VACS Application Privacy Policy

The VACS Application (“Application”), developed by iCrypto Inc., provides ubiquitous cyber-physical access control solution for critical infrastructure through a security overlay with minimal changes to current workflow utilizing current data from personnel vetting, trouble ticketing, work assignment and physical electronic lock operation

iCrypto, Inc. (iCrypto) is a privately held software company that provides a full-stack implementation of omnichannel mission-critical access control technologies for large enterprises and service providers. Our solution provides a mobile-centric, automated, highly accurate and user-friendly identity vetting solution combined with standards based OAUTH2 and OpenID Connect (OIDC) verification systems that allow Single-SignOn for embedded and legacy applications. Mobile based authenticators (FIDO2, etc.) provide cryptographic signed operations to verify identity for any Enterprise transaction.

iCrypto understands that you entrust us with your personal information with the expectation that it will be used only for specific purposes. We respect your expectation and place a high priority on protecting this information by limiting its use. At iCrypto, protecting your privacy is fundamental to the way our company conducts its business and we leverage the latest state of the art technology in order to aim for maximum protection.

This Privacy Policy (“Policy”) applies to personal information processed through the VACS Application (“Application”), developed and provided by iCrypto, Inc. (“iCrypto,” “we,” “us,” or “our”). The Application is intended for authorized internal use by employees, contractors and other authorized users.

We collect and process information about you as described in this Privacy Policy (“Policy”). We are committed to protecting the privacy of those with whom we interact. This Policy contains details about how we collect, use, and share Personal Information that we obtain from and about you when you interact with us through your use of the VACS Application. Please read this Policy carefully.

Whenever you interact with us on behalf of another individual or entity, such as by providing or accessing Personal Information about another individual, you represent that your interactions and exchanges comply with applicable data protection laws. You shall have sole responsibility for any violation of privacy laws as a result of a failure to inform the other individual about how their Personal Information will be processed or to obtain any necessary consent from such individual.
We may update this Policy from time to time. The current Policy will be effective when posted. Please check this Policy periodically for updates. If any of the changes are unacceptable to you, you should cease interacting with us. When required under applicable law, we will notify you of any changes to this Policy by posting an update on our website. When required under applicable law, we will seek affirmative consent from you before making material changes to the way we handle Personal Information previously collected from you. If you do not provide such consent, Personal Information will continue to be used in a manner that is consistent with the version of this Policy under which it was collected.

Personal Information refers to any information relating to an identified or identifiable natural person or household.
We collect information about you and how you interact with us in several ways, including:

• Information you provide to us directly. We collect the information you provide to us directly, including to the applications acting on our behalf.
• Information you provide to us indirectly. We collect the information from sources, such as lock servers, you authorize us to provide information on your behalf.
• Information automatically collected or inferred from your interaction with us. We automatically collect technical information about your interactions with us (such as IP address, mobile device ID, or application diagnostic information).
• Information from public sources, including government entities from which public records are obtained
• Information from third parties. We receive information about you and your interactions with us from third parties, such as authorized employee or contractor directories, access-control systems and scheduling systems

 

We may combine information received from the authorized sources described in this Policy and use or disclose it only for the purposes of providing and securing authorized facilities and site access.

The types of information that we may collect about you are: 

• Identifiers, such as your unique personal identifier, online identifier, identifier for mobile notification services, internet protocol address, or other similar identifiers. These identifiers will be used by us to confirm your identity and to communicate with VACS Application.
• Identity verification and authentication information, where enabled. The Application may use the Device camera or Device-supported authentication features to verify an authorized user for registration or access-control purposes. Where a camera permission is required, it is requested in context for that feature. VACS does not store biometric templates or use biometric information for advertising, profiling, or unrelated purposes.
• Identification and account information, such as an employee, contractor or other authorized-user identifier and, where required, limited identity information used to confirm authentication and authorization. Information is processed only as necessary for identity, authentication, security and access-control purposes and is protected using appropriate technical and organizational safeguards.
• Internet or other electronic network activity information, information regarding your interactions with us (including interacting with us online, by the mobile application, and through advertisements). This information will be stored in a de-identified manner and will not be associated with your identity. We will use this data to improve application experience and usability.
• Mobile phone Geolocation can be collected from the device for reporting purposes but only with your explicit consent via the VACS Application. Your exact location will be utilized to ensure compliance with access control requirements at physical infrastructure sites. Your geolocation will also be utilized in reports, alarms, alerts and other workflow as associated with the operation of VACS.

