Privacy Policy

Excelsior Protect is the Data Controller for personal data processed through this application.

For all data protection enquiries, please contact:
📧 privacy@excelsiorprotect.com

We collect only the minimum personal data necessary for the App to function ("data minimisation" principle — GDPR Art. 5(1)(c)):

• Account information: Name and email address (when you register or are invited)
• Usage data: Pages visited, features used, and session duration (anonymised analytics)
• Device data: Browser type, operating system, and screen size (for compatibility purposes)
• Location data: Used (with your explicit permission) to: (1) share your location with emergency services when you initiate an emergency call, (2) display local emergency numbers relevant to your region, and (3) receive location-based emergency alerts. Location data is processed on-device only and is never stored on our servers.
• Language preference: Stored locally on your device only (localStorage)
• Emergency contact data: Any emergency contacts you manage are stored encrypted in our database

We do not collect health records, biometric data, or any special category data as defined under GDPR Art. 9.

We process your personal data on the following lawful bases (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)): To provide you with access to the App and its features
• Legitimate interests (Art. 6(1)(f)): To improve the App, ensure security, and prevent fraud
• Consent (Art. 6(1)(a)): For location access and any optional analytics — you may withdraw consent at any time
• Legal obligation (Art. 6(1)(c)): Where required by applicable law

Your data is used exclusively to:

• Provide and maintain access to the App and its features
• Authenticate your identity and manage your account
• Display relevant emergency contact numbers based on your region
• Improve App performance and user experience
• Ensure the security and integrity of the platform
• Comply with legal and regulatory obligations

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We implement security measures aligned with ISO/IEC 27001:2022 to protect your data, including:

• Encryption in transit: All data is transmitted over HTTPS/TLS 1.2+
• Encryption at rest: Sensitive data is encrypted in our database
• Access controls: Role-based access control (RBAC) limits data access to authorised personnel only
• Audit logging: Access to personal data is logged and monitored
• Incident response: We maintain a documented security incident response procedure
• Regular reviews: Security controls are reviewed periodically through internal risk assessments
• Supplier management: Third-party processors are vetted and bound by data processing agreements

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, in accordance with GDPR Art. 33–34.

We retain personal data only for as long as necessary for the purposes for which it was collected (GDPR Art. 5(1)(e)):

• Account data: Retained for the duration of your account and deleted within 30 days of account closure
• Usage analytics: Anonymised after 12 months; raw logs deleted after 90 days
• Location data: Never stored on our servers — processed in real-time on your device only

As a data subject, you have the following rights (GDPR Arts. 15–22):

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to erasure / "right to be forgotten" (Art. 17): Request deletion of your personal data
• Right to restriction (Art. 18): Request that we limit processing of your data
• Right to data portability (Art. 20): Receive your data in a machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Rights related to automated decision-making (Art. 22): We do not use solely automated decision-making that produces legal effects

To exercise any of these rights, contact us at privacy@excelsiorprotect.com. We will respond within 30 days.

You also have the right to lodge a complaint with your national supervisory authority (e.g. CNPD in Portugal, ICO in the UK, CNIL in France).

The App uses localStorage (not cookies) to store your language preference and offline cache data on your device. This data:

• Is stored entirely on your device and never transmitted to our servers
• Can be cleared at any time by clearing your browser/app storage
• Does not contain any personal identifiers

If we introduce cookies in future, we will update this policy and seek appropriate consent.

Your data is processed and stored within the European Economic Area (EEA). Where we engage sub-processors outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with GDPR Chapter V.

This app may request the following device permissions. Each permission is used solely for the stated purpose and is never used to collect or transmit personal data beyond what is described below:

You can manage all app permissions at any time via iOS Settings → Privacy & Security or your Android device's Settings → Apps → Permissions.

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email or in-app notification at least 14 days before taking effect. Continued use of the App after changes constitutes acceptance of the updated policy.

The current version of this policy is always available within the App.

For any privacy-related questions, data subject requests, or security concerns: