Privacy Policy

Start here

This notice explains what Bitwards Oy does with information about people. It covers everyone: the person who opens a door with their phone, the administrator who grants them that right, the installer who fitted the lock, and the person who filled in a form on our website.

You do not need to know which of these you are. People often hold more than one role, and roles change. The panels below give you the whole picture. If you want the detail for your own situation, Part 2 has a section for each role.

The one thing worth understanding first

For most of the information in the Bitwards service, Bitwards is not the organisation that decides what happens to it. Your employer, your landlord, your school or whoever else gave you access made those decisions: they chose to use the service, and they decide who gets access to what, how long records are kept and what the information is used for. In data protection law they are the controller, and Bitwards is the processor — we act on their instructions, under a written agreement.

For a smaller set of information — people who visit our website, people we contact about our products, people who write to our support desk, and the named contacts at our customers and partners — Bitwards decides, and we are the controller.

Both situations are explained below, and both are covered by this one notice.

One further arrangement exists. Where an organisation bought the service through one of our partners, that partner acts for the organisation and Bitwards acts for the partner — a sub-processor, in the language of the law. It changes nothing about who decides: the organisation still does. It changes only whose instructions we take.

If you only read one thing

Part 1 — This applies to everyone

1.1 Who we are and how to reach us

Bitwards Oy, Business ID 2799772-8, Upseerinkatu 1–3, FI-02600 Espoo, Finland.

Privacy, data protection and security

support@bitwards.fi

General enquiries

info@bitwards.fi

We have assessed that we are not required to appoint a statutory Data Protection Officer under Article 37 of the GDPR, and have not appointed one. We keep that assessment under review. The contact above reaches the person responsible for data protection at Bitwards.

1.2 What this notice is, and what accepting it means

This is an information notice. It tells you what we do; it is not a contract and it does not ask you for permission.

When you register to use the service you may be asked to confirm that you have read this notice. That confirmation is an acknowledgement, not consent. It records that the information was put in front of you. It does not make your consent the basis on which your data is handled, and withdrawing it would not remove your access rights — those come from the organisation that granted them, not from us.

This matters in practice. If your access data were handled on the basis of your consent, you could withdraw it and your access would have to stop working, in the middle of a working day, at a door you need to get through. That is why access control is not normally run on consent, and why the service is not built to depend on it. The organisation that granted your access decides the basis it relies on, and it should be able to tell you which.

1.3 Your rights

Whatever your role, you have the following rights under the GDPR:

• Access — to be told whether your data is being processed, and to receive a copy of it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted, in the circumstances the law allows.
• Restriction — to have processing limited while a dispute about it is resolved.
• Objection — to object to processing carried out on the basis of legitimate interests, including profiling. Where we market to you, you may object at any time and we will stop.
• Portability — to receive data you provided in a machine-readable form, or have it sent to another organisation.
• Withdrawal of consent — where we do rely on your consent, which is limited to marketing sent to you as an individual and to any non-essential cookies, you may withdraw it at any time and as easily as you gave it. Withdrawing does not affect anything done before you withdrew.
• Complaint — to complain to a data protection supervisory authority, as set out in section 1.5.

Things that happen automatically

Some things in the service happen without a person deciding them each time. A resource opens or refuses to open according to the access rights your organisation has set. Where an account is configured for it, records older than the retention period are removed on a schedule, and users who have not used their access for a set time are deleted overnight.

These follow rules your organisation chose, and there is no profiling and no scoring of individuals. We do not consider them automated decisions producing legal or similarly significant effects within the meaning of Article 22 of the GDPR. If a resource refuses you and you want to know why, your organisation can see the rule that applied and the record of the attempt.

How to exercise them

Write to the privacy contact in section 1.1. We answer within one month. Where a request is complex or there are several, the law allows a further two months, and we will tell you within the first month if we need them. We do not charge for this. The old version of this policy said we might charge a small fee for a copy of your data; we have removed that, because the GDPR makes the first copy free.

If your request concerns data in an organisation’s account, that organisation has to answer it — and we are contractually required not to answer it for them, which is a protection for you as much as for them, since only they know the full context. We will refer you to them without delay, tell them you have asked, and help them respond.

