VisitorPad Full Privacy Notice

ViPower Limited | Company number 12503008
59 Quex View Road, Birchington, Kent CT7 0DY
info@vipower.co.uk | www.vipower.co.uk

This notice explains how VisitorPad processes personal information for visits to buildings using the service. It must be read with the building's information identifying the responsible organisation or organisations, their contacts, applicable purposes and retention arrangements. Reception or your host can provide those details and a copy of this notice.

1. Who is responsible

The building operator and/or the organisation you are visiting determine the purposes of visitor processing and act as the relevant Data Controller. Their respective responsibilities depend on the building's arrangements. Ask reception or your host for the identity and contact details of the controller responsible for your information if these are not already displayed.

ViPower Limited supplies VisitorPad and processes visit information on the relevant Controller's instructions. ViPower's contact details appear at the start of this document. ViPower's own website, business enquiries and account administration are covered separately by its Website and Portal Privacy Policy.

2. Information processed

Depending on the enabled features and the building's requirements, records may include your name, organisation, contact details, host, purpose of visit, arrival and departure times, pre-registration details, visitor photograph, health and safety acknowledgements, document acknowledgements or signatures and access control events. Delivery features may record the recipient, courier, delivery details, relevant photographs and collection events.

The building or host organisation may define additional fields, such as vehicle registration, contractor identification, PPE acknowledgement or an NDA acknowledgement. It must explain why the information is needed and identify required and optional fields. Any consequences of declining required information must be explained before collection. Particular fields are not automatically required by law simply because they appear on a sign-in screen.

Information may come directly from you, from a host or authorised administrator who pre-registers you, or from enabled building systems. Staff and host accounts may include work contact details, roles, permissions, login and audit activity, and operational notifications. Devices and systems may also generate technical records needed to operate, support and secure the service.

3. Purposes and lawful bases

The relevant Controller uses information to manage visits, building access, security, evacuation and safety arrangements, host notifications, deliveries and operational records. It must identify the lawful basis for each applicable purpose in its building information.

Legitimate interests may support appropriate access, security and operational processing, subject to the relevant assessment. Legal obligation applies only where a specific applicable duty requires the processing. Where consent is used for a separate activity, the Controller must explain the choice and how it may be withdrawn. Custom fields containing sensitive information need an appropriate additional legal condition where required.

Visitor records are not used by ViPower for its own marketing. Acknowledging this notice or pressing Continue does not itself supply a lawful basis for every activity.

4. Access and recipients

Authorised building and host-organisation users may access records needed for the stated purposes. Access must follow their roles and permissions; unrelated tenants are not authorised to access another tenant's visitor records through ordinary tenant access.

ViPower and authorised providers may process information for hosting, infrastructure, notifications, security, logging and support. Enabled integrations may exchange relevant records with authorised building systems. The Controller can provide the applicable recipient categories and integration details. Information may also be disclosed where required by law.

5. Locations and safeguards

The applicable hosting, backup, support and provider arrangements determine where information is processed. The Controller or ViPower can provide the relevant location and transfer information. Where processing involves a restricted international transfer, the responsible parties must establish an appropriate lawful transfer mechanism and provide information about the safeguards and how to obtain a copy. UK hosting alone does not exclude overseas provider processing or support access.

ViPower must apply appropriate technical and organisational measures, including suitable authentication, access restrictions and protection of information in transit and storage, in accordance with the DPA and the nature of the processing.

6. Retention

The building's retention schedule determines how long each category is kept, within the supported service plan and agreed configuration. It must identify the applicable period or criteria; ask reception or your host for those details. Different periods may apply to visitor logs, photographs, deliveries, health and safety records and access or audit events.

For specific, documented security, regulatory or legal requirements, the Controller may agree with ViPower retention of specified visitor or access records for up to seven years. The Controller must justify the period and ViPower must confirm the supported configuration. This does not automatically extend photographs or every associated record to seven years. Access remains restricted to authorised users and continuing necessity must be reviewed.

7. When the service ends

The Controller may arrange return or deletion under the agreed offboarding process. Unless different documented instructions are agreed, a 30-day export window applies. Remaining live personal data is then deleted without undue delay in accordance with the Controller's instructions. Residual backup copies are put beyond ordinary use and expire under the documented backup cycle; the Controller can obtain its maximum period from ViPower. Any legally required retention is limited to the relevant information and purpose. Truly anonymous statistics may be retained where individuals cannot reasonably be identified.

Extended retention does not automatically extend a subscription or replace these offboarding arrangements.

8. Your rights and objections

Depending on the processing and applicable conditions, you may request access, correction, erasure or restriction, object to processing, and exercise portability rights where applicable. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

You have the right to object to processing based on legitimate interests. Contact the relevant building operator or host organisation. ViPower will assist the Controller and forward requests about processing carried out on its behalf. You do not waive your rights by continuing check-in.

9. Questions and complaints

Contact reception or your host for the relevant Controller's complaint route. You may also contact ViPower at info@vipower.co.uk for help identifying the appropriate contact or for questions about ViPower's handling of information. The responsible Controller must acknowledge a data protection complaint within 30 days, investigate appropriately and communicate the outcome without undue delay.

You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/ or on 0303 123 1113. This does not depend on accepting this notice.

10. Changes

This notice is dated and versioned. Material changes to the processing must be explained through an appropriate notice. Building-specific information forms part of the information provided to visitors and must be kept consistent with the service configuration.