 

We may use each category of your information described above in the following ways:

• To enable interactions between you and us, such as to process account creation and registrations; register and administer your account; provide you with services and support your interactions with us; diagnose, repair and track service and quality issues; provide requested product information; communicate with you about your account or our data practices; install and configure changes and updates to programs and technologies related to interactions with us; authenticate those who interact with us; or to respond to your requests, complaints, and inquiries.
• For internal operational and service purposes of iCrypto and the VACS Application, such as to evaluate or audit the usage and performance of programs and technologies related to interactions with us; evaluate and improve the quality of your interactions with us and programs and technologies related to interactions with us; design new services; process and catalogue your responses to surveys or questionnaires; perform internal research for technological development and demonstration; conduct data analysis and testing; maintain proper business records and other relevant records.
• For legal, safety, or security reasons, such as to comply with legal requirements; protect our safety, our property, or rights of those who interact with us, or others; and detect, prevent, and respond to security incidents or other malicious, deceptive, fraudulent, or illegal activity.
• In a de-identified, anonymized, or aggregated format. When converted to a de-identified, anonymized, or aggregated format, data no longer constitutes Personal Information in certain jurisdictions, and we may use this information for any purpose as legally permissible.
  Application data is not placed in a repository for broad community sharing. Information is used and disclosed only as necessary to provide, administer, secure, support and audit authorized site access, or as otherwise required by applicable law.
  
• For any other purposes for which you provide consent.

 

We may share your Personal Information with:

• Any member of our group, our ultimate holding company and its subsidiaries, who support our processing of Personal Information under this policy;
• Appropriate authorized service provider or subcontractor that support the secure operation of VACS, but only to the extent necessary to provide, administer, support or secure the Application and subject to appropriate contractual and security safeguards;
• Our auditors, legal advisors and other professional advisors or service providers;
• If we are under a duty to disclose or share your Personal Information in order to comply with any legal obligation, or in order to enforce or apply supply terms and other agreements with you or the organization you work for; or to protect the rights, property, or safety of our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud prevention, security and prevention of cybercrime.

 

We maintain appropriate technical and organizational security measures designed to protect personal information processed through VACS against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Personal information is limited to what is necessary for the Application's access-control, authentication, security, support and audit functions.

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide and secure the Application, maintain required access-control or security audit records, comply with legal or contractual obligations, and resolve disputes. When information is no longer required, it is securely deleted, anonymized, or otherwise disposed of in accordance with applicable requirements and our retention practices.

The Application is intended only for employees, contractors and other users who have been authorized to use VACS for facilities or site access. It is not intended for general consumer use.

If you believe that we have inadvertently collected Personal Information from a person who is not an employee or a contractor, please contact us at the address below and we will use reasonable efforts to delete the person’s information from our databases. In all cases where we may be provided with personal information relating to unauthorized personnel, with your authorization, the information in the relevant parts of this Policy applies to unauthorized personnel, as well as authorized personnel.

If you have questions regarding this Policy, please contact us at:

• Attention: VACS Application
• EMAIL: support@icrypto.com
• U.S. MAIL: 4701 Patrick Henry Drive, Bldg. 16, Suite 1M, Santa Clara, CA 95054 U.S.A.

VACS is not used to deliver third-party advertising or promotional marketing to Application users.

Purpose of Processing
The business and/or commercial purposes for which we process personal information are detailed in the Section 6 and are part of the following general purposes: (a) performing services, (b) auditing, (c) legal and compliance, (d) quality assurance, (e) security, (f) debugging, (g) short term, transient use, (h) internal research, and (i) corporate transactions.
If we intend to process your personal information for any additional purpose(s), we will provide you with information on the other purpose(s) and seek your prior consent.

Legal Basis
You have the following rights in relation to your Personal Information (subject to certain limitations at law):

• Access - The right to access Personal Information about you, as well as obtain further information relating to its processing.
• Rectification - The right to correct or update any Personal Information about you that is inaccurate or incomplete.
• Restriction of Processing - The right to require us to limit the purposes for which we process your Personal Information if the continued processing of the Personal Information in this way is not justified, such as where the accuracy of the Personal Information is contested by you.
• Restriction of Processing - The right to require us to limit the purposes for which we process your Personal Information if the continued processing of the Personal Information in this way is not justified, such as where the accuracy of the Personal Information is contested by you.
• Erasure - The right to request the erasure of Personal Information about you without undue delay if the continued processing of that Personal Information is not justified.
• Portability - The right to obtain a copy of Personal Information about you in an easily accessible format and the right to have that data transmitted to another responsible party.
• Objection to Processing - You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your Personal Information, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

The disclosures in this Policy are intended to be read together with any in-app permission disclosures and the Google Play Data safety information for VACS. The Application requests access only to Device permissions and data that are necessary for enabled facilities-access, authentication, security or support functionality.