Effective Date: May 14, 2026
Last Updated: October 13, 2026

1. Introduction

ASIP Technologies, Inc. (“ASIP,” “we,” “us,” or “our”) respects privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how ASIP collects, uses, discloses, stores, and protects personal information in connection with:

The ASIP website and other ASIP-controlled websites that link to this Privacy Policy;
The Advanced Safety Intelligence Platform and its related portals, dashboards, application programming interfaces, integrations, and support services;
The ASIP Go and ASIP Passport mobile applications and other ASIP mobile applications, including versions under development;
ASIP Reception visitor-management services, including sign-in kiosks, front-desk and administration tools, host notifications, and site safety features, and ASIP Screens digital-signage services;
Demonstrations, pilots, private-alpha and beta programs, waitlists, events, sales activities, customer support, and business communications; and
Other services that expressly link to this Privacy Policy.

Together, these are referred to as the “Services.”

This Privacy Policy should be read together with ASIP’s Cookie Policy, Artificial Intelligence Customer Notice, Terms of Service, and any customer agreement, data processing agreement, notice at collection, consent form, or feature-specific notice that applies to a particular use of the Services.

If a written agreement between ASIP and a customer contains different or additional privacy terms, that agreement will control for the covered customer relationship to the extent of any conflict.

2. ASIP’s Roles

ASIP may act in different legal roles depending on the context.

2.1 ASIP as a controller or business

ASIP generally determines why and how personal information is processed when it handles:

Website visitor information;
Waitlist, demonstration, investor, vendor, partner, and sales inquiries;
ASIP account administration, authentication, billing, and direct support information;
Security, fraud-prevention, service-integrity, and diagnostic information;
ASIP’s own business contacts, applicants, contractors, and personnel; and
Information used to comply with ASIP’s legal obligations and enforce its rights.

In these situations, ASIP may be described as the “controller,” “business,” or similar responsible organization under applicable privacy law.

2.2 ASIP as a processor or service provider

ASIP generally processes information on behalf of an organizational customer when that customer or its authorized users place employee, contractor, safety, operational, compliance, equipment, training, investigation, document, or other organizational information into a customer tenant.

In these situations:

The customer generally determines the purposes of the processing;
The customer is generally the controller, business, or responsible organization;
ASIP acts as the customer’s processor, service provider, or subprocessor;
The customer’s privacy notices, workplace notices, policies, instructions, and agreements also apply; and
Requests concerning Customer Content should ordinarily be directed first to the applicable customer.

“Customer Content” means information, data, records, documents, images, audio, video, submissions, and other materials provided to or processed through a customer’s ASIP tenant.

ASIP may separately act as a controller for limited account, security, service-usage, billing, and business-administration information even when it otherwise processes Customer Content for a customer.

3. Personal Information We Collect

The information ASIP collects depends on the Services used, the customer’s configuration, the user’s role and permissions, device settings, integrations, and applicable law.

3.1 Information you or an organization provides

ASIP may collect:

Identity and contact information, such as name, business email address, telephone number, mailing address, signature, preferred language, and communication preferences;
Professional and organizational information, such as employer, job title, department, role, work location, station, region, reporting line, employee or contractor identifier, qualifications, licenses, and professional credentials;
Account and authentication information, such as username, account identifier, authentication records, single-sign-on identifiers, multi-factor authentication status, role assignments, permissions, and account recovery information;
Inquiry and relationship information, such as waitlist submissions, demonstration requests, investor inquiries, event registrations, sales communications, support tickets, survey responses, feedback, and correspondence;
Transaction and commercial information, such as customer organization, subscription or order information, invoice records, payment status, contract records, and purchasing history. ASIP may use payment processors and generally does not need to store complete payment-card numbers;
User-generated and customer-provided content, such as reports, observations, comments, answers, forms, photographs, images, audio, video, documents, manuals, procedures, safety data sheets, corrective actions, inspection records, and uploaded files;
Safety, quality, and compliance information, such as hazard reports, incident and injury records, investigation materials, audit and inspection findings, risk assessments, corrective actions, safety briefings, acknowledgements, equipment defects, operational events, and regulatory records;
Training and workforce-readiness information, such as training completion, qualifications, competency, recency, experience, assigned work, scheduling information, work hours, fatigue-related indicators, and attendance-related information where a customer lawfully provides and configures that information;
Fleet, equipment, and driving information, such as vehicle assignments, pre-use inspections, defects, driving events, telematics, hours-of-service information, commercial-driver records, license details, and medical-certificate status where an authorized feature is used;
Health and injury-related information, such as work-related injury or illness details, restrictions, treatment-related records, exposure information, workers’ compensation information, and other information that a customer is lawfully authorized to process through a designated feature;
Location and environmental information, such as approximate or precise location, worksite or station, GPS verification, geofencing events, time zone, weather conditions, lightning proximity, and location associated with a report, inspection, vehicle, device, or operational event;
Image, audio, and voice information, such as photographs, recorded statements, dictated reports, voice-to-text submissions, document images, equipment images, and other media submitted through an authorized feature;
Government-issued and regulated records, such as driver-license information, commercial-driver credentials, regulatory certificates, permit details, and other records submitted through a designated compliance feature;
Emergency and notification information, such as alert recipients, escalation paths, acknowledgements, emergency contacts, and response records, including, for ASIP Passport, safety-alert choices, delivery records, and “I’m safe” or “I need help” responses (see Section 21B); and
Any other information a person or customer chooses to submit through an authorized feature.

