braXpass Privacy Notice

braXpass is a system whereby authorized users can request, receive, and delete mobile credentials on their mobile device. The braXpass app can be installed on an authorized user’s device by downloading it from the Apple App store or the Google Play store, being available for both iOS and Android. 

braXos provides the app and is a controller of personal information. Personal information can also be delegated by the user to the building administration and other responsible parties in order to acquire access to otherwise secured destinations. 

This Privacy Notice explains how and why we might collect, store, use, and/or share (“process”) your information when you use the braXpass application (the “Services”): 

By using our Services, you consent to our Privacy Notice and our collection, use, and sharing of your information in accordance with the terms below.

Contents 

Collection of Information
Use of Information 
Disclosure of Information 
Retention 
Your Information and Rights 
California Notice 
Categories of Personal Information Collected 
Categories of Sources from Which We Collect Your Personal Information 
Purposes for Collecting Personal Information 
Sale and Sharing of Personal Information 
Sale or Share of Personal Information of Consumers under 16 Years of Age 
Disclosing Personal Information for Business Purposes 
Retention of Your Personal Information 
California Privacy Rights 
Request to Access My Personal Information 
Delete My Personal Information 
Stop Selling or Sharing My Personal Information 
Correct My Personal Information 
Limit the Use and Disclosure of SPI 
Verifying Your Identity to Complete Your Access, Correction and Deletion Requests 
Unable to Verify 
Submit a Request Using an Authorized Agent 
Number of Requests Received in 2023 
Shine the Light 
Notice of Financial Incentive 
Connecticut Privacy Rights 
Virginia Privacy Rights 
Utah Privacy Rights 
Summary 
Categories of Personal Information Collected 
Purposes for Collecting Personal Information 
Sharing of Personal Information 
Share of Personal Information of Consumers under 16 Years of Age 
Exercising Your Utah Privacy Rights 
Colorado Privacy Rights 
Summary 
Collection, Use and Sharing of Personal Data 
Processing Purposes 
Your Colorado Privacy Rights 
How to Submit a Request 
Identity Verification 

Collection of Information

Application registration involves users supplying: 

  • First and Last name 
  • Email address 

Using the application successfully requires the enablement of location services on the device, so that Bluetooth can discover your device’s location.

In addition, device information (make, model, and device ID) is supplied to braXos during usage of the app.

Use of Information 

Application user personal information may be used by braXos for: 

  • allowing building approvers and administrators to grant access to secured locations as well as additional privileges (e.g.: roles) 
  • secure braXos systems, prevent fraud and help us protect the security of user accounts 
  • when accessing secured destinations and where applicable by law
  • facilitating support by braXos 
  • communicating with you via push notifications
  • fulfilling our legal obligations 
  • conducting auditing and monitoring of transactions and engagement 
  • maintaining the quality and safety of services and devices and improving, upgrading, or enhancing them 
  • conducting research and development 

Disclosure of Information 

Disclosure of information is limited to: 

  • building administrators and approvers you have elected to interact with by requesting access to secured locations or elevated privileges 
  • mobile credential issuers in the context of problem determination in collaboration with braXos support law enforcement or regulatory authorities when presented with a legitimate legal request 

Whenever in the course of sharing information we transfer personal information to other countries, braXos will ensure that the information is transferred in accordance with this Privacy Statement and as permitted by the applicable laws on data protection. 

Retention 

braXos will retain personal information as long as needed in order to permit the functioning of the application, be in compliance in laws and regulations, and maintain a secure operating environment. When braXos no longer has an ongoing legitimate business need to process your personal information, we will either delete or anonymize such information. 

Your Information and Rights 

You can request access to your personal information, or correct or update out-of-date or inaccurate personal information we hold about you. You may also request that we delete personal information that we hold about you. 

Please email support@braxos.com with any questions about this policy. 


California Notice 

This California Consumer Privacy Act Notice (“California Notice”) describes how we handle your personal information, the reasons we do so, and the rights you have as a California resident regarding your information. This Notice supplements the braXos Privacy Notice. 

This California Notice uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations. 

Categories of Personal Information Collected 

We may collect or receive (and may have collected or received during the 12-month period prior to the Last Updated date of this California Notice) the categories of personal information listed below. Not all categories will be collected or received for every individual. 

