Privacy Policy – Forus Patrol
1. Data controller and contact details
Forus Security AS
Registry code: 10622346
Address: Kadaka tee 63, 12915 Tallinn, Harjumaa, Estonia
Privacy contact: privacy@forus.ee
Forus Security AS determines the purposes and means of the personal data processing described in this Privacy Policy.
2. Who this Privacy Policy applies to
This Privacy Policy applies to authorised users of the Forus Patrol mobile application, including:
- patrol crew members and responders;
- employees involved in control-centre or operational activities; and
- other persons authorised by Forus Security AS to use Forus Patrol for work-related purposes.
Forus Patrol is intended for work-related use and is not a general consumer application. The application is not intended to monitor a user's private life.
3. Personal data processed by Forus Patrol
3.1 Account and authentication data
Depending on the user's role and configuration, Forus Patrol may process:
- user name, user identifier or other identifier needed to identify the authorised user;
- work contact information;
- user role and access level;
- patrol, crew or work-unit identifiers;
- authentication and access tokens; and
- login and session information.
3.2 Precise location data, including background location
Forus Patrol may collect, transmit and process precise location data, including GPS- or network-based location, latitude and longitude, timestamps and related location records.
Location data may be processed while the application is actively in use and in the background, including when the application is closed or not actively in use, when this is necessary for the user's active work shift or work task and the required Android location permission has been granted.
Background and foreground location data are used to enable core Forus Patrol functionality, including:
- operational coordination of patrol and response services;
- identifying or assigning the nearest or most appropriate patrol or responder;
- supporting movement to an incident or service location;
- documenting and evidencing completion of work tasks;
- service-quality and safety controls; and
- protecting the legitimate rights and interests of Forus Security AS in relation to service delivery and disputes.
Forus Security AS does not use Forus Patrol location data for advertising or for monitoring a user's private life.
3.3 Device, application and technical data
For operation, security, reliability, support and notifications, Forus Patrol may process:
- device type, manufacturer and model;
- operating-system version;
- Forus Patrol application version;
- technical identifiers required for application operation, authentication, security and troubleshooting;
- push-notification tokens;
- IP address and connection metadata;
- application errors, diagnostic data and reliability events; and
- server and security logs.
Forus Patrol does not use advertising identifiers for advertising, marketing profiling or behavioural advertising.
3.4 Work-task data and user-provided content
Forus Patrol may process work-related information entered or generated during operational activities, including:
- acceptance, start, progress and completion of work tasks;
- incident, signal, alarm, patrol and response information;
- notes and checklist responses;
- photos, files or other attachments added by the user; and
- other information necessary to document or complete an operational work process.
4. How personal data is collected
Personal data may be collected:
- from the user's actions in Forus Patrol;
- through device APIs, including location, camera, files/photos and notification functionality where required;
- from Forus Security AS systems, servers and real-time communication services; and
- through operational and control-centre work processes.
An Android operating-system permission is a technical permission that enables a device capability. It does not by itself determine the legal basis for processing personal data under the GDPR.
5. Purposes of processing
Forus Security AS processes personal data through Forus Patrol for purposes including:
- authentication, access control and user administration;
- sending, receiving, performing and documenting work tasks;
- operational management of patrol and response services;
- assigning an appropriate patrol or responder to an incident;
- supporting navigation or movement to an incident or service location;
- verifying and evidencing service delivery and task completion;
- documenting alarms, incidents, responses and related operational events;
- sending push notifications and real-time operational messages;
- maintaining application and information-system security, reliability and availability;
- preventing misuse and unauthorised access;
- handling disputes, legal claims and security incidents; and
- complying with applicable legal obligations.
6. Legal bases for processing
Depending on the specific processing activity, Forus Security AS may process personal data on the basis of:
- performance of a contract or work/service relationship where processing is necessary for the relevant relationship;
- the legitimate interests of Forus Security AS, including safe and effective service delivery, operational management, information security, service quality, prevention of misuse and the establishment, exercise or defence of legal claims;
- compliance with a legal obligation; and
- consent where a particular processing activity genuinely relies on consent.