3.2 Information collected automatically

When a person visits the Site or uses the Services, ASIP may automatically collect:

IP address and approximate location derived from IP address;
Browser, device, operating-system, application-version, and language information;
Device and application identifiers;
Date, time, duration, referring page, and pages or screens viewed;
Log-in, authentication, session, and access records;
Feature usage, search, navigation, button interaction, and workflow activity;
Error reports, crash data, performance data, and diagnostic information;
Network, security, threat-detection, and fraud-prevention information;
Cookie, local-storage, SDK, pixel, and similar-technology data as described in the Cookie Policy; and
Audit logs and records of creation, access, modification, approval, export, acknowledgement, and deletion events.

3.3 Information from other sources

ASIP may receive information from:

The organization that created or manages a user’s account;
Customer administrators and other authorized users;
Single-sign-on, identity, workforce, training, scheduling, fleet, weather, aviation, mapping, regulatory, communications, and other integrated systems;
Devices, sensors, cameras, telematics systems, scanners, and mobile-device services connected by a customer;
Publicly available, licensed, regulatory, manufacturer, and industry sources;
Service providers, implementation partners, resellers, professional advisors, and business partners;
References or other people authorized to provide information; and
Corporate transactions, diligence processes, or legal proceedings.

Customers are responsible for ensuring that they have the authority and appropriate legal basis to provide information to ASIP and to connect third-party systems to the Services.

4. Sensitive Personal Information

Some Services may process information considered sensitive under applicable law, including:

Precise geolocation;
Government-issued identification information;
Account credentials;
Work-related health, injury, illness, exposure, or disability information;
Information revealing racial or ethnic origin, religious beliefs, trade-union membership, sexual orientation, immigration status, or similar protected characteristics if included in a customer-authorized record;
Biometric identifiers or biometric information, if a specifically authorized feature is designed and contractually approved to process them;
Voice, image, or video data that may contain personal information;
Information concerning allegations, investigations, discipline, or legal matters; and
Personal information relating to employees, contractors, drivers, applicants, or other members of a workforce.

ASIP does not use sensitive personal information to infer characteristics about a person for unrelated purposes. ASIP processes sensitive information only when reasonably necessary to provide an authorized Service, follow customer instructions, maintain security, comply with law, establish or defend legal claims, protect vital interests, or for another disclosed purpose supported by an appropriate legal basis.

ASIP Passport uses precise geolocation only as described in Section 21B.4.

Ordinary photographs and audio recordings are not necessarily biometric information. ASIP will not intentionally create facial-geometry templates, voiceprints, or other biometric identifiers for identification or authentication unless the feature has been specifically designed, reviewed, authorized, and disclosed for that purpose and all legally required notices, consents, retention rules, and customer instructions are in place.

Users must not place protected health information subject to the U.S. Health Insurance Portability and Accountability Act (“HIPAA”) into the Services unless ASIP and the applicable covered entity or business associate have executed a Business Associate Agreement and ASIP has expressly authorized the relevant Service environment for that use.

5. How We Use Personal Information

ASIP may use personal information to:

Provide, operate, maintain, configure, and support the Services;
Create, authenticate, secure, and administer accounts;
Apply customer-defined roles, permissions, workflows, escalation rules, and retention settings;
Process safety reports, inspections, audits, investigations, corrective actions, risk assessments, training records, equipment information, operational records, and other authorized workflows;
Provide alerts, notifications, dashboards, reports, searches, summaries, and customer-requested outputs;
Support authorized AI and machine-learning features as described in Section 8;
Process authorized images, documents, audio, voice, barcodes, and other media;
Enable mobile functions such as camera access, location verification, offline capture, push notifications, and device-based safety features when enabled;
Integrate with customer-selected and third-party systems;
Personalize the Services based on a user’s role, organization, settings, and permissions;
Respond to inquiries, demonstrations, support requests, and feedback;
Manage customer, vendor, investor, partner, and business relationships;
Process orders, invoices, subscriptions, and contractual obligations;
Conduct product research, testing, quality assurance, accessibility work, and service improvement;
Monitor performance, troubleshoot errors, prevent fraud, enforce access controls, and protect the security and integrity of the Services;
Create and maintain audit trails and records of legally or operationally significant actions;
Communicate about service changes, security, support, legal terms, and administrative matters;
Send marketing or product communications where permitted, subject to available choices;
Comply with law, regulation, court orders, lawful process, recordkeeping requirements, and contractual obligations;
Protect people, aircraft, vehicles, equipment, property, operations, the environment, ASIP, customers, and the public;
Establish, exercise, or defend legal claims; and
Complete a merger, financing, acquisition, reorganization, sale, or other corporate transaction.

ASIP will not materially expand the use of identifiable Customer Content for an unrelated purpose solely through a change to this public Privacy Policy where additional customer authorization, consent, notice, or contractual agreement is required.

6. Legal Bases for Processing

Where applicable law requires a legal basis, ASIP relies on one or more of the following:

Contract: processing necessary to enter into or perform a contract, provide requested Services, administer an account, or take requested pre-contract steps;
Legitimate interests: processing necessary for ASIP’s or another party’s legitimate interests, such as securing the Services, preventing misuse, supporting customers, improving functionality, administering business relationships, and establishing legal claims, provided those interests are not overridden by applicable individual rights;
Consent: processing based on freely given, specific, informed, and unambiguous consent where required, including certain optional cookies, mobile permissions, communications, or sensitive-data uses;
Legal obligation: processing required to comply with law, regulation, lawful process, tax, accounting, sanctions, security, or recordkeeping obligations;
Vital interests: processing reasonably necessary to protect a person’s life or physical safety where permitted by law; and
Public interest or substantial public interest: processing permitted for an applicable public-interest, employment, occupational-safety, legal-claims, or regulatory purpose.

