ePro Locker Privacy Policy

Introduction

Shenzhen Epro Software Co., Ltd. (hereinafter referred to as "we", "our", "us", or "ePro") is committed to protecting your privacy. This Privacy Policy (the "Policy") explains how we collect, use, share and safeguard personal data when you use the ePro Locker mobile application and related services and products (collectively, the "Products").

In this Policy, "Personal Data" refers to information that can identify an individual either alone or when combined with other information; it does not include deidentified or anonymized data. "Smart Devices" refer to connected hardware with a human-machine interface that transmits data over wireless networks — in this Product primarily ePro branded smart door locks, doorbells, viewers and companion accessories. "App" refers to the ePro Locker mobile application developed by ePro that helps end users remotely manage and control those Smart Devices.

What Personal Data We Collect

To provide our services to you, we will ask you to provide the personal information necessary for such services. If you do not provide the required personal information, we may not be able to provide you with our Products or services.

Information You Voluntarily Provide to Us

• Account or user profile data: When you register for our account, we may collect certain information from you, such as your email address, phone number, and username. During your interaction with our Products, we may further collect information from your account, including your nickname, avatar, country code, language preference, or time zone information.
• Feedback: When you use the feedback and suggestion function in our Products, we will collect your email address, mobile phone number, and feedback content to promptly address your questions and device malfunctions.

Information We Automatically Collect

• Device information: When you interact with our Products, we automatically collect device information, such as the device's MAC address, IP address, wireless connection information, operating system type and version, application version number, push notification identifier, log files, and mobile network information.
• Usage data: During your interaction with our Products and services, we automatically collect usage data related to visits, clicks, downloads, sending/receiving messages, and other uses.
• Log information: When you use our App, app logs and exception stacks may be uploaded.
• Location information: We only collect information about your real-time precise or imprecise geolocation when you use features that require it (for example, obtaining Wi-Fi information during device pairing, or location-based automations).
• List of installed app package names: We only collect information about whether relevant apps are installed on your mobile phone when you use specific services of ours (e.g., services requiring integration with Alexa or Google Home) to provide you with convenient App Link / Universal Link services.

Smart Device-Related Information

• Basic smart device information: When you use a smart device connected to our services, we may collect certain basic information about the smart device, including device name, device ID, online status, activation time, firmware version, and update information.
• Smart device reported information: When you use our Products, we may collect information reported by your device, such as unlocking records and methods, battery status, alarm events, and images or video captured by a doorbell or viewer camera.
• Biometric data: When you use a smart door lock device that supports facial recognition, we will collect and store the facial feature information (including facial geometric feature point data) you actively input in an encrypted manner for biometric authentication. Raw facial image data is only processed locally on the device and will not be uploaded to cloud servers.
• Biometric verification: For the biometric data you actively provide (e.g., facial information), we only process it locally on the device to implement identity verification functions, and the processing complies with the principle of data minimization.
• Biometric management, retention and destruction: You can delete the facial data you have enrolled at any time through the App; the deletion will simultaneously clear all related biometric information stored on the device. Otherwise, biometric identifiers and biometric information are permanently destroyed when the initial purpose for collecting them has been satisfied, when you delete your account, or within three (3) years of your last interaction with us, whichever occurs first. We do not sell, lease, trade or otherwise profit from your biometric information.
• Fingerprints and passcodes: Fingerprint templates are stored and matched locally on the lock and are not uploaded to the cloud; unlocking passcodes are processed irreversibly and we do not store them in plain text.

Purposes and Legal Bases for Processing Personal Data

The purposes for which we process your information are as follows:

• Providing services to you: We process your account and user profile data, device information, usage data, location information, and smart device-related information to provide the Products and services you request or purchase. The legal basis is performance of our contract with you.
• Improving our services: We process your device information, usage data, location information, and smart device-related information to ensure the functionality and security of our Products, develop and improve our Products and services, analyze our operational efficiency, and prevent fraud or improper use. The legal basis is our legitimate interests or performance of our contract with you.
• Non-marketing communications: We process your Personal Data to send you important information related to services, changes to terms, conditions, and policies, and/or other administrative information. Due to the importance of such information, you may not be able to opt out of receiving such communications. The legal basis is performance of our contract with you.
• Marketing communications: We process your Personal Data to provide you with marketing and promotional information related to our Products and services. Each marketing email we send includes instructions allowing you to opt out. The legal basis is your consent.
• Personalization: We process your account and user profile data, usage data and device information to personalize your experience and to invite you to participate in surveys about product usage. The legal basis is your consent.
• Biometric processing: We process facial feature information only after your express consent, solely for authentication at the lock. You may withdraw consent and delete the data at any time.
• Compliance: We will process your Personal Data when we deem it necessary or appropriate to: (a) comply with applicable laws and regulations; (b) comply with legal procedures; (c) respond to requests from public and government authorities; (d) perform our terms and conditions; (e) protect our operations, business, and systems; (f) protect the rights, privacy, safety, or property of us and/or other users (including you); and (g) pursue available remedies or reduce losses we may suffer.

Who We Share Your Information and Personal Data With

We only share your Personal Data in ways you are aware of, and may share it with the following parties:

• Third-party service providers who provide us with business-related services (e.g., cloud hosting, data analysis, infrastructure provision, IT services, customer support services, email and push delivery services, and other similar services) to enable them to provide services to us.
• Customers and other business partners who directly or indirectly provide you with smart devices and/or the networks and systems you use to access and use our services.
• Affiliates or other third parties in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or part of our business, assets, or shares (including, without limitation, in connection with any bankruptcy or similar proceedings). In such cases, you will receive clear notice via email and/or in-App notification regarding the change of ownership and any change in how your personal information is used.
• When we deem it necessary or appropriate to: (a) comply with applicable laws and regulations; (b) comply with legal procedures; (c) respond to requests from public and government authorities (including those outside the country/region where you reside); (d) perform our terms and conditions; (e) protect our operations, business, and systems; (f) protect the rights, privacy, safety, or property of us and/or other users (including you); (g) pursue available remedies or reduce losses we may suffer.
• Subsidiaries or affiliates within our group, to conduct ordinary business activities.

Except for the above-mentioned third parties, we will only disclose your Personal Data to other third parties with your consent. We do not sell your Personal Data and do not use it for cross-context behavioral advertising.

Rights Related to Personal Data

We respect your rights and also properly manage your Personal Data. You may exercise any of the following rights by sending an email to CustomerService@epro.com.cn.

You are not required to pay any fees, and we will respond within 30 days. Please clearly state in your request which information you wish to modify, whether you want your personal information to be deleted from our database, or what restrictions you want to impose on our use of your personal information. Please note that for security reasons, we may require you to verify your identity before further processing your request. You may:

• Request access to the Personal Data we process that relates to you;
• Request us to correct inaccurate or incomplete personal information relating to you;
• Request the deletion of your Personal Data. You may also do this yourself in the App via Me → tap your account card to open Account Settings → Delete Account → confirm with your password and the emailed verification code. When you delete your account, we will delete all logs and information you uploaded through the App or bound devices, including:
  • a. Registered account information: including but not limited to mobile phone number, email, password, login token, nickname, country code, and language setting information;
  • b. Mobile device information: including but not limited to mobile phone unique identifier, push token, login logs, and software version information;
  • c. Basic device information: including but not limited to device ID, device MAC address, device IP, device name, unique ID associated with password fingerprint (not the password itself), events generated by the device, firmware version information, and activation time;
  • d. Data generated when relevant devices are connected: including but not limited to Bluetooth and Wi-Fi connection information;
  • e. Biometric information: including facial feature data and fingerprint templates stored on the device.
  Note: copies of recordings you have exported to your photo library or other apps must be deleted by you separately.
• Request the temporary or permanent restriction of our processing of part or all of your Personal Data;
• Request us to transmit personal information to you or a third party when we process your data based on your consent or the contract signed with you, and when we process your data by automated means;
• Object to or refuse our use of your data when we use it based on your consent or our legitimate interests, and withdraw your consent at any time (withdrawal does not affect the lawfulness of processing carried out before the withdrawal).

Information Security Protection Measures

We adopt commercially reasonable physical, administrative, and technical protection measures to maintain the integrity and security of your personal information:

• In terms of device access, we use proprietary algorithms to ensure data isolation, access authentication, and authorization requests;
• In terms of data communication, we support communication using security algorithms, transmission encryption protocols, and commercial-grade encrypted information transmission based on dynamic keys;
• In terms of data processing, we adopt strict data filtering and verification processes as well as complete data auditing procedures;
• In terms of data storage, all your confidential information will be encrypted and stored securely.

However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. If for any reason you believe that your interaction with us is no longer secure (e.g., you believe the security of your ePro Locker account has been compromised), please immediately inform us by sending an email to CustomerService@epro.com.cn.