Where processing is based on legitimate interests, Forus Security AS considers the necessity and proportionality of the processing and the rights and interests of affected users.
7. Sharing of personal data
Forus Security AS does not sell personal data. Personal data may be disclosed only where necessary for the purposes described in this Privacy Policy, including to:
- authorised Forus Security AS personnel, including control-centre, operational, management, IT, security and support personnel;
- Forus group companies or support functions where they provide relevant IT, administrative, legal or security services;
- service providers acting as processors, such as hosting, cloud, messaging, push-notification, authentication, communications and IT-support providers;
- clients, where disclosure of specific service or incident information is necessary to evidence or manage the relevant service;
- legal advisers, auditors, insurers or claims-handling parties where necessary; and
- courts, law-enforcement, supervisory or other competent authorities where required by law or necessary for legal claims.
8. International transfers
Forus Security AS prefers processing within the European Economic Area (EEA). Where a service provider processes personal data outside the EEA, Forus Security AS uses an applicable lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses, where required.
9. Data retention
Personal data is retained only for as long as necessary for the purposes described in this Privacy Policy or to meet applicable legal obligations. The standard retention periods for Forus Patrol are:
| Data category | Standard retention period |
|---|---|
| Precise location data | Up to 90 days |
| Authentication and device tokens | Up to 30 days after logout, token expiry or termination of access, as applicable |
| Operational work-task data, notes, signals, checklists and attachments | Up to 3 years |
| Technical security and server logs | Up to 180 days |
| Basic account data | For the duration of the user relationship and up to 3 years after it ends |
Relevant data may be retained for a longer period where necessary for a legal obligation, an active claim or dispute, a security incident, an official proceeding or another lawful retention requirement. In those cases, retention is limited to the data necessary for that purpose.
10. Data deletion and account closure requests
Forus Patrol uses work-related user accounts that are normally provisioned and administered by Forus Security AS. Users may request deletion of their personal data or closure of their Forus Patrol access by contacting privacy@forus.ee.
Please send the request from your registered work email address where possible and include:
- your full name;
- your user identifier, if known;
- your work contact information; and
- a description of the requested deletion or account action.
Forus Security AS may verify the requester's identity before completing the request. Requests are normally answered within one month, subject to any extension permitted by applicable law.
Some data may need to be retained where this is necessary to comply with a legal obligation, document completed work, handle a security incident, establish or defend a legal claim, or meet another lawful retention requirement. In such cases, deletion may be limited to the extent permitted by law.
11. Data security
Forus Security AS uses appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Measures include, as appropriate:
- user authentication and role-based access control;
- management of user access rights;
- protection of data in transit;
- logging and security monitoring;
- measures to prevent unauthorised access and misuse;
- data-minimisation and retention controls; and
- contractual safeguards with processors and service providers.
12. User rights
Subject to the conditions of applicable data-protection law, users may have the right to:
- receive information about the processing of their personal data;
- request access to their personal data;
- request correction of inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability where applicable; and
- withdraw consent where a specific processing activity is based on consent.
To exercise these rights, contact privacy@forus.ee.
Users also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent supervisory authority.
13. Children and public use
Forus Patrol is not intended for children or for general public/consumer use. It is a work application for authorised users.
14. Advertising and sale of personal data
Forus Patrol does not display advertising, does not use personal data for behavioural advertising, and does not sell users' personal data.
15. Changes to this Privacy Policy
Forus Security AS may update this Privacy Policy when the application's functionality, data-processing practices, legal requirements or relevant work processes change. The current version will be published at this URL with an updated “Last updated” date.
16. Contact
For privacy questions, rights requests or deletion requests relating to Forus Patrol:
privacy@forus.ee