When ASIP processes Customer Content as a processor, the customer is responsible for identifying and documenting the legal basis for its processing. ASIP processes that information according to the customer’s lawful instructions and applicable agreement.

7. How We Disclose Personal Information

ASIP may disclose personal information to the following categories of recipients when reasonably necessary for an authorized purpose:

The applicable customer and authorized users, including customer administrators, managers, safety professionals, operational leaders, investigators, auditors, and other persons granted access by the customer;
ASIP affiliates and personnel who require access for authorized business, technical, security, support, legal, or administrative purposes;
Service providers and subprocessors, such as hosting, data storage, infrastructure, authentication, communications, analytics, security, support, payment, professional-services, and enterprise-software providers;
Customer-directed integrations and third parties when a customer enables an integration, export, notification, or other disclosure;
Professional advisors, such as attorneys, accountants, auditors, insurers, banks, and consultants subject to appropriate duties;
Regulators, courts, law-enforcement authorities, and government bodies when disclosure is required or permitted by valid legal process or applicable law;
Emergency recipients when disclosure is permitted and reasonably necessary to address an imminent threat of death, serious physical harm, security, or a significant operational emergency;
Transaction counterparties and advisors involved in a financing, merger, acquisition, reorganization, sale, bankruptcy, or transfer of all or part of ASIP’s business or assets; and
Other recipients authorized by the individual, customer, or applicable law.

ASIP requires service providers that process personal information on its behalf to use the information only for authorized purposes and to apply appropriate safeguards.

For ASIP Reception and ASIP Passport, see Sections 21A and 21B. A Passport profile is disclosed only to the site you choose to check in to, for that visit.

ASIP does not disclose one customer’s Customer Content to another customer and does not use one customer’s information to state, infer, prompt, suggest, or present information about that customer to another customer.

8. Artificial Intelligence and Machine Learning

ASIP uses artificial intelligence, machine learning, natural-language processing, document parsing, computer vision, voice processing, and related technologies to support authorized safety, quality, compliance, operational-risk, and administrative functions.

ASIP’s public Artificial Intelligence Customer Notice provides additional information about these capabilities, human oversight, limitations, tenant isolation, and customer responsibilities.

Unless a customer expressly agrees otherwise in a signed written agreement:

Identifiable Customer Content is not used to train or fine-tune a shared or generalized model for the benefit of other customers;
Customer Content is not used to train a model for another customer;
Customer Content is not sold or licensed for AI-model training;
Third-party model providers are not authorized to use Customer Content to train their generalized models; and
Customer-specific learning, retrieval, indexing, configuration, and analytical improvement remain limited to the authorized customer environment.

Where appropriate, ASIP may use privacy-enhancing methods to detect, redact, mask, tokenize, de-identify, or otherwise reduce exposure of personal information before authorized analytical processing. De-identification controls reduce privacy risk but do not guarantee that every instance of personal information will be detected.

ASIP may use aggregated or de-identified information that does not reasonably identify an individual or customer to secure, test, evaluate, and improve the Services, subject to applicable law and customer agreements.

ASIP’s AI features are decision-support tools. Customers and authorized users are responsible for meaningful human review and must not use an AI-generated output as the sole or controlling basis for an employment, disciplinary, medical, legal, emergency, or similarly consequential decision.

9. Tenant Isolation and Access Control

Each customer operates within a logically separated tenant environment. ASIP applies access controls intended to prevent Customer Content from passing between customer tenants.

Access to Customer Content is limited according to customer configuration, role-based permissions, operational need, security requirements, and contractual obligations. Customer administrators control which authorized users may access their tenant and may assign or remove permissions.

ASIP personnel may access Customer Content only when reasonably necessary for authorized support, security, implementation, legal, or service-operation purposes and subject to applicable controls.

Customers are responsible for:

Assigning appropriate administrators and permissions;
Keeping user and employment status current;
Promptly removing access that is no longer authorized;
Reviewing audit logs and security notices made available to them;
Providing legally required workforce and monitoring notices;
Ensuring that users submit information only for authorized purposes; and
Reporting suspected unauthorized access without unreasonable delay.

10. Cookies, Analytics, and Similar Technologies

ASIP uses cookies and similar technologies for website functionality, security, consent management, preferences, performance, and analytics. Optional technologies are used only subject to applicable consent and opt-out requirements.

Additional information, including categories of technologies and available controls, is provided in the Cookie Policy.

ASIP does not currently sell personal information or share personal information for cross-context behavioral advertising. Where applicable law requires ASIP to recognize an opt-out preference signal, such as the Global Privacy Control, ASIP will treat a legally valid and supported signal as a request to opt out for the browser or device from which the signal is sent.

Browser “Do Not Track” signals are not governed by a uniform legal or technical standard. ASIP may not respond to a Do Not Track signal unless required by law. This does not affect ASIP’s treatment of legally recognized opt-out preference signals.

11. Communications and Marketing Choices

ASIP may send:

Transactional and service communications necessary to administer an account, respond to a request, provide support, maintain security, or communicate material changes;
Waitlist, demonstration, pilot, and customer-relationship communications requested by the recipient; and
Marketing communications where permitted by law.

