Steward Cloud Privacy Notice

Steward Cloud is a system whereby customers can manage credentials using a portal for access control systems managed under their subscription. Steward Cloud allows a library of cloud connectors to be utilized in the construction of “integrations” which can process your personal information, if your personal information resides in those systems. 

braXos provides the portal and API and is a controller of personal information, although Steward Cloud itself is stateless. 

This Privacy Notice explains how and why we might collect, store, use, and/or share (“process”) your information when you use the Steward Cloud application (the “Services”): 

By using our Services, you consent to our Privacy Notice and our collection, use, and sharing of your information in accordance with the terms below. 

Contents 

Collection of Information 
Portal Users 
Cardholders 
Use of Information 
Disclosure of Information 
Retention 
Your Information and Rights 
California Notice 
Categories of Personal Information Collected 
Categories of Sources from Which We Collect Your Personal Information 
Purposes for Collecting Personal Information 
Sale and Sharing of Personal Information 
Sale or Share of Personal Information of Consumers under 16 Years of Age 
Disclosing Personal Information for Business Purposes 
Retention of Your Personal Information 
California Privacy Rights 
Request to Access My Personal Information 
Delete My Personal Information 
Stop Selling or Sharing My Personal Information 
Correct My Personal Information 
Limit the Use and Disclosure of SPI 
Verifying Your Identity to Complete Your Access, Correction and Deletion Requests 
Unable to Verify 
Submit a Request Using an Authorized Agent 
Number of Requests Received in 2023 
Shine the Light 
Notice of Financial Incentive 
Connecticut Privacy Rights 
Virginia Privacy Rights 
Utah Privacy Rights 
Summary 
Categories of Personal Information Collected 
Purposes for Collecting Personal Information 
Sharing of Personal Information 
Share of Personal Information of Consumers under 16 Years of Age 
Exercising Your Utah Privacy Rights 
Colorado Privacy Rights 
Summary 
Collection, Use and Sharing of Personal Data 
Processing Purposes 
Your Colorado Privacy Rights 
How to Submit a Request 
Identity Verification 

Collection of Information 

Portal Users 

Steward Cloud portal access registration involves users supplying: 

• First and Last name 
• Email address 

Cardholders 

Steward Cloud manages the synchronization, additional, updating, and deletion of credential information on behalf of properties whose user information resides in access control systems. As a consequence, the following attributes are elements which flow through Steward Cloud with respect to Cardholders: 

• First and Last name 
• Email address 
• Credential information (card number, facility code, etc.) 
• Access group membership 
• Profile and credential activation and expiration dates 

Use of Information 

Application user personal information may be used by braXos for: 

• integrating with HID for the enrollment of mobile keys 
• securing braXos systems, prevent fraud and help us protect the security of user accounts 
• facilitating support by braXos 
• fulfilling our legal obligations 
• conducting auditing and monitoring of transactions and engagement 
• maintaining the quality and safety of services and devices and improving, upgrading, or enhancing them 
• conducting research and development 

Disclosure of Information 

Disclosure of information is limited to: 

• property administrators you have elected to engage with in order to access secured areas 
• security integrators in the context of problem determination in collaboration with braXos support 
• law enforcement or regulatory authorities when presented with a legitimate legal request 

Whenever in the course of sharing information we transfer personal information to other countries, braXos will ensure that the information is transferred in accordance with this Privacy Notice and as permitted by the applicable laws on data protection. 

Retention 

braXos will retain personal information as long as needed in order to permit the functioning of the application, be in compliance in laws and regulations, and maintain a secure operating environment. When braXos no longer has an ongoing legitimate business need to process your personal information, we will either delete or anonymize such information. 

Your Information and Rights 

You can request access to your personal information, or correct or update out-of-date or inaccurate personal information we hold about you. You may also request that we delete personal information that we hold about you. 

Please email support@braxos.com with any questions about this policy. 

California Notice 

This California Consumer Privacy Act Notice (“California Notice”) describes how we handle your personal information, the reasons we do so, and the rights you have as a California resident regarding your information. This Notice supplements the braXos Privacy Notice. 

This California Notice uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations. 

Categories of Personal Information Collected 

We may collect or receive (and may have collected or received during the 12-month period prior to the Last Updated date of this California Notice) the categories of personal information listed below. Not all categories will be collected or received for every individual. 

• Identifiers: Personal identifiers, such as name and email address. 
• Communications: Use of your email address when enrolling a credential using 3rd party systems (HID, Openpath). 