Some of it you can do yourself

You can delete your own data from the Bitwards application. The application lets you remove all of your data from each account you belong to. Once it has been removed from every account, you are signed out and your user data is erased from the service.

This is worth understanding before you use it. Deleting your data removes the access rights that go with it, so you will no longer be able to open the resources that account gave you. If you need that access, speak to the organisation’s administrator first. The application also shows you your own access history, and an administrator of your account can correct your details or remove you.

1.4 Where the information comes from

Most of the information in the service was not given to us by you. An administrator at the organisation that granted your access entered your name and contact details in order to invite you — the invitation reaches you by email — and it is that organisation that decided to collect them. You provide the rest yourself when you register and when you use the application.

Where Bitwards is the controller, the information comes from you — from a form on our website, an email, a meeting or a support request — or from the customer or partner organisation that named you as its contact for a contract, for invoicing or for security notices.

1.5 Complaints

If you are unhappy with how your data has been handled, please tell us first — most matters are settled quickly that way. You do not have to, and you can complain directly to a supervisory authority.

In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki, tietosuoja.fi. If you live or work in another EU or EEA country, or the matter arose there, you may complain to that country’s authority instead.

Where the data sits in an organisation’s account, the complaint is properly made about that organisation, since it decides how the data is used. You may still raise it with us and we will help you direct it.

1.6 Children

The service is sold to organisations, not to individuals, and it is not directed at children. Some of our customers are schools and other institutions that grant access to young people. In those cases the institution is the controller, and it is responsible for the lawful basis on which it does so and for informing pupils and their parents.

No user of the service is under the age of 13. Bitwards does not knowingly collect data directly from a child, and where an institution grants access to a young person it does so as the controller. Under Finnish law, where consent is the basis for an information society service, that consent may be given by a child aged 13 or over; below that age it must come from a parent or guardian. If you believe a child’s data has reached us in a way it should not have, contact us and we will act on it.

1.7 Do you have to give us your information?

For access to a building or a resource, the organisation granting it needs your name and a way to reach you in order to invite you and issue your credential. Without them it cannot give you access. Whether you take up that access is a matter between you and that organisation, not between you and us.

Where Bitwards is the controller, the position is simpler. Filling in a form on our website is voluntary; the fields marked as required are the ones we need in order to reply. Writing to our support desk is voluntary, but we need enough detail to identify the problem, or we cannot solve it. For the people named as contacts under a contract, the details are required by the contract itself and, for invoicing, by Finnish accounting law.

Part 2 — Find your situation

Each entry below has a section of its own. If more than one describes you, read both — many people are an end user and an administrator at the same time.

• Open doors, lockers or cabinets with the Bitwards application, or with a card or code issued through it2.1Bitwards is the processor
• Administer an account: invite users, grant access rights, read event reports2.2Bitwards is the processor
• Own the account, or are the named contact for the contract, invoicing or security2.3Processor, and controller for the contact relationship
• Work for a partner, installer or reseller and hold a role in a customer’s account2.4Processor for the account; controller for your details as a named contact
• Gave us your details on our website, or are a contact we hold about our products2.5Bitwards is the controller
• Wrote to our support desk2.6Both — see the section

2.1 People who use the service to get through a door

This is most people. You were invited by an organisation, you registered, and you now open resources — doors, gates, lockers, cabinets, lifts, devices — with your phone, a card or a code.

What is held about you

Your identity and contact details

Name, email address, telephone number, your organisation, your role in the account, and anything the administrator typed into the additional information field

How you sign in

Your password, hashed in the database; second-factor details if enabled; and, where your organisation uses corporate sign-in, the identifier its identity provider issues for you

Your credentials

Mobile key and smart token identifiers, RFID card identifiers, and PIN codes

What you may open

Your access rights, the user and resource groups you belong to, validity periods, weekly schedules and exception days

Which resources you used, and when

Records of access granted and denied: which resource, where, the date and time, and which credential was used

Technical information

IP address, browser type and version, device type, operating system, application version and sign-in times

Why, and on what basis

Your organisation decides this. In practice the reason is the security of premises and property and the administration of who may enter them, and the basis is usually its legitimate interests, or the performance of its contract with you, or a legal obligation it is under. It — not Bitwards — must be able to explain which.