Recipients may unsubscribe from marketing emails using the link in the message or by contacting ASIP. Opting out of marketing does not stop necessary transactional, security, legal, or customer-administration communications.

ASIP Passport verification codes and site safety alerts are transactional and safety communications, not marketing. They are described in Section 21B.7 and the SMS Terms in Section 21B.10. The marketing communications described above are never sent to ASIP Passport users through Passport or using Passport contact details, and ASIP does not make sales calls to them (see Section 21B.6).

ASIP does not sell waitlist email addresses. Information submitted to join a waitlist is used to administer the waitlist, respond to the request, prevent abuse, maintain records, and communicate about relevant ASIP availability unless the person separately chooses to receive broader marketing.

12. Data Retention

ASIP retains personal information for no longer than reasonably necessary for the purposes described in this Privacy Policy, subject to customer instructions and legal, regulatory, security, contractual, dispute-resolution, and recordkeeping requirements.

Retention depends on factors such as:

The nature and sensitivity of the information;
The customer’s configured retention period and written instructions;
The duration of the customer or user relationship;
Safety, audit, investigation, corrective-action, training, equipment, document-control, or regulatory requirements;
Applicable limitation periods and litigation holds;
The need to maintain security, fraud-prevention, and audit records;
Backup, disaster-recovery, and system-integrity cycles; and
Whether the information can be safely deleted, aggregated, or de-identified.

Customer Content is retained and deleted according to the applicable customer agreement, customer configuration, lawful customer instructions, and legal obligations. Deletion from active systems may be followed by deletion from backups according to controlled backup-rotation schedules, unless preservation is legally required.

ASIP may retain aggregated or de-identified information that no longer reasonably identifies an individual or customer.

Retention for ASIP Reception visit records and ASIP Passport accounts is described in Sections 21A and 21B.8.

13. Security

ASIP uses administrative, technical, physical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, use, alteration, disclosure, or destruction.

Safeguards may include, as appropriate:

Encryption in transit and at rest;
Role-based access controls and least-privilege principles;
Multi-factor authentication and single-sign-on capabilities;
Tenant isolation;
Logging, monitoring, alerting, and audit trails;
Secure development and change-management practices;
Vulnerability management, backups, and recovery controls;
Vendor and subprocessor review;
Workforce confidentiality, training, and access requirements;
Incident-response and breach-notification procedures; and
Data-minimization, redaction, and de-identification controls.

No security measure can guarantee absolute protection. Users must protect credentials, devices, and authentication factors and must promptly report suspected unauthorized access.

ASIP is developing its security and compliance program toward a SOC 2 Type II independent attestation and ISO/IEC 27001 certification. These efforts are in progress. ASIP does not represent that either has been completed until formally achieved.

14. Data Location and International Transfers

ASIP is designed to regionalize Customer Content based on the customer’s contracted data region, applicable law, and available service configuration.

ASIP’s intended regional model provides for Customer Content stored at rest in the contractually designated region, including:

The United States for United States customers;
Canada for Canadian customers;
The United Kingdom for United Kingdom customers; and
An applicable European region for customers in the European Union or European Economic Area.

The customer agreement or data-processing documentation will identify the applicable region and any relevant exceptions, subprocessors, support arrangements, disaster-recovery configuration, or lawful transfers.

When personal information is transferred across national borders, ASIP uses safeguards required by applicable law, which may include contractual restrictions, data-processing agreements, approved contractual clauses, transfer-risk assessments, access controls, encryption, and other legal or technical measures.

Information may be processed in a jurisdiction with privacy laws different from those in the person’s location. ASIP remains responsible for applying the protections required by applicable law and contract.

15. Government and Legal Requests

ASIP may disclose personal information to a court, regulator, law-enforcement agency, government body, or other public authority only when required or permitted by applicable law and valid legal process.

Government and legal requests are subject to review for validity, jurisdiction, scope, and legal basis. ASIP seeks to disclose only the information legally required.

Where legally permitted and contractually appropriate, ASIP will notify the affected customer before disclosure. ASIP may object to or challenge a request that it reasonably believes is unlawful, invalid, overbroad, or inconsistent with applicable protections.

ASIP may preserve information when legally required. Nothing in this section prevents ASIP from making a disclosure permitted by law in a genuine emergency involving an imminent threat of death or serious physical harm.

16. Your Privacy Rights

Depending on where a person lives and the law that applies, the person may have the right to:

Know whether ASIP processes personal information about them;
Obtain access to personal information;
Correct inaccurate personal information;
Delete personal information;
Receive a portable copy of certain personal information;
Restrict or object to certain processing;
Withdraw consent for future processing where processing is based on consent;
Opt out of sale, targeted advertising, certain profiling, or other processing where applicable;
Limit certain uses of sensitive personal information;
Request meaningful information about certain automated processing;
Request human review of a qualifying automated decision;
Appeal a decision ASIP makes regarding a privacy request;
Lodge a complaint with a privacy or data-protection authority; and
Receive equal service and not be unlawfully discriminated against for exercising privacy rights.

These rights are not absolute. ASIP may deny or limit a request where permitted by law, including when ASIP cannot verify the request, must retain information, needs the information to provide a requested Service, must protect another person’s rights, or processes the information solely on behalf of a customer.

16.1 Requests involving Customer Content

If personal information was submitted by an employer, customer, or other organization, the individual should ordinarily direct the request to that organization. ASIP will support the customer in responding as required by law and contract.