  • Identifiers: Personal identifiers, such as name and email address.
  • Device Information and Online Activity: Device and online identifiers, mobile activity when the app is in the foreground or when the app, in the background, is near an access control reader supporting mobile credential technologies 
  • Geolocation: Location information, as reported by an access control reader to the app via Bluetooth. When not within range of a beacon, the app does not report or collection location information 

Categories of Sources from Which We Collect Your Personal Information

We may obtain and combine personal information from different sources: 

  • Provided directly by you 
  • Collected from the device associated with you 
  • Collected from a building or a building’s affiliated third party with whom you have a relationship 

Purposes for Collecting Personal Information 

We may use your personal information for the purposes described in the Use of Information section of the braXos braXpass Privacy Policy and as provided below: 

  • Providing customer service 
  • To conduct auditing and monitoring of transactions and engagement, including auditing compliance Helping to ensure security and integrity and prevent fraud 
  • Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them 
  • Debugging to identify and repair errors 
  • To conduct business analysis, such as analytics, projections, identifying areas for operational improvement To conduct research and development, including undertaking internal research for technological development and demonstration 
  • To fulfill our legal function or obligations 

Sale and Sharing of Personal Information 

braXos does not sell personal information. Except as noted in the braXos braXpass Privacy Policy’s Disclosure of Information, braXos does not share personal information. 

Sale or Share of Personal Information of Consumers under 16 Years of Age 

braXos does not knowingly collect personal information from children under the age of 16. By using the Services, you represent that you are at least 16 years old or that you are the parent or guardian of a minor and you grant consent to such minor’s use of the Services. If we learn that personal information from users less than 16 years old has been collected, we will deactivate any related accounts and will delete such information from our records. 

braXos does not sell or share personal information. Except as noted in the braXos braXpass Privacy Policy’s Disclosure of Information, braXos does not share personal information. 

Disclosing Personal Information for Business Purposes 

During the 12-month period prior to the Last Updated date of this California Notice, we may have disclosed your personal information with certain categories of third parties as described in the braXos braXpass Privacy Policy’s Disclosure of Information and disclosed below: 

  • Device and online identifiers 
  • Location information  
  • Personal identifiers 
  • Access control activity 

Retention of Your Personal Information 

We will keep the personal information we collect about you for as long as necessary to carry out the purposes set forth in this Privacy Notice or any other notice provided at the time of data collection, but no longer than as required or permitted under applicable law or internal braXos policy. We dispose of the information we collect in accordance with braXos’s retention policies and procedures. 

California Privacy Rights 

If you are a California resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. 

As stated in more detail below, you can request that we: 

  • Provide you with access to a copy of and certain details regarding the personal information we have about you. Delete your personal information. 
  • Correct your inaccurate personal information. 
  • Limit the use or disclosure of your sensitive personal information (SPI). 
  • To exercise any of these privacy rights, send an email to support@braxos.com. 

Request to Access My Personal Information 

You have the right to request access to the personal information we may have collected about you. 

Requests to access your personal information may be submitted up to two times in a rolling twelve-month period. In response, we will return to you the following categories of information, to the extent required by law: 

  • The categories of personal information we have collected about you. 
  • The categories of sources from which we collect your personal information. 
  • The business or commercial purpose for collecting, selling, or sharing your personal information. The categories of third parties to whom we disclose personal information. 
  • The specific pieces of personal information we have collected about you. 
  • A list of categories of personal information that we have disclosed for a business purpose, along with the categories of third parties we disclosed it to. 

Delete My Personal Information 

You have the right to ask that we delete your personal information. Once we receive a request, we will delete the personal information (to the extent required by law) we hold about you as of the date of your request from our records and direct our service providers to do the same. Choosing to delete your personal information may impact your ability to use the app. To delete your personal information, click “Delete Account” on the Settings panel of the app. 

Stop Selling or Sharing My Personal Information 

braXos does not sell your personal information. When you make a request for access at a building, or perform email address verification as requested by a building, you share personal information with that building (first name, last name, and email address). You have the right to opt-out of that engagement by sending an email to support@braxos.com. 

Correct My Personal Information 

You have the right to ask that we correct the personal information we may have collected about you if that information is inaccurate. We reserve the right to request identifying documentation from you in certain circumstances, as permitted by law. To correct your personal information, you may do so in the app, or send an email to support@braxos.com. 

Limit the Use and Disclosure of SPI 

You have the right to ask that we limit our use and disclosure of your SPI to certain purposes permitted by law. braXos does not collect SPI at this time. 

Verifying Your Identity to Complete Your Access, Correction and Deletion Requests 

If you request access to, or the correction or deletion of, your personal information we will verify your identity before disclosing the requested information. To do so, we may ask that you log into your account or provide us with your: 

  • First name 
  • Last name 
  • Email address 

When you make a request, you will be asked to answer a few questions about yourself to help us verify your identity. Third party identification services may help us with verification to prevent disclosure of your personal information resulting from fraudulent requests. You may be asked to log into the app. In the event more documentation is necessary to verify your identity, we will notify you directly. 