Information Retention Period

We will process your Personal Data for the shortest period necessary to achieve the purposes stated in this Policy, unless a longer retention period is required by specific legal provisions. We will determine an appropriate retention period based on the quantity, nature, and sensitivity of the Personal Data. After the expiration of the retention period, we will destroy your Personal Data. If we are unable to do so due to technical reasons, we will take appropriate measures to prevent further use of your Personal Data. Biometric information is additionally subject to the destruction schedule described above.

Children's Privacy

We do not intentionally collect any Personal Data from consumers under the age of sixteen (16). We do not sell the Personal Data of any individuals, including individuals under the age of sixteen (16). If you believe we have inadvertently collected a child's Personal Data, please contact us at CustomerService@epro.com.cn and we will delete it promptly.

Your Rights in the European Economic Area, the United Kingdom and Switzerland (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom or Switzerland, you have the right to access, rectify, erase ("right to be forgotten"), restrict the processing of, and port your Personal Data, as well as the right to object to processing (including direct marketing) and to withdraw consent at any time where processing is based on consent. ePro is the data controller for the processing described in this Policy.

The legal bases on which we rely are: performance of a contract with you (Art. 6(1)(b) GDPR), our legitimate interests (Art. 6(1)(f)), your consent (Art. 6(1)(a)), and compliance with legal obligations (Art. 6(1)(c)). Biometric data is a special category of personal data under Art. 9 GDPR and is processed solely on the basis of your explicit consent.

You have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or the place of the alleged infringement. We encourage you to contact us first at CustomerService@epro.com.cn so that we can try to resolve your concern.

Your State Privacy Rights (United States)

Depending on the state in which you reside and the current laws of that state (for example the CCPA/CPRA in California, and the privacy laws of Virginia, Colorado, Connecticut, Utah and Texas), you may have certain privacy rights regarding your Personal Data, which may include:

• The right to confirm whether or not we are processing your Personal Data and to access such Personal Data;
• The right to obtain a copy of your Personal Data in a portable and, to the extent technically feasible, readily usable format;
• The right to delete Personal Data that we collected from and/or about you, subject to certain exceptions;
• The right to correct inaccurate Personal Data that we maintain about you, subject to certain exceptions;
• The right, if applicable, to opt out of the processing of your Personal Data for purposes of (1) targeted advertising; (2) the "sale" of your Personal Data (as that term is defined by applicable law); and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
• Where applicable law requires our consent to process sensitive Personal Data, the right to withdraw your consent; and
• The right not to receive discriminatory treatment for the exercise of your privacy rights.

Sensitive personal information: biometric information such as facial feature data is sensitive personal information under applicable law. We process it only with your express consent and solely for authentication; we do not use it to infer characteristics about you.

Shine the Light Law: If you are a California resident, California Civil Code § 1798.83 permits you to request information regarding the disclosure of your personal information by us to third parties for the third parties' direct marketing purposes. We do not sell or disclose information to third parties for their direct marketing purposes.

To exercise or inquire about your rights, please contact us directly at CustomerService@epro.com.cn. If legally required, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the individual on whose behalf you are making such request. If we refuse to take action regarding your request and your state permits appeals of our decision, you may appeal by replying to the email you received from us in response to your request.

International Transfers of Data

We are headquartered in China and use cloud service providers located in several countries. Your Personal Data may therefore be transferred to, stored in, and processed in countries other than your country of residence — including China, the United States and Europe — where data protection laws may differ from those of your jurisdiction.

Where we transfer personal data from the EEA, the UK or Switzerland, we implement appropriate safeguards, including the European Commission's Standard Contractual Clauses (and, where applicable, the UK International Data Transfer Addendum), together with transfer impact assessments where required. You may request further information about these safeguards at CustomerService@epro.com.cn.

Changes to This Policy

We may update this Policy in accordance with changes in information practices. If we make any material changes, we will notify you via email (sent to the email address specified in your account) or post a notice in the App before the changes take effect. We recommend that you review this page regularly to obtain the latest information about our privacy practices.

Governing Law and How to Contact Us

Except where mandatory local law provides otherwise, this Policy is governed by the laws of the State of Texas, United States, and any related dispute shall be brought in the state or federal courts located in Austin, Texas. Nothing in this section limits the rights granted to you by the GDPR or by applicable U.S. state privacy laws, or your right to lodge a complaint with your local supervisory authority.

If you have any questions about our practices or this Policy, please contact us: