping to increase your account security
• Password
• Telephone number
• Product ID
• User verification identifiers.

Single sign-on services

We allow you to use providers of single sign-on services (such as Google, WeChat, or Apple) with whom you already have an account to create a Yale Home account. You can decide what personal data we can see and use when creating an account using a single sign-on service. For more information about how your personal data may be processed when you use such a single sign-on service, please refer to the single sign-on service provider’s privacy notice.

Personal data collected based on your use of the Services

About you and others
We collect personal data that you may provide about yourself, such as user-name, as well as personal data about other people who have access to your products, such as other family members, guests, service providers like gardeners, house cleaners and/or others (“Invitees”). This will include mobile telephone numbers, as well as other information you may provide in relation to a contact list, such as the name or email addresses of Invitees who you are allowing to access your products, as well as the unique pin codes or user codes you may create for them.

We may ask for access to your contact list and you may consent to providing access to such list which includes personal data.

When setting up your products we will gather details about the positioning and use of the products, for example you can name a device or a ‘security area’ within your property, such as kitchen or garage.

Location
If you enable the Auto-Unlock feature for a smart door lock and disarming prompts for an alarm system, the App will request your consent to track your location in order to determine when your device nears products that you have permission to access (e.g. when you are near home). Location information will only be stored on your device, and not by Yale. This information will tell your mobile device to start listening for your product more often. This improves the device’s performance and saves your mobile device’s battery life.

Fingerprints

Certain products contain a fingerprint scanner, allowing the use of a fingerprint as an approved credential to operate a product. For instance, a fingerprint can be used to open a smart door lock, in the same way as using a pin code. Products containing a fingerprint scanner do not store an image of a fingerprint when one is registered. Instead, the fingerprint is stored as a digital representation in the form of a binary code. This code cannot be reversed to create a copy of a fingerprint. The fingerprint data is encrypted and only stored in the device. Yale cannot view or access the fingerprint data and it is not backed up to a cloud.

You are in control of how your fingerprint is used. It is not necessary for a fingerprint to be registered for a product to function. Fingerprint functionality is provided for the convenience and preference of customers, so you can choose to enroll a fingerprint. We therefore rely on your explicit consent to process fingerprint data. If you change your mind and do not want to use a fingerprint as a credential, you can delete it from the device at any time.

Cameras
If you have a camera, it will capture image recordings of the areas in view of the camera, depending on where you position it around your property. It may also capture audio as part of the recording depending on the product used and the settings selected. As a result, the recordings may be of you and your family and friends, as well as other visitors to your property. The images captured can be limited by making use of the Privacy Zone feature, which allows you to black-out areas in the image when they are recorded or live-streamed.

You are always in control of who can see your recordings. In order for someone other than you to access and view your recordings, you must provide your permission. This could be done by providing access to an Invitee, or to Yale in the event of a security concern at your property when you subscribe to our 24/7 monitoring service so we can determine if it is a false alarm or whether the police should be notified or a security guard sent to your home. We take the security of our customer’s recordings very seriously and use a range of measures to keep recordings safe, such as encryption and using a two-step verification process when a new device is used to sign in to an account to view recordings.

Some cameras include detection features, allowing detection of people, pets, vehicles and parcels. You can then customize notifications based on what is detected. These detection features do not recognize individuals or specific vehicles, and as such Yale does not process personal data in order to provide these features.

In many countries there are data protection laws, such as the General Data Protection Regulation (GDPR), which may apply to your use of our camera and CCTV products. It is your responsibility to make sure your use of our products complies with relevant data protection laws. As an example, you should consider displaying a notice to inform visitors to your property that you are capturing visual and audio recordings, and make use of the ‘privacy zone’ feature to help you avoid capturing images of neighbouring properties or public places. You should also consider when and with whom you share recordings, and where they are shared. For example, posting a recording on social media may affect the privacy rights of individuals captured within the recording. If you are unsure whether your intended use of a camera or CCTV system complies with data protection laws in your country, you should refer to the data protection authority for your country. Details of data protection authorities can be found in the ‘Your rights’ section below.

Personal data we automatically collect

When you use the App, we will create a user ID. In addition, we also gather the following information for purposes of providing the Services when you download the App and/or access the Services:

• Usage data about how and when you interact with the Services
• Product status
• Logs of those who make use of your products (e.g. lock/unlock a door, or arm/disarm an alarm system) – this information is then presented to owners in the activity feed in the App
• Logs of when an alarm system is triggered – this information is then presented to owners in the activity feed in the App
• A record of when a product owner sends an invite to another person to use their product

We also collect the following information about the devices on which the App is downloaded and the products you use:

• Operating system of the device on which the App is downloaded (e.g. by you, Invitees)
• The version of the App on such devices
• Information about your products, including serial numbers, MAC address, software versions on such products and installation dates.

Personal Data we receive when you use third party products and services

If you access the Services through a third-party (e.g. by managing your device via a smart speaker), use a third-party application or service through the “Works With” feature, otherwise use a third-party service provider in connection with the Services and products, or request or authorize us to give access or data to a third-party service provider (e.g. a delivery service, property management or rental service), then that third party will send us data about you and your Invitees, such as User ID.

In-app news & offers

In the Explore section of the app we provide information and news about new products, offers and services. This information is provided to all app users at a country / language level, and is not targeted to individual app users based on the products they use in the app. If you would like to receive tailored offers based on the products and services you receive from Yale, you can provide consent to do so. If you choose to provide consent, we will use details of the products you hold and use to provide you with tailored in-app messages and notifications about Yale products and services which we think you’ll love. For example, if you use a smart door lock and an alarm system, we may send you an offer about a camera which we think will work with and complement your existing products to improve your overall home security. You can unsubscribe at any time by updating your preferences in the App Consents section of the app menu.

App usage tracking

Where you provide your consent, we will collect information about how customers use the app, so we can keep making it better:

• Usage and behavioural insights: To help us understand how you use and engage with the app, such as the features you use and how you navigate between pages.
• Device information: Basic technical details, such as the app version being used or your device type and operating system.
• Crash information: If the app experiences a bug, sharing this information helps us to fix problems more quickly.

This information may include personal data, but it will only be used to improve the app and our products.  The insights gathered from this tracking is reviewed on an aggregated level in order to help us improve the user experience, functionality and reliability of the app.

You can provide or withdraw your consent at any time in the App Consents page in the User Settings section of the app.

Who and where will your personal data be transferred to?

We will transfer personal data for the purposes set out in the section entitled “How and why we use your personal data”;

-   To other organisations of the ASSA ABLOY Group to the extent necessary to support the operation of the Yale Home products and Services.

-   To third parties which provide support services connected to the Yale Home products and Services and its functions, but only to the extent necessary to provide these services, for example, to Amazon Web Services who may store your personal data on our behalf, or to an SMS service provider to allow us to send you one-time verification codes during the registration process or when you subsequently sign in to the App.

-   With third parties that provide support services for some existing Yale Home products and Services, such as for customer support purposes.

-   To third party security partners, which support us to provide 24/7 monitoring of your property, if you have selected this option as part of a Yale Home Subscription.

-   To Digital Analytics providers who provide tools that help us improve your experience, as well as Market Research agencies which support us to understand how our products are used and viewed by customers. These service providers may only use your personal data in accordance with our instructions and this Privacy Notice.

-   To your Invitees when you invite them to access your products. For example, if you invite a guest to access your products, then we will share certain elements of your information with them, such as your name, in order for your guest to understand the invite and access the product.

-   To third parties that you choose, such as when you use the “Works With” feature of the Yale Home app, to connect your products with such third-party products or services, or use a method of connection initiated via a third party product, service or application.

-   To a buyer or a potential future buyer of our business.

-   As required by law

Invitees

As part of our Services, you may give Invitees permission levels to access your products - e.g. to view camera recordings/live streams, unlock and lock your door, arm/disarm your alarm system, and possibly even to pass this access along to others. Needless to say, you must take care when choosing the people that you invite and the level of access that you choose to give them. You are responsible for all uses of your account, so be careful to secure this information and only give access to people you trust. Additionally, certain portions of your personal data, as well as other information about your use of the Service and your products may be shared with Invitees, such as your name and the status of the product (e.g. locked/unlocked or armed/disarmed).

In connection with the guest invitation process, we may ask for access to your contact list. We will only store information for contacts that you add as guests. We will only access and store such information with your express consent.

If you are an Invitee, we collect your personal data when you use the Services and products, as set forth in this Privacy Notice. All such information (including your Service usage information) is subject to, and will be used and disclosed as set forth in, this Privacy Notice.

We collect and store the information set out in the table below when you register for and use the Services:

We may transfer your personal data for the purposes set out above:

• To other organisations in the ASSA ABLOY Group, whether or not going to market as ASSA ABLOY, that market, sell and support our solutions in your country.
• To third parties who provide services connected to the product or its functions, but only to the extent necessary to provide these services, for example, to Amazon Web Services who may store your personal data on our behalf.
• To Invitees or third parties that you have requested we send your personal data to, for example when using the “connected to” or “Works with” functions on some devices (see “How we treat data relating to the Yale Home products/Services”).
• When required by law, including to government agencies and institutions, where legally required.
• To a buyer or a potential future buyer of our business. We do not sell or rent your personal data to third parties.

Some recipients are located in countries outside the UK/EU/European Economic Area (EEA). As in some cases these countries have a lower level of protection than that within the UK/EU/EEA, when transferring personal data to countries outside the UK/EU/EEA we use standard contractual clauses approved by the UK government or European Commission as applicable to ensure a sufficient level of protection for your personal data. You can obtain a copy by getting in touch using the details in the ‘Contact us’ section below.

We take measures to protect all personal data transferred to a third party, or to other countries, in accordance with applicable data protection laws.

Privacy policies of other websites

When you request that your information is shared with a third party, such as if you use the “Works With” feature in the Yale Home app, you may be linked to third-party services and websites that you choose. Also, when using the apps, you may use features that link you to social media websites, such as Facebook or X, for example if you chose to share a camera or CCTV recording using the share functionality provided by your device operating system. We are not responsible for the privacy practices or content of any of these third parties or the linked sites. Linked sites may collect personal data from you that is not subject to our control. We encourage you to review the privacy policies on any linked website you visit.

We store personal data for as long as necessary to fulfil the purpose for which the data has been collected, and in accordance with our internal record retention schedule. This means that we delete your personal data when such data is no longer necessary to process a request, or to manage your account or our client relationship. Statistics which have been anonymised may be saved for longer.

For the Yale Home App, activity logs visible in the activity feed are stored for 30 days.

Where a CCTV/camera product is used, the below table sets out where and for how long the video recordings and thumbnail images are stored. Certain Apps may use a thumbnail image of a recording, to allow an easily navigated recording list to be presented in the App, so you can quickly identify a relevant recording from the thumbnail image.

In relation to the personal data that we hold about you, you have the right to:

-   Request a copy of your personal data from our records;

-   Ask that we correct or erase your personal data (though this may mean that we cannot process requests, or that your account expires);

-   Ask us to stop processing your personal data (for example as regards the use of the data to improve our product);

-   Ask us to restrict how we process your personal data (for example if you deem the data to be incorrect);

-   Request the personal data used to provide you with information you requested or manage your account or our relationship, in a machine-readable format, which you are entitled to transfer to another data controller; and

-   Withdraw your consent where you have consented to us processing your data at any time.

We may not accept a request to erase your personal data where we require it to comply with a legal obligation or in relation to a legal claim.

For information about how to requests to exercise your rights, see Contact Us below.

If you have a complaint regarding our processing of your personal data you are entitled to report this to the relevant data protection regulator for your country:

• If you are in the UK, you can refer your complaint to the Information Commissioner’s Office at Information Commissioner's Office (ICO)
• If you are in Switzerland, you can refer your complaint to the Federal Data Protection and Information Commissioner at Startseite (admin.ch)
• If you are in another country within the EU, please refer to the list of regulators for contact details which can be found at Our Members | European Data Protection Board (europa.eu).

We may update this privacy notice from time to time in response to changing legal, regulatory or operational requirements. If we make any material changes to this Privacy Notice, we will notify you by placing a prominent notice on our website or in the app.

If you have any questions about this Privacy Notice or our processing of your personal data, please contact us at privacy@yale.co.uk

Notice version 6.0 February 2025