Categories of Sources from Which We Collect Your Personal Information

We may obtain and combine personal information from different sources: 

• Provided directly by you, in the case of Steward Cloud portal enrollment 

• Collected from the device associated with you, in the case of 3rd party credential enrollment 

• Collected from a building or a building’s affiliated third party with whom you have a relationship 

Purposes for Collecting Personal Information 

We may use your personal information for the purposes described in the Use of Information section of the braXos Steward Cloud Privacy Policy and as provided below: 

• Providing customer service 
• To conduct auditing and monitoring of transactions and engagement, including auditing compliance Helping to ensure security and integrity and prevent fraud 
• Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them 
• Debugging to identify and repair errors 
• To conduct business analysis, such as analytics, projections, identifying areas for operational improvement To conduct research and development, including undertaking internal research for technological development and demonstration 
• To fulfill our legal function or obligations 

Sale and Sharing of Personal Information 

braXos does not sell personal information. Except as noted in the braXos Steward Cloud Privacy Notice’s Disclosure of Information, braXos does not share personal information. 

Sale or Share of Personal Information of Consumers under 16 Years of Age 

braXos does not knowingly collect personal information from children under the age of 16 for the purposes of accessing the Steward Cloud portal. By using the Services, you represent that you are at least 16 years old or that you are the parent or guardian of a minor and you grant consent to such minor’s use of the Services. If we learn that personal information from users less than 16 years old has been collected for the purposes of accessing the Steward Cloud portal, we will deactivate any related accounts and will delete such information from our records. 

braXos does not sell or share personal information. Except as noted in the braXos Steward Cloud Privacy Notice’s Disclosure of Information, braXos does not share personal information. 

Disclosing Personal Information for Business Purposes 

During the 12-month period prior to the Last Updated date of this California Notice, we may have disclosed your personal information with certain categories of third parties as described in the braXos Steward Cloud Privacy Notice’s Disclosure of Information and disclosed below: 

• Device and online identifiers 
• Personal identifiers 
• Email address 
• Access control information 

Retention of Your Personal Information  

We will keep the personal information we collect about you for as long as necessary to carry out the purposes set forth in this Privacy Notice or any other notice provided at the time of data collection, but no longer than as required or permitted under applicable law or internal braXos policy. We dispose of the information we collect in accordance with braXos’s retention policies and procedures. 

California Privacy Rights 

If you are a California resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. 

As stated in more detail below, you can request that we: 

• Provide you with access to a copy of and certain details regarding the personal information we have about you. Delete your personal information. 
• Correct your inaccurate personal information. 
• Limit the use or disclosure of your sensitive personal information (SPI). 
• To exercise any of these privacy rights, send an email to support@braxos.com. 

Request to Access My Personal Information 

You have the right to request access to the personal information we may have collected about you. 

Requests to access your personal information may be submitted up to two times in a rolling twelve-month period. In response, we will return to you the following categories of information, to the extent required by law: 

• The categories of personal information we have collected about you. 
• The categories of sources from which we collect your personal information. 
• The business or commercial purpose for collecting, selling, or sharing your personal information. The categories of third parties to whom we disclose personal information. 
• The specific pieces of personal information we have collected about you. 
• A list of categories of personal information that we have disclosed for a business purpose, along with the categories of third parties we disclosed it to. 

Delete My Personal Information 

You have the right to ask that we delete your personal information. Once we receive a request, we will delete the personal information (to the extent required by law) we hold about you as of the date of your request from our records and direct our service providers to do the same. Choosing to delete your personal information may impact your ability to use the Steward Cloud portal. 

Stop Selling or Sharing My Personal Information 

braXos does not sell your personal information. When a participating building enrolls you into their access control system, the personal information during the enrollment is shared with braXos. Additionally, if you are a Steward Cloud portal user, the registration process entails the collection of certain personal information. You have the right to opt-out of that engagement by sending an email to support@braxos.com. 

Correct My Personal Information 

You have the right to ask that we correct the personal information we may have collected about you if that information is inaccurate. We reserve the right to request identifying documentation from you in certain circumstances, as permitted by law. To correct your personal information, you may do so in the app, or send an email to support@braxos.com. 

Limit the Use and Disclosure of SPI 

You have the right to ask that we limit our use and disclosure of your SPI to certain purposes permitted by law. braXos does not collect SPI at this time. 

