Privacy Statement

1. General

iotspot B.V. ("we" or "iotspot"), as a data processor of your personal data, ensures that such data is handled in full compliance with applicable data protection laws and regulations, including the EU General Data Protection Regulation (GDPR). This Privacy Policy explains how we collect, process, store, and protect your data when you use our Services.

2. Legal Basis for Processing

To access our Services, you (as a Customer and/or User, as defined in our Terms of Service) may be required to provide personal data, such as identification or contact details. This data is processed as necessary to perform our contractual obligations and deliver the Services to you, in accordance with this Privacy Policy.

3. Processing of Customer Data

When a Customer contracts iotspot, we collect and process the following data:

• Legal entity name and addresses (registered and service locations)
• Email domain names of authorized user groups
• Descriptive metadata about activated locations, such as pictures, floors, and zone denominations
• Descriptive metadata of category and type of workplace, meeting rooms, and parking spaces enabled in the Service
• Number of workplaces, rooms, and parking spaces activated per location
• Billing information of the legal entity

4. Processing of User Data

Upon registration as a User, we will process and store the following information:

• Mandatory: Name and corporate email address
• Optional: Phone number, job title, LinkedIn URL, department, team zone, profile photo, vehicles, Emergency Rescue Officer status, and hybrid work schedule
• Optional: Favorite workplaces (including their location), and favorite colleagues
• Optional: Guest name and email address (external people invited to use the Service)
• During the use of our Services, we will process and store:
• • Future workplace reservations (date, time), including desks, meeting rooms and parking spaces
  • Presence data during reservations (removed after a reservation has passed)
• Support Logs:
• • Last login (up to 6 weeks)
  • Login attempts including timestamp and IP address (up to 6 weeks)

5. Purpose of Data Processing

We collect and process information and usage statistics to support the delivery and improvement of our Services. This includes transactional data, such as reservations and bookings, which is recorded and stored during your use of the Service.

We process transactional and personal data only for the following purposes, based on the lawful grounds described:

a) To improve and research our Services (legitimate interests)

b) To promote usage within the scope of the Customer’s contract (legitimate interests)

c) To fulfill contractual obligations and deliver the Services (contractual necessity)

d) To manage the technical and functional operation of the Services (contractual necessity)

e) To comply with legal obligations, including:

• Providing data to authorized third parties such as rights holders, regulators, tax authorities, law enforcement, or judicial authorities
• Enforcing compliance with our Terms of Service

We ensure that data is processed only where necessary, in line with the principles of data minimization and purpose limitation.

6. Confidentiality

The data described in Sections 3, 4, and 5, provided by you and/or generated in association with you may be viewed by authorized iotspot employees, contractors, and sub-processors. All involved employees are required to maintain the confidentiality of the personal information they obtain as documented in a written agreement between our employees and iotspot. Contractors and sub-processors are engaged only where necessary for the provision of the Services and are subject to written agreements that impose confidentiality, security, and data processing obligations equivalent to those imposed on iotspot.

Subject to Section 5(e) above, your personal data will not be passed to third parties unless you have given us specific permission to do so, or if this is necessary for the implementation of the Services you want to use, or if it is required by law.

7. Your rights

As a User, you may access, review, and update your personal data at any time. You also have the right to restrict visibility to other users or to object to data processing if the information is incorrect, incomplete, or irrelevant. You can review and update your data via the app under Account Settings or by contacting us at dpo@iotspot.co. A full overview of your account data will be sent to your registered email address.

You may also request deletion of your personal data at any time. Upon receiving your request at dpo@iotspot.co, we will promptly process and confirm the deletion.

8. Information security

We take all reasonable measures to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, please note that no method of data transmission over the internet is entirely secure or free from errors. You are responsible for maintaining the security of your own internet connection.

All data generated, collected, and processed by iotspot is hosted on Amazon Web Services (AWS) infrastructure. The AWS services we use comply with the General Data Protection Regulation (GDPR). For more details, you can view our full Information Security Statement at: https://iotspot.zendesk.com/hc/en-nl/article_attachments/16106938045468

9. Caching of Information on a Mobile Device

Our Services are also accessible via a mobile application on your mobile device. To ensure optimal performance, iotspot may cache limited content locally on your device. This content is restricted to non-personal elements such as images related to your company account or uploaded within that account.

10. Social Media

Our Services may allow users to share workspace links through secure messaging platforms such as WhatsApp. These shared links only include a workspace URL and contain no personal information. Only users within the same company account can access the shared workspace.

We do not support social media logins (e.g., LinkedIn, Twitter, Facebook, Google), and any references to social media (such as profile links displayed in the app) are purely informational and do not involve data exchange or cookie-based tracking.

11. Cookies and Tracking

We do not use cookies in our Services or mobile applications. Our public website uses cookies and analytics tools, which you can accept or opt-out based on your preferences. We do not use social media tracking cookies.

12. Amendment of this Privacy Policy

We may update this Privacy Policy occasionally. Any changes will take effect once published, with the latest revision date shown. For significant updates, we may notify you directly or post a prominent notice. We recommend checking this policy regularly to stay informed about how we protect your data.

13. Contact

For questions or to exercise your privacy rights, please contact our Data Protection Officer at dpo@iotspot.co.