Who sees it

Administrators of the account, according to the roles they hold. Bitwards support staff, where your organisation asks us for help and only to the extent needed to give it. The suppliers listed in section 3.5, which run parts of the service for us.

Two further routes exist, and both are your organisation’s choice rather than ours. It can share a group of resources with another organisation’s account, so that the other organisation can let its own people in — where it does, the two organisations remain separate controllers, neither sees the other’s user records, and a record of the sharing is available to both. It can also connect a third-party system to its account through our interface, in which case that system acts for your organisation, not for us, and your organisation is answerable for it.

Beyond that: nobody, except where the law compels a disclosure, as section 3.5 explains. We do not sell personal data and we never have.

You can remove your own data from the service yourself, from within the application — section 1.3 explains how, and what it means for your access.

On your own phone

Your access rights are held in encrypted form in the Bitwards application on your phone, and are removed when you sign out or when the right expires or is withdrawn. Where a lock has no network connection of its own, event data travels between that lock and the cloud service by way of the phones of the people who use it, in protected form.

The application can show resources near you. To do that it asks for your device location, and the sorting happens on your phone. Your location is not stored and is not sent to Bitwards. You can refuse the permission and continue to use the application; the list simply will not be sorted by proximity.

2.2 Administrators

If you invite users, issue credentials, set access rights or read reports, you are an administrator. Everything in section 2.1 applies to you as well, because you are also a user of the service. Three things are additional.

Your actions are recorded. Changes to a user’s data or access rights are logged with your identity and the time, so that the organisation can see who granted what. Installation and device movement records are kept in the same way. This is a normal control in an access control system and it exists to protect the account.

You can see other people’s data. What you may see is defined by your role. Handle it accordingly: it is your organisation’s data, subject to your organisation’s rules, and the people it describes have rights in it that you may be the one who has to satisfy.

Two-factor authentication. The service offers two-factor authentication for administrator accounts. Whether it is switched on and required is a decision for your organisation’s account owner, not for Bitwards — we make the feature available but cannot enforce it on your organisation’s behalf. If you hold administrative access, we recommend you enable it, and that you tell your account owner if it is not being required.

2.3 Account owners and named contacts

The account owner holds the senior administrative role in an account, and sets — among other things — whether two-factor authentication is required.

Separately from the account, we hold the details of the people named as contacts for the contract, invoicing, security notifications and data protection at each customer and partner. For those contact details Bitwards is the controller, on the basis of our legitimate interest in managing the business relationship and, for invoicing records, our legal obligations under accounting law. We use them to send service and security notices, contractual correspondence and invoices. We do not use them for product marketing without a separate basis, and you may object at any time.

2.4 Partner, installer and reseller personnel

Where a partner delivers, installs or supports the service, its people may hold a role in a customer’s account. What that role permits is limited and defined:

• An installer role reaches the installation queue only, and gives no access to the personal data of the account’s users.
• A reseller administrator role permits a search of user data by the email address of a user already known to be invited, used only to resolve that user’s registration.

The customer decides which roles a partner holds, and they are recorded in the customer’s data processing agreement. Partner personnel are themselves users of the service, so section 2.1 applies to them, and their administrative actions are logged as in section 2.2.

Where the customer’s contract is with the partner rather than with Bitwards, the partner acts as the customer’s processor and Bitwards acts as a sub-processor engaged by the partner. The customer is still the controller and still decides; Bitwards takes its instructions through the partner. If you are unsure which arrangement applies to your account, your administrator or your partner contact will know.

Separately, where you are named as a contact for the partner’s own relationship with Bitwards — for the contract, invoicing or security notices — section 2.3 applies to you and Bitwards is the controller of those details.

2.5 Website visitors and the contacts we hold

Bitwards is the controller for everything in this section.

If you give us your details on our website — a contact form, a document download, a subscription — and consent to us keeping them, we hold what you gave us: typically your name, your organisation, your role and your business contact details, together with a record of what we discussed so that we can respond and keep track of the conversation. We hold the same kind of details for the named contacts at our customers and partners, as section 2.3 describes.

This information is kept in our customer relationship management system, which is operated by Zoho and hosted in the European Union. It is not sold, and it is not shared with anyone outside the suppliers listed in section 3.5.

Marketing, and how to stop it

Where we send you email about our products, we do so on the basis of your consent, or of our legitimate interest in keeping in touch with the named contacts at organisations we already work with. Every campaign carries a link to refuse further messages, and using it stops them. You may also write to us at any time and we will remove you.

Withdrawing consent, or objecting, does not affect anything we did before you told us. If you want your details deleted altogether rather than simply removed from a mailing list, email support@bitwards.fi and ask for that, and we will erase them.

Visiting the website

The Bitwards website uses cookies, including analytics cookies, and you control them through the cookie settings on the site. What each category does, and how to allow or refuse it, is set out in the site’s own cookie policy at bitwards.fi. Section 3.7 of this notice summarises the position for both the website and the service.

2.6 People who contact our support desk

When you write to support we hold your message, your contact details and whatever you tell us about the problem, in a ticketing system, so that we can resolve it and see the history if you come back.

Which role we are in depends on what you wrote. If you are an administrator or a named contact raising a service question, Bitwards is the controller of the ticket itself. If the ticket contains information about the users in an account — and it usually does, because that is what the problem is about — that information remains your organisation’s, and we handle it as its processor under the data processing agreement.

The practical consequence is worth knowing: please do not put more personal data into a support ticket than the problem needs. A user’s email address is usually enough to identify a record.

Part 3 — The detail

3.1 What we never do

We do not sell personal data. We do not use the personal data in a customer’s account for our own purposes, and we do not use it to develop or improve our products except in a form from which no individual can be identified and which cannot be traced back to the customer. We do not serve advertising in the service and we do not profile you for it. This is a contractual commitment to our customers, in clause 2.5 of our data processing agreement, not only a statement of intent.

The previous version of this policy said we used personal information “for providing and improving the Service”. That was too broad and it contradicted the agreement we sign with customers. It has been corrected.

3.2 Special categories of data

The service is not intended to hold special categories of personal data within the meaning of Article 9 of the GDPR — data about health, genetics or biometrics, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or a person’s sex life or sexual orientation. Customers are contractually required not to enter such data, including into free-text fields such as the additional information field on a user record. If a customer needs to process such data, it must tell us in advance so that the additional measures can be agreed.

3.3 Legal bases in summary

Where we rely on legitimate interests, we have weighed those interests against your rights, and you may object. We will stop unless we can show compelling grounds that override your objection, and for marketing we will stop in every case.

3.4 How long data is kept

Inside an organisation’s account, some periods are the organisation’s to set and some are fixed by how the service is built. The table says which is which.

Where Bitwards is the controller: contractual and invoicing records are kept for the period Finnish accounting law requires; support tickets while the matter is live and for a reasonable period afterwards, so that we can see the history if it recurs; and the contact details in our CRM until you ask us to delete them or withdraw your consent, which you can do at any time by writing to support@bitwards.fi.

3.5 Who else is involved

We use a small number of suppliers to run the service. Each acts on our instructions under a written contract with data protection obligations equivalent to our own.

We also disclose personal data where the law requires it — a court order, or a lawful request from an authority. We resist such a request where there are grounds to, and where the data belongs to a customer’s account we tell that customer unless we are forbidden to.

If Bitwards were ever part of a merger or a sale of the business, the data for which Bitwards is the controller — the contacts and support records in sections 2.3, 2.5 and 2.6 — could transfer to the acquirer, and we would tell you before it did. Data in a customer’s account is not ours to transfer; what happens to it is governed by that customer’s agreement.

3.6 Transfers outside Europe

The service stores your data in the European Union. The cloud service, its database and its backups run in Amazon Web Services data centres in the EU, and none of it is stored outside. Where any of the tools we use as a company sit elsewhere, they are named in section 3.5.

Bitwards’ own administrative and support access to the service takes place from within the European Union. So does our customer relationship management system, which is hosted in the EU.