Unable to Verify 

If we are unable to verify your identity, we will notify you, and your request(s) may not be processed to prevent fraud. 

Submit a Request Using an Authorized Agent 

In order to process requests using an authorized agent, braXos will require documentation demonstrating your agent’s authority to submit requests on your behalf (e.g.: power of attorney or other documentation, including a letter, signed by you (the California resident) authorizing the agent to submit your requests). 

Number of Requests Received in 2023 

Shine the Light 

California residents have the right to request that we provide you with: 

  • A list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year 
  • The identity of those third parties 

To exercise this right, please send an email to support@braxos.com. 

Notice of Financial Incentive 

If we provide a financial incentive, we will provide you with the details, including how the incentive is related to your data before you participate so that you may make an informed decision about whether and how to participate. In the event you decide to take advantage of a financial incentive, you will always have the right to withdraw from participation and we will provide you with directions on how to do so. 

If you have questions or concerns or would like to exercise your CCPA rights, you should contact braXos by emailing us at support@braxos.com. 


Connecticut Privacy Rights 

Connecticut residents can exercise the following rights by either sending an email to support@braxos.com or by going to the Settings section within the braXpass app: 

  • Request to Access My Personal Information (support@braxos.com) 
  • Delete My Personal Information (Settings) 
  • Correct My Personal Information (Settings) 

braXos does not process personal information for the purposes of targeted advertising. Nor does braXos sell your personal information. 


Virginia Privacy Rights 

Virginia residents can exercise the following rights by either sending an email to support@braxos.com or by going to the Settings section within the braXpass app: 

  • Request to Access My Personal Information (support@braxos.com) 
  • Delete My Personal Information (Settings) 
  • Correct My Personal Information (Settings) 

braXos does not process personal information for the purposes of targeted advertising. Nor does braXos sell your personal information. 


Utah Privacy Rights 

Summary 

This Utah Consumer Privacy Act Notice (“Utah Notice”) describes how we handle your personal information, the reasons we do so, and the rights you have as a Utah resident regarding your information. This Notice supplements the braXos Privacy Notice. 

This Utah Notice uses certain terms that have the meaning given to them in the Utah Consumer Privacy Act of 2022. 

Categories of Personal Information Collected 

  • Identifiers: Personal identifiers, such as name and email address 
  • Device Information and Online Activity: Device and online identifiers, mobile and web network activity and related information (such as IP address and Device ID) 
  • Commercial Information: Not collected 
  • Communications: Communication details (such as the content of emails, text messages, or other communications) where braXos is a party to the exchange 
  • Demographic Information: Not collected 
  • Financial Information: Not collected 
  • Biometric Information: Not collected 
  • Geolocation: Location information, such as geolocation information by means of bluetooth beacon TOTP reporting Sensory Information: Not collected 
  • Background Information: Not collected 
  • Inferences: Individual preferences and characteristics 
  • Sensitive Personal Information: Not collected 

Purposes for Collecting Personal Information 

We may use your personal information for the purposes described in the How Do We Use Your Personal Information section of the braXos Privacy Notice and as provided below: 

  • As a means of sharing enough of your identity to building administrators, at your request, to gain access to secured destinations 
  • Performing services, including maintaining or servicing accounts, providing customer service, verifying customer information, providing analytics services, providing storage, or providing similar services 
  • To conduct auditing and monitoring of transactions and engagement, including auditing related to auditing compliance Helping to ensure security and integrity and prevent fraud 
  • Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them 
  • Debugging to identify and repair errors 
  • To conduct business analysis, such as analytics, projections, identifying areas for operational improvement To conduct research and development, including undertaking internal research for technological development and demonstration 
  • To fulfill our legal function or obligations 

We use sensitive personal information for each of the purposes described above and to make inferences about customers. 

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law. 

Sharing of Personal Information 

We only share personal information with third parties (building administrators and elevator vendors) when you collaborate with the building in order to gain access to otherwise secured destinations. 

Category of Personal Information Category of Third-Party Recipient
Identifiers – Building administrators 
– Mobile credential issuers
Device Information and Online Activity – Building administrators 
– Mobile credential issuers
Geolocation – Building administrators 
– Mobile credential issuers

Share of Personal Information of Consumers under 16 Years of Age 

braXos shares the same information as the aforementioned irrespective of the age of the user, a data point of personal information that braXos does not collect. 

Exercising Your Utah Privacy Rights 

If you are a Utah resident, you can make certain requests regarding your personal information, and we will fulfill each request to the extent required by law. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. 