Verifying Your Identity to Complete Your Access, Correction and Deletion Requests 

If you request access to, or the correction or deletion of, your personal information we will verify your identity before disclosing the requested information. To do so, we may ask that you log into your account or provide us with your: 

• First name 
• Last name 
• Email address 
• Phone number 

When you make a request, you will be asked to answer a few questions about yourself to help us verify your identity. Third party identification services may help us with verification to prevent disclosure of your personal information resulting from fraudulent requests. You may be asked to log into the app. In the event more documentation is necessary to verify your identity, we will notify you directly. 

Unable to Verify 

If we are unable to verify your identity, we will notify you, and your request(s) may not be processed to prevent fraud. 

Submit a Request Using an Authorized Agent 

In order to process requests using an authorized agent, braXos will require documentation demonstrating your agent’s authority to submit requests on your behalf (e.g.: power of attorney or other documentation, including a letter, signed by you (the California resident) authorizing the agent to submit your requests). 

Number of Requests Received in 2023 

0 

Shine the Light 

California residents have the right to request that we provide you with: 

• A list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year 
• The identity of those third parties 

To exercise this right, please send an email to support@braxos.com. 

Notice of Financial Incentive 

If we provide a financial incentive, we will provide you with the details, including how the incentive is related to your data before you participate so that you may make an informed decision about whether and how to participate. In the event you decide to take advantage of a financial incentive, you will always have the right to withdraw from participation and we will provide you with directions on how to do so. 

If you have questions or concerns or would like to exercise your CCPA rights, you should contact braXos by emailing us at support@braxos.com. 

---

Connecticut Privacy Rights 

Connecticut residents can exercise the following rights by sending an email to support@braxos.com: 

• Request to Access My Personal Information 
• Delete My Personal Information 
• Correct My Personal Information 

braXos does not process personal information for the purposes of targeted advertising. Nor does braXos sell your personal information. 

---

Virginia Privacy Rights 

Virginia residents can exercise the following rights by sending an email to support@braxos.com: 

• Request to Access My Personal Information 
• Delete My Personal Information 
• Correct My Personal Information 

braXos does not process personal information for the purposes of targeted advertising. Nor does braXos sell your personal information. 

---

Utah Privacy Rights 

Summary 

This Utah Consumer Privacy Act Notice (“Utah Notice”) describes how we handle your personal information, the reasons we do so, and the rights you have as a Utah resident regarding your information. This Notice supplements the braXos Privacy Notice. 

This Utah Notice uses certain terms that have the meaning given to them in the Utah Consumer Privacy Act of 2022. 

Categories of Personal Information Collected 

• Identifiers: Personal identifiers, such as name and email address 
• Device Information and Online Activity: Device and online identifiers, mobile and web network activity and related information (such as IP address and Device ID) 
• Commercial Information: Not collected 
• Communications: Communication details (such as the content of emails, text messages, or other communications) where braXos is a party to the exchange 
• Demographic Information: Not collected 
• Financial Information: Not collected 
• Biometric Information: Not collected 
• Geolocation: Location information, such as when you last presented a credential at a reader 
• Sensory Information: Such as when you last entered a region where sensors communicated the activity to an ACS Background Information: Not collected 
• Inferences: Individual preferences and characteristics 
• Sensitive Personal Information: Not collected 

Purposes for Collecting Personal Information 

We may use your personal information for the purposes described in the How Do We Use Your Personal Information section of the braXos Privacy Notice and as provided below: 

• For the purposes of replication and reporting as dictated by the building managers’ use of Steward Cloud Performing services, including maintaining or servicing accounts, providing customer service, verifying customer information, providing analytics services, providing storage, or providing similar services 
• To conduct auditing and monitoring of transactions and engagement, including auditing related to auditing compliance Helping to ensure security and integrity and prevent fraud 
• Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them 
• Debugging to identify and repair errors 
• To conduct business analysis, such as analytics, projections, identifying areas for operational improvement To conduct research and development, including undertaking internal research for technological development and demonstration 
• To fulfill our legal function or obligations 

We use sensitive personal information for each of the purposes described above and to make inferences about customers. 

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law. 

Sharing of Personal Information 

We only share personal information with third parties (property managers and their respective systems) when you collaborate with the building such that your personal information is stored in their access control system. 

Category of Personal Information	Category of Third-Party Recipient
Identifiers	Building administrators
Device Information and Online Activity	Building administrators
Geolocation	Building administrators

Share of Personal Information of Consumers under 16 Years of Age 

braXos shares the same information as the aforementioned irrespective of the age of the user, a data point of personal information that braXos does not collect. 

Exercising Your Utah Privacy Rights 

If you are a Utah resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. 