Data leaves the EEA in one narrow respect: through remote access by the support and engineering staff of two of our suppliers to the systems they themselves operate. Google’s support functions in the United States can reach the notification email service; Atlassian’s in the United States and Australia can reach support tickets. This is occasional access in the course of resolving a problem, not a routine flow of data. Where you allow analytics cookies on our website, the analytics data is likewise accessible to Google in the United States.

Where that access happens, it is covered by the European Commission’s Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 of 4 June 2021, in the processor-to-processor module. For the United States part, the recipients are also certified under the EU–US Data Privacy Framework, which the Commission has found to provide an adequate level of protection. You may ask us for a copy of the clauses that apply, and for the transfer assessment that sits behind them, which we prepare on request.

The previous version of this policy said that your consent to the policy represented your agreement to a transfer. Consent is not a sound basis for a transfer that happens routinely, and it has been removed.

3.7 Cookies, browser storage and technical logs

The Bitwards website

The website at bitwards.fi uses cookies in three groups: those necessary for the site to work, which cannot be switched off; functional cookies, which remember choices such as your language; and analytics cookies, which tell us how the site is used. Analytics is provided through Google Tag Manager and Google Analytics.

You control the functional and analytics groups through the cookie settings on the site, and you can change your mind at any time. The site’s cookie policy describes each group and how to allow or refuse it.

The Bitwards service

When you are signed in to the service, information is kept in your browser so that the service can work. It is not advertising, and it is not shared: it stays in your browser and is used by the application itself.

What is stored is your authentication token; details of the signed-in user — email address, name, chosen language, address, telephone number, role, organisation and any additional information; and details of the account you are working in, including its name, billing information and its support and contact people. If your role lets you manage other accounts, the same is stored for the account you have selected. The service also remembers which page you are on, so that reloading does not send you back to the beginning; that is forgotten as soon as you navigate away.

Session storage is cleared whenever you close the browser or the browser tab. All of this is necessary for the service to function, so it does not depend on your consent — but you are entitled to know it is there, which is why it is set out here.

Technical logs

The service records technical information when you use it: IP address, browser type and version, the pages visited, times and durations, and for mobile use the device type, operating system and application version. This is used to run the service, to investigate faults and to detect misuse.

Which role we are in follows the same rule as everything else. Technical logs generated by a user signing in to an organisation’s account are part of that account’s data and we hold them as its processor. Logs from our own website, and anything set in your browser when you visit it, are ours and we are the controller.

3.8 How the service is protected

The measures are described in full in the technical and organisational measures document that forms part of our customer agreements, and a customer can ask us for it. In outline:

• Data is encrypted in transit between the lock, the phone and the cloud, and user data is stored encrypted in the database. Encryption keys are managed in the AWS Key Management Service.
• On your phone, access rights are held in an encrypted database, with the key kept in the device keychain on iOS and the keystore on Android.
• Bitwards staff use named accounts, have signed confidentiality undertakings, hold only the access their role requires, and their actions are logged. Administrative access to the servers is possible only from named addresses and with individual keys.
• The service is penetration tested by a third party, reviewed for security monthly, and monitored automatically for vulnerabilities and misconfiguration.
• The database is clustered across separate availability zones and backed up daily within the EU, and recovery is rehearsed.
• Two-factor authentication is available for administrator accounts. Whether it is required is set by the customer, as section 2.2 explains.

Bitwards does not currently hold ISO/IEC 27001 certification and is building the processes and controls needed for it.

No system is perfectly secure, and we do not claim otherwise.

If a breach affects personal data in a customer’s account, we tell that customer without undue delay and in any event within seventy-two hours of becoming aware of it, with what we know and what we are doing about it. It is then for that organisation, as the controller, to decide whether the people affected have to be told and to tell them — that decision is not ours to make, and we support it rather than pre-empt it. Where the breach affects data for which Bitwards is the controller, we notify the supervisory authority and, where the law requires it, the people affected, ourselves.

3.9 Links to other sites

Our website and our documents sometimes link elsewhere. We do not control those sites and this notice does not cover them.

3.10 Changes to this notice

We update this notice when the service or the law changes. The current version is always at tos.bitwards.io, with its version number and date at the top. Where a change materially affects you we do more than post it — we tell the account administrators, who can tell their users. Because customers rely on this document in their own compliance work, we keep the superseded versions and can say which was in force at a given time.