ASIP will not independently alter or delete Customer Content contrary to the lawful instructions of the responsible customer unless required by law.

16.2 Submitting a request

Privacy requests must be submitted in writing to [email protected] or by mail to the address in Section 24.

A request should identify:

The person making the request;
The right being exercised;
The person’s jurisdiction;
The relevant customer or employer, if applicable;
The relevant account, email address, or other information needed to locate records; and
Whether the request is submitted by an authorized agent.

ASIP may request information reasonably necessary to verify identity, authority, jurisdiction, and relationship to the information. ASIP will use verification information only for verification, security, fraud prevention, and legal compliance.

If ASIP denies a request in whole or in part, the response will explain the reason where required. To appeal, reply to the decision or email [email protected] with the subject line “Privacy Request Appeal” and explain the basis for the appeal.

ASIP will respond within the time required by applicable law.

17. United States State Privacy Disclosures

This section supplements the rest of this Privacy Policy for residents of U.S. states with applicable comprehensive privacy laws.

During the preceding 12 months, ASIP may have collected the categories of personal information described below, depending on actual use of the Services:

Category	Examples	Purposes	Categories of Recipients
Identifiers	Name, email, telephone number, IP address, account ID, employee ID	Accounts, communications, support, security, customer services	Customers, service providers, authorized integrations, legal recipients
Customer-record information	Contact details, signature, payment status, government-issued record details	Contract administration, compliance features, customer-requested workflows	Customers, service providers, professional advisors, legal recipients
Commercial information	Subscription, order, invoice, demonstration, and relationship history	Sales, billing, support, relationship administration	Service providers, advisors, transaction parties
Internet or electronic activity	Device, browser, usage, log, cookie, and diagnostic data	Security, functionality, analytics, troubleshooting, improvement	Service, security, hosting, and analytics providers
Geolocation	Approximate or precise worksite, device, report, inspection, or equipment location; ASIP Passport location while checked in at a site (used to detect leaving the site area, with no location history kept)	Verification, weather, alerts, operational workflows, security	Applicable customer, mapping/weather providers, authorized integrations
Audio, visual, or similar information	Photographs, video, dictated reports, recordings, document images	Reporting, evidence, document parsing, authorized analysis	Applicable customer, authorized processing providers and integrations
Professional or employment-related information	Employer, role, qualifications, training, schedule, reporting line, performance-related operational records	Account authorization, safety, readiness, compliance, customer workflows	Applicable customer, authorized integrations and service providers
Education or training information	Courses, competencies, certifications, acknowledgements	Qualification, compliance, readiness, reporting	Applicable customer and authorized integrations
Sensitive personal information	Credentials, precise location, health/injury data, government IDs, protected traits if included, biometric data if specifically authorized	Authorized safety and compliance workflows, security, legal obligations	Applicable customer and restricted authorized providers or legal recipients
Inferences	Risk indicators, suggested classifications, patterns, or recommendations based on authorized data	Decision support, risk intelligence, service improvement within the authorized environment	Applicable customer and its authorized users

For ASIP Passport, the recipients are the ASIP Reception site you choose to check in to and the service providers described in Section 21B.9.

ASIP obtains these categories from the sources described in Section 3 and uses them for the purposes described in Sections 5 and 8.

ASIP does not sell personal information. ASIP does not share personal information for cross-context behavioral advertising. ASIP does not knowingly sell or share the personal information of consumers under 16 years of age.

ASIP may disclose the categories above for business purposes to the categories of recipients identified in Section 7.

Where applicable, residents may exercise rights to know, access, correct, delete, or obtain a portable copy of personal information and may opt out of sale, targeted advertising, certain profiling, or certain uses of sensitive information. ASIP will honor legally valid requests and authorized-agent requests subject to verification and applicable exceptions.

18. European Economic Area, United Kingdom, and Switzerland

For personal data for which ASIP acts as controller, ASIP Technologies, Inc. is the responsible controller unless another notice states otherwise.

Individuals in the European Economic Area, United Kingdom, or Switzerland may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to a competent supervisory authority.

Where ASIP relies on legitimate interests, individuals may request information about the balancing of those interests. Where ASIP relies on consent, withdrawal does not affect processing lawfully completed before withdrawal.

ASIP does not make solely automated decisions that produce legal or similarly significant effects about individuals through the public website. Customers must not configure or use the Services to make such a decision without an appropriate legal basis, required notice, meaningful human involvement, and any legally required right to contest the decision.

When ASIP acts as a processor, the applicable customer remains responsible for responding to data-subject requests and providing required notices. ASIP will provide assistance required by its data-processing agreement and applicable law.

Individuals may complain to the supervisory authority in the country where they live, work, or believe a violation occurred. ASIP asks that concerns first be sent to [email protected] so ASIP can attempt to resolve them.

19. Canada

Where Canadian privacy law applies, ASIP handles personal information according to principles of accountability, identified purposes, meaningful consent where required, limited collection, limited use and disclosure, retention controls, accuracy, safeguards, openness, individual access, and complaint handling.

Canadian individuals may request access to or correction of personal information controlled by ASIP and may withdraw consent for future optional processing, subject to legal and contractual limits.

When ASIP processes personal information on behalf of a Canadian customer, the customer remains responsible for the purposes of processing and for responding to individuals. ASIP will support the customer as required by applicable law and agreement.

20. Children and Minors

The Services are built for organizations and their authorized workforce. They are not directed to children under 18, and ASIP does not knowingly collect personal information from anyone under 13 through any Service.