Utah residents can exercise the following rights by sending an email to support@braxos.com with the following actionable content or by using the mobile app’s “Delete” function: 

  • Request to Access My Personal Information 
  • Delete My Personal Information 

You can also email support@braxos.com to contact our Support Team with any questions or comments about this notice or about how we handle your personal information. 


Colorado Privacy Rights 

Summary 

This Colorado Consumer Privacy Notice supplements the information in the braXos Privacy Notice and applies solely to Colorado consumers who interact with us in an individual. This Colorado Notice uses certain terms that have the meaning given to them in the Colorado Privacy Act (the “CPA”). 

Collection, Use and Sharing of Personal Data 

Category Processing PurposeUsed for Targeted Advertising?Sold or Shared
Identifiers– Fulfilling our legal functions or obligations 
– Helping to ensure security and integrity and prevent fraud 
– Performing services 
– To conduct auditing and monitoring of transactions and engagement 
– Undertaking activities to verify or maintain the quality or safety of our services or devices
NoOnly first name, last name, and email address are shared with building administrators and elevator vendors for the purposes of managing authorized access to secured locations
Device and Online Identifiers– Fulfilling our legal functions or obligations 
– Helping to ensure security and integrity and prevent fraud 
– Debugging to identify and repair errors 
– Performing services 
– To conduct auditing and monitoring of transactions and engagement 
– Undertaking activities to verify or maintain the quality or safety of our services or devices
No No
Internet and Other Network Activity Information– Fulfilling our legal functions or obligations 
– Helping to ensure security and integrity and prevent fraud 
– Debugging to identify and repair errors 
– Performing services 
– To conduct auditing and monitoring of transactions and engagement 
– Undertaking activities to verify or maintain the quality or safety of our services or devices
No No
Commercial– Fulfilling our legal functions or obligations 
– Helping to ensure security and integrity and prevent fraud  
– Debugging to identify and repair errors 
– Performing services 
– To conduct auditing and monitoring of transactions and 
engagement 
– Undertaking activities to verify or maintain the quality or safety of our services or devices 
NoNo
Demographic InformationDemographic information is not collected NoNo
Financial InformationFinancial information is not collectedNoNo
Biometric InformationBiometric information is not collected.NoNo. Biometric authorization is required to access certain administrative functions in the app, but the biometric information is not collected by the app, which relies on iOS or Android to authorize access.
Geolocation– Fulfilling our legal functions or obligations 
– Helping to ensure security and integrity and prevent fraud 
– Debugging to identify and repair errors 
– Performing services 
– To conduct auditing and monitoring of transactions and engagement 
– Undertaking activities to verify or maintain the quality or safety of our services or devices
NoActivity at the access control reader locations is shared with building administrators and mobile credential issuers, contingent upon local laws and regulations.
Sensory InformationSensory information is not collected NoNo
Background InformationBackground information is not collected NoNo
Inferences– Fulfilling our legal functions or obligations 
– Helping to ensure security and integrity and prevent fraud 
– Debugging to identify and repair errors 
– Performing services 
– To conduct auditing and monitoring of transactions and engagement 
– Undertaking activities to verify or maintain the quality or safety of our services or devices 
NoNo

Processing Purposes 

  • Performing services – including maintaining or servicing accounts, providing customer service, processing elevator calls, permitting the management of logical access via an access control system, providing a management portal for administrative and reporting functions by building administrators and elevator vendors 
  • To conduct auditing and monitoring of transactions and engagement, including auditing compliance Helping to ensure security and integrity and prevent fraud 
  • Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them 
  • Debugging to identify and repair errors 
  • Conducting business analysis, such as analytics, projections and identifying areas for operational improvement Conducting research and development, including undertaking internal research for technological development and demonstrationFulfilling our legal functions or obligations 

braXos does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the CPA. 

Your Colorado Privacy Rights 

If you are a Colorado consumer who interacts with us in an individual capacity (and not in a commercial or employment context), you may have the right to: (1) request access to, correction of or deletion of your personal data; and (2) opt-out of the processing of your personal data for purposes of targeted advertising or the sale of your personal data. In addition, you may have the right to obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another entity. 

How to Submit a Request 

To request access to, correction of or deletion of your personal data, please email support@braxos.com. 

Identity Verification 

If you request access to, or the correction or deletion of, your personal information we will verify your identity before disclosing the requested information. To do so, we may ask that you log into your account or provide us with your: 

  • First name 
  • Last name 
  • Email address 

Third-party identification services may help us with verification to prevent disclosure of your personal information resulting from fraudulent requests. You may be asked to log into your online account and complete a one-time passcode validation. In the event more documentation is necessary to verify your identity, we will notify you directly.