Privacy Policy
Introduction
PenCheck (“we”, “our”, “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you use the PenCheck mobile and watch applications, the accompanying web services and any related features (collectively, the “Service”).
Information We Collect
1. Account Data
• Name, e-mail address, employee ID, department, operation/hotel assignment, language preference, and user-supplied profile photo.
• Authentication identifiers from third-party providers (Apple ID, Google, Microsoft, etc.).
2. Device & Log Data
• Device model, OS version, app version, preferred font size, locale, and time-zone.
• IP address, device identifiers, crash reports, performance logs.
3. Room-Device Data
• For each hotel guest-room: lists of designed, discovered and mobile devices (MAC address, device name, battery level, power state, connection type, VLAN, IP address, last-connected timestamp).
• Room state (checked-in, DND, make-up, temperature, minibar status, valet-box pickup, etc.).
4. Notification Tokens
• APNs/Firebase Cloud Messaging tokens for push-notification delivery.
5. Usage Analytics
• Anonymous, aggregated events (screen opens, button taps, filter selections).
• No precise location, microphone, camera or contacts are ever collected.
How We Use Information
• Deliver and maintain the Service.
• Authenticate users and personalise content (e.g., remembered filters, font size).
• Display live health status of room devices, generate statistics and alerts.
• Send push notifications (maintenance reminders, device alerts, profile updates).
• Detect, prevent and investigate fraud, security incidents or misuse.
• Improve performance, debug crashes and plan new features.
• Comply with legal obligations and internal audit requirements.
Legal Bases (GDPR / PDPO)
• Performance of a contract (providing the Service to employees).
• Legitimate interests (security, analytics, maintenance).
• Consent (optional push notifications, marketing e-mails – none sent by default).
• Compliance with legal obligations (safety, financial audit, data-retention rules).
How We Share Information
• Hotel IT / Engineering departments: full room-device data and alert history.
• Watch companion app: simplified device status per room (no personal data).
• Service providers: Firebase (hosting, analytics, crash-reporting, messaging), Apple (iCloud, APNs), AWS (object storage and backups).
• Law enforcement or regulators when required by law.
• We never sell or rent personal data to third parties.
International Transfers
Data are stored in encrypted form on Firebase (Iowa, USA) and AWS (Hong Kong SAR). Standard Contractual Clauses and organisational safeguards ensure adequate protection for cross-border transfers.
Data Retention
• User-profile data: retained while the employee account remains active plus 12 months.
• Room-device telemetry: 24 months, then aggregated and anonymised.
• Crash logs and analytics: 90 days.
• Push tokens: deleted within 30 days of logout or uninstallation.
Your Rights
Depending on your jurisdiction, you may have rights to:
• Access, correct or delete personal data;
• Object to or restrict processing;
• Receive a portable copy of your data;
• Withdraw consent at any time (does not affect prior processing);
• Complain to a supervisory authority.
Requests can be sent to: privacy@pencheck.app.
Security
We use TLS for all data-in-transit, AES-256 encryption at rest, minimum-privilege IAM, network firewalls, MFA for administrator accounts and regular penetration testing. No method of transmission or storage is 100 % secure, but we take industry-standard precautions.
Children
PenCheck is an internal enterprise tool and is not directed to anyone under 16. We do not knowingly collect personal data from children.
Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top indicates the latest revision. Material changes will be notified via e-mail or in-app alert.
END OF POLICY