A customer that gives a minor access to the Services must have a lawful, documented purpose and all notices and permissions that applicable law and the customer agreement require. ASIP uses information about a minor user only to provide the Services to that customer. ASIP does not sell it or share it for advertising.

ASIP Passport is only for people 18 and older. See Section 21B.11.

If ASIP learns it has collected personal information from a child under 13, or from a minor without the required authorization, it will take reasonable steps to delete it.

21. Mobile Applications and Device Permissions

ASIP mobile applications, including ASIP Go and ASIP Passport, may request device permissions necessary for enabled features, such as:

Camera and photo-library access (for example, for photographs, profile photos, and scanning QR codes);
Microphone and voice-recording access;
Precise or approximate location;
Push notifications;
Bluetooth, NFC, or nearby-device access;
Motion, activity, or sensor access;
Local storage for offline workflows; and
Biometric device authentication controlled by the device operating system.

The app will request permissions through the device or application interface where required. A user may change permissions in device settings, but disabling a permission may prevent the related feature from functioning.

ASIP’s mobile disclosures and app-store privacy information will be updated to reflect the data practices of the released version of each application. App-store summaries are abbreviated and should be read together with this Privacy Policy and feature-specific notices.

Where a mobile application permits account creation, an authorized user may initiate or request deletion as required by applicable app-store rules and law. For enterprise-managed accounts, deletion may require action or approval by the customer administrator because the customer controls the account and related Customer Content.

21A. ASIP Reception

ASIP Reception is a visitor-management service that ASIP provides to organizations. Visitors and contractors sign in and out at a site, usually on a kiosk tablet run by that organization, read and acknowledge the site’s safety briefing and rules, and their host is told they have arrived. The site can also see who is on site during an emergency roll call.

Who is responsible. The organization that runs the site is ASIP’s customer and decides how its visit records are used and kept. ASIP processes visit records on that organization’s behalf, as described in Section 2.2. Each site’s visitor privacy notice, site rules, and instructions are written and provided by that organization, not by ASIP.

What a site may collect through ASIP Reception. Depending on how the organization sets up its site, a visit record may include:

The visitor’s name, company or organization, and contact details;
The host, department, or purpose of the visit;
Answers to the site’s sign-in questions;
Acknowledgement of the site’s safety briefing and rules and, where the site asks for it, a signature;
Optional details such as vehicle information or an emergency contact, where the site asks for them;
A photo of the visitor, where the site asks for one, taken at the kiosk or shared from the visitor’s ASIP Passport profile (see Section 21B.6), which may be printed on the visitor label where the site prints labels; and
Arrival and departure times and how the visit ended.

How it is used. Visit records are used to sign visitors in and out, notify hosts, show the site who is on site (including during an emergency roll call), keep the site’s records, and secure the service. Being listed as checked out is a record of departure only; it is not a confirmation that a person is safe.

Retention. Visit records are kept and deleted according to the organization’s settings and instructions, its agreement with ASIP, and applicable law, as described in Section 12.

Questions and requests. Questions about a visit record, or requests to access or delete one, should be sent first to the organization you visited. ASIP will help that organization respond, as described in Section 16.1.

21B. ASIP Passport

ASIP Passport (“Passport”) is a free mobile app for visitors. You create one profile, and you can then use it to check in at sites that use ASIP Reception, for example by scanning the code shown on the site’s kiosk, instead of entering your details again at each site. This section explains how Passport handles personal information. It adds to the rest of this Privacy Policy and controls if the two conflict for Passport.

21B.1 Who is responsible for your information

ASIP is responsible for your Passport profile and for the messages Passport sends. ASIP acts as the controller or business for your Passport account.
The site you visit is responsible for its visit record. When you check in, the details you choose to share become part of that site’s visit record in ASIP Reception, described in Section 21A.
Each site provides its own visitor notice. Each site’s visitor privacy notice, site rules, and instructions are written and provided by that site’s organization, not by ASIP. Passport shows you that site’s notice when you check in.

21B.2 What Passport collects

Information you provide:

Your name;
Your mobile phone number;
Your email address;
A photo of yourself;
Your company or organization; and
Optionally, details of your vehicle.

Passport also records your preferred language, your confirmation that you are 18 or older, and your choices about location, notifications, text messages, and automated calls. When you check in, you also provide the details the site asks for, such as your host or purpose of visit, your acknowledgement of the site’s instructions, and your signature where the site requires one. Those check-in details go to that site.

Information collected automatically:

Account, sign-in, and security records, including verification-code requests;
Device, operating-system, and app-version information;
A notification token for your device, if you allow notifications;
Location, only as described in Section 21B.4; and
Records of safety alerts sent to you during an emergency at a site where you are checked in, whether they were delivered, and your response.

21B.3 How your contact details are protected

In addition to the safeguards in Section 13, sensitive fields in your Passport profile, such as your phone number, email address, and vehicle details, are protected with an additional layer of encryption before they are stored. Verification codes are not stored in readable form and expire shortly after they are sent.

Your photo. Your profile photo is stored with ASIP so that it can be restored when you sign in again. Before it is stored, location, time, and device information embedded in the image file is removed; the picture itself is not changed. It is kept in private storage, encrypted at rest, and can be retrieved through Passport only by your own signed-in account.

21B.4 Location

What Passport asks for. Precise location, including background (“Always”) permission, so that Passport can work while the app is closed.
When it is used. Location is used only while you are checked in at a site, for automatic check-out and site safety. Passport does not use your location when you are not checked in.
No trail is kept. ASIP does not keep a location history or a trail of your movements. When you leave a site’s area, the site is told that you left, not where you went. Location use stops when your visit ends.
Asking for help. If you tell a site that you need help during an emergency at a site where you are checked in, your current location may be shared with that site’s emergency team so they can find you.
Your choice. Location is optional. You can decline it or change it in your device settings and still check in, but automatic check-out will not work and you should check out yourself.

21B.5 Automatic check-out

While you are checked in, Passport may check you out automatically when you leave the site’s area, or at midnight in the site’s local time, whichever comes first. Automatic check-out depends on your device, permissions, and connection, and may be delayed or missed, so please check out when you leave. If an emergency starts shortly after you were checked out automatically, the site may still list you on its roll call so its team can confirm that you are safe.

21B.6 How Passport information is shared

Only with the site you are visiting, for that visit. Passport shares your profile only with the ASIP Reception site you choose to check in to, and only for that visit. A site does not get ongoing access to your profile and does not see your visits to other sites. If a site asks visitors for a photo, your profile photo is shared with that site as part of your check-in; Passport tells you before you check in, and the site keeps it as part of its visit record (see Section 21A) and may print it on your visitor label.
Service providers. ASIP uses the service providers described in Section 21B.9, under contract and only to run Passport.
Legal and emergency disclosures. ASIP may disclose information as described in Section 15, or where needed to protect someone’s life or safety.
Never sold, never used for marketing. ASIP does not sell Passport information, does not share it for cross-context behavioral advertising, and does not use Passport information, including your Passport contact details (your phone number and email), for marketing, advertising, or sales calls, whether for ASIP or on behalf of anyone else. Your Passport contact details are used only for visitor access (sign-in, account verification, and account recovery) and for safety and emergency communications about a site where you are checked in, as described in Section 21B.7 and the SMS Terms in Section 21B.10.
Mobile opt-in data. Mobile phone numbers, text-message opt-in data, and consent are not shared with third parties or affiliates for their marketing or promotional purposes.

21B.7 Verification codes, safety alerts, texts, and automated calls

Verification codes. When you create your Passport account, ASIP texts a one-time code to your mobile number to confirm that it belongs to you. If you later change your phone number in the app, ASIP texts a code to the new number. A code is texted only after you check the box agreeing to receive verification codes by text and then request the code. ASIP also emails one-time codes to your email address when you sign up, and when you sign in with your email. Signing in to an existing account does not send a text.

Site safety and evacuation alerts. During setup, Passport asks for your consent to receive site safety alerts. If you agree, and a site where you are checked in starts an evacuation or other emergency alert, ASIP may contact you by:

App notification;
Text message to your mobile number; and
Automated voice call to your mobile number, using a prerecorded or computer-generated voice.

These alerts are sent only for safety, never for marketing, and only about a site where you are checked in (or were very recently checked in, as described in Section 21B.5).

Telling the site your status. During an active evacuation, you can reply to the evacuation text with SAFE if you are safe or HELP if you need help, or press 1 on the automated call to confirm that you are safe. You can also use the buttons in the app. Your response is recorded as your own status report on that site’s roll call for that evacuation, and the site’s emergency team can see it. A HELP reply always also returns information about the text program.

The sending numbers. Verification-code texts come from a US number registered for ASIP Passport verification codes. Safety texts and automated calls come from the toll-free number +1 (833) 274-0115. These numbers are used only to send messages and are not staffed. Calls to the toll-free number play a short recorded message. For questions, use the contacts in Section 24.

Call 911 first. A safety alert, text reply, or in-app response is not a call to emergency services. If you are in danger, call 911 or your local emergency number.

Your choices. You can reply STOP to any text to stop text messages, and you can turn off notifications in your device settings. If you turn alerts off, a site may not be able to reach you in an emergency. Message and data rates may apply.

21B.8 Retention and account deletion

Your profile. ASIP keeps your Passport profile for as long as your account is open and as needed to provide the service and meet legal obligations.
Your photo. ASIP keeps your profile photo until you replace it or delete your account. A replaced photo is deleted. When you delete your account, your photo is deleted first, and the account is not deleted until the photo has been.
Visits. Passport does not keep a location history. The record of each visit is held by the site you visited, under that site’s retention rules (see Section 21A).
Safety and security records. Records of safety alerts and responses, and security and audit records, are kept for as long as needed to provide the service, support the site’s emergency records, and meet legal obligations, and are then deleted or de-identified.
Deleting your account. You can ask to delete your Passport account through the app or by emailing [email protected]. Deletion removes your Passport profile, subject to the backup and legal-retention practices described in Section 12.
Visit records held by sites. Deleting your Passport account does not delete visit records already held by the sites you visited. Those belong to each site’s organization and follow its retention rules (see Section 21A).

21B.9 Service providers

ASIP uses a limited number of service providers under contract to run Passport, including cloud hosting and data-storage providers, communications providers that deliver text messages, voice calls, and email, and the notification services built into your device’s operating system. Your mobile carrier delivers texts and calls to your phone. These providers may use Passport information only to provide their services to ASIP.

21B.10 SMS Terms (ASIP Passport alerts)

Program name: ASIP Passport alerts, operated by ASIP Technologies, Inc.
Messages you may receive: one-time verification codes when you create your account or change your phone number, and site safety and evacuation alerts (including confirmations of your replies) from a site where you are checked in. No marketing messages are sent.
How you opt in: for verification codes, by entering your mobile number in the Passport app and checking the box next to this statement before you request a code: “I agree to receive one-time verification code texts from ASIP Passport (ASIP Technologies, Inc.) at this number when I sign up or change my number. Message frequency varies, about one text per code request. Msg & data rates may apply. Reply HELP for help, STOP to opt out. Consent is not a condition of purchase. See our Terms of Use and Privacy Policy.” The box is not checked in advance, and no code is sent until you check it. For safety alerts, by agreeing to safety alerts during setup.
Sending numbers: verification codes come from a US number registered for ASIP Passport verification codes. Safety alerts come from toll-free +1 (833) 274-0115. These numbers send messages only. Calls to the toll-free number play a short recorded message.
Message frequency varies. Codes are sent only when you request them, usually once when you create your account and once each time you change your phone number. Safety alerts are sent only during an emergency at a site where you are checked in.
Message and data rates may apply.
To stop: reply STOP at any time. You will receive one message confirming that you have opted out, and no further text messages will be sent to that number, including verification codes and safety alerts, unless you opt back in by replying START.
For help: reply HELP for program information, or email [email protected]. During an active evacuation, a HELP reply also tells the site you need help.
Evacuation replies: reply SAFE if you are safe or HELP if you need help.
Carriers are not liable for delayed or undelivered messages.
Privacy: this Privacy Policy, at https://asip.io/privacy/. Mobile opt-in data and consent are not shared with third parties for marketing.
Terms: the Terms of Service, including Section 13B.

21B.11 Age

You must be 18 or older to use Passport, and you confirm this during setup. ASIP does not knowingly collect Passport information from anyone under 18. Visitors under 18 should be signed in by the site’s front desk or staff instead. If ASIP learns that a Passport account belongs to someone under 18, it will delete the account.

21B.12 Your rights and choices

You can see and correct your profile in the app. You may also ask ASIP to tell you what Passport information it holds about you, give you a copy, correct it, or delete it, and you may withdraw consent at any time, as described in Section 16. ASIP will verify your request before acting on it. Questions about a site’s visit record should go first to that site’s organization.

21C. ASIP Screens

ASIP Screens (“Screens”) is a digital-signage service that ASIP provides to organizations. It lets an organization show its own content on screens at its sites. This section explains how Screens handles information. It adds to the rest of this Privacy Policy.

What Screens collects.

Account and billing information, such as the names and email addresses of the organization’s users and its billing details. Payment card details are collected and processed by our payment processor. ASIP does not store full card numbers.
Uploaded media, such as the images, video, documents, and web addresses an organization adds to Screens.
Device and screen information, such as screen and device identifiers, device type, app version, the site a screen belongs to, and its status, for example whether it is reporting and what it is playing.
Playback records of what played on each screen and when.
Audit records of changes the organization’s administrators make, such as who changed a screen, a playlist, or branding, and when.

How it is used. ASIP uses this information to run Screens: to show content on the organization’s screens, show screen health and proof of play, support emergency messages where the organization uses ASIP Crisis, bill the subscription, secure the service, and provide support.

Who is responsible. Uploaded media and what the organization shows on its screens are Customer Content. The organization decides what to display, and ASIP processes it on the organization’s behalf, as described in Section 2.2. ASIP handles account and billing information as described in Section 2.1.

Service providers. Screens uses service providers for hosting, storage, email, and payment processing, as described in Section 7.

Retention and deletion.

Playback records are kept for 13 months and then deleted.
When a Screens account closes at the end of the 30-day protection period described in the Terms of Service, all stored media is permanently deleted and cannot be recovered. A Company Super Admin may choose to delete it at once instead.
Other information is kept as described in Section 12, for example billing records ASIP must keep for tax and accounting.

No sale. ASIP does not sell Screens information and does not share it for cross-context behavioral advertising.

22. External Services and Links

The Services may contain links to, display information from, or integrate with third-party websites, applications, data sources, maps, weather services, communications systems, identity providers, mobile platforms, or other services.

ASIP’s Privacy Policy does not govern a third party’s independent processing. Customers and users should review the third party’s terms and privacy information before enabling or using an external service.

When a customer directs ASIP to connect to or disclose information through an integration, the customer is responsible for evaluating the integration and ensuring the transfer is authorized.

23. Changes to This Privacy Policy

ASIP may update this Privacy Policy as the Services, laws, and business practices evolve.

ASIP will post the revised policy with an updated “Last Updated” date. When a change is material, ASIP will provide additional notice where required by law or contract, such as through the Site, the Services, an account notice, or email.

Changes do not retroactively authorize a materially different use of identifiable Customer Content where additional consent, notice, customer instruction, or contractual agreement is required.

24. Contact ASIP Technologies

Questions, written privacy requests, complaints, and appeals may be directed to:

ASIP Technologies, Inc.
8 The Green, #26257
Dover, DE 19901
United States

Email: [email protected]

Who to contact about privacy

Privacy questions, requests, complaints, and appeals: email [email protected] or write to the address above. This includes questions about ASIP Passport and requests to access, correct, or delete your information.
A site’s visit records: contact the organization you visited first; ASIP will help it respond.
The toll-free number +1 (833) 274-0115 is the number ASIP’s safety texts and automated calls come from. It is not staffed and does not take messages; calls to it play a short recorded message. Please use the email or postal address above instead.
In an emergency, call 911 or your local emergency number.