Utah residents can exercise the following rights by sending an email to support@braxos.com with the following actionable content: 

• Request to Access My Personal Information 
• Delete My Personal Information 

You can also email support@braxos.com to contact our Support Team with any questions or comments about this notice or about how we handle your personal information. 

---

Colorado Privacy Rights 

Summary 

This Colorado Consumer Privacy Notice supplements the information in the braXos Privacy Notice and applies solely to Colorado consumers who interact with us in an individual. This Colorado Notice uses certain terms that have the meaning given to them in the Colorado Privacy Act (the “CPA”). 

Collection, Use and Sharing of Personal Data 

Category	Processing Purpose	Used for Targeted Advertising?	Sold or Shared
Identifiers	– Fulfilling our legal functions or obligations  – Helping to ensure security and integrity and prevent fraud  – Performing services  – To conduct auditing and monitoring of transactions and engagement  – Undertaking activities to verify or maintain the quality or safety of our services or devices	No	Data owned by property managers’ ACS is shared, synchronized, and managed by those same property managers for the purposes of reporting and managing authorized access to secured locations
Device and Online Identifiers	– Fulfilling our legal functions or obligations  – Helping to ensure security and integrity and prevent fraud  – Debugging to identify and repair errors  – Performing services  – To conduct auditing and monitoring of transactions and engagement  – Undertaking activities to verify or maintain the quality or safety of our services or devices	No	No
Internet and Other Network Activity Information	– Fulfilling our legal functions or obligations  – Helping to ensure security and integrity and prevent fraud  – Debugging to identify and repair errors  – Performing services  – To conduct auditing and monitoring of transactions and engagement  – Undertaking activities to verify or maintain the quality or safety of our services or devices	No	No
Commercial Information	– Fulfilling our legal functions or obligations  – Helping to ensure security and integrity and prevent fraud  – Debugging to identify and repair errors  – Performing services  – To conduct auditing and monitoring of transactions and engagement  – Undertaking activities to verify or maintain the quality or safety of our services or devices	No	No
Demographic Information	Demographic information is not collected	No	No
Financial Information	Financial information is not collected	No	No
Biometric Information	Biometric information is not collected.	No	No. Biometric “credentials” may participate in an access control transaction if the mechanism is used by a property’s access control system.
Geolocation	– Fulfilling our legal functions or obligations  – Helping to ensure security and integrity and prevent fraud  – Debugging to identify and repair errors  – Performing services  – To conduct auditing and monitoring of transactions and engagement  – Undertaking activities to verify or maintain the quality or safety of our services or devices	No	Activity controlled by a property’s access control system may participate in a Steward Cloud synchronization or reporting transaction, managed by the property.
Sensory Information	Sensory information is not collected	No	Activity controlled by a property’s access control system may participate in a Steward Cloud synchronization or reporting transaction, managed by the property.
Background Information	Background information is not collected	No	No
Inferences	– Fulfilling our legal functions or obligations – Helping to ensure security and integrity and prevent fraud  – Debugging to identify and repair errors  – Performing services  – To conduct auditing and monitoring of transactions and engagement  – Undertaking activities to verify or maintain the quality or safety of our services or devices	No	No

Processing Purposes 

• Performing services – including maintaining or servicing accounts, providing customer service, synchronizing access control system data, permitting the management of logical access via an access control system, providing a management portal for administrative and reporting functions by building administrators 
• To conduct auditing and monitoring of transactions and engagement, including auditing compliance Helping to ensure security and integrity and prevent fraud 
• Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them 
• Debugging to identify and repair errors 
• Conducting business analysis, such as analytics, projections and identifying areas for operational improvement Conducting research and development, including undertaking internal research for technological development and demonstrationFulfilling our legal functions or obligations 

braXos does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the CPA. 

Your Colorado Privacy Rights 

If you are a Colorado consumer who interacts with us in an individual capacity (and not in a commercial or employment context), you may have the right to: (1) request access to, correction of or deletion of your personal data; and (2) opt-out of the processing of your personal data for purposes of targeted advertising or the sale of your personal data. In addition, you may have the right to obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another entity. 

How to Submit a Request 

To request access to, correction of or deletion of your personal data, please email support@braxos.com. 

Identity Verification 

If you request access to, or the correction or deletion of, your personal information we will verify your identity before disclosing the requested information. To do so, we may ask that you log into your account or provide us with your: 

• First name 
• Last name 
• Address 
• Email address 
• Phone number 

Third-party identification services may help us with verification to prevent disclosure of your personal information resulting from fraudulent requests. You may be asked to log into your online account and complete a one-time passcode validation. In the event more documentation is necessary to verify your identity, we will notify you directly.