This policy explains which personal data the SafeXS and BellXS apps and the website safexs.eu process, why, and what your rights are. We keep it short and only collect what is needed to open doors safely.
1. Who is responsible
SafeXS and BellXS are products of Studio WebApp B.V., Amsterdam, the Netherlands (Chamber of Commerce 59040335), reachable at info@safexs.eu.
Every SafeXS lock system belongs to an organisation or person, for example an apartment owners’ association, a company, a municipality or a home owner. That owner decides who gets access and is the controller for the data in their lock system. When we host or manage a lock system for the owner, we act as processor on their behalf. For this website we are the controller ourselves.
2. Data in a lock system
- Account: your name, e-mail address and password (stored only as a secure hash), and optionally a profile photo.
- Device: an identifier of the phone your account is linked to and a session key, so that your account works on one phone only.
- Access rights: the doors you may open, the validity period and the rights the administrator gave you.
- Openings: which door was opened, when and by whom, if the owner has switched on logging. The owner can choose anonymous logging.
- Lock positions: to save battery, the app learns the approximate GPS position of a lock and stores it encrypted, so that it only searches for locks when you are nearby. Your own position is used on your phone for this and is not tracked.
- Doorbell (BellXS): a snapshot of the visitor with every ring, deleted automatically after 14 days, and the live call itself, which is not recorded.
- Notifications: a push token, so your phone can be told about doorbell rings and changes to your rights.
E-mail addresses are stored encrypted on the server.
3. Why we use it
Only to provide the service: to let you log in securely, to check whether you may open a door, to open it, to ring you when a visitor is at the door, and, if the owner wants this, to keep a log of openings. The legal basis is the performance of the agreement with the owner of the lock system and the owner’s legitimate interest in securing their building. We do not use your data for advertising and we never sell it.
4. Where the data is stored
Each lock system has its own server and database: on the owner’s own server, on a cloud server in the owner’s name, or on European servers hosted by us. E-mails (such as login codes) are sent through a European e-mail provider. Push notifications are delivered through the push services of Apple and Google; they carry no more information than needed to wake the app.
5. How long we keep it
Account data is kept as long as you have access to a lock system. When an administrator removes you, or you remove yourself in the app with “Slide to remove me from system”, your access ends. The owner decides how long the log of openings remains available. BellXS snapshots are deleted after 14 days. Server log files are kept for at most 30 days.
6. Security
Connections are protected with TLS. Opening commands are encrypted, digitally signed and valid only once. Locks are not connected to the Internet. Read more on our security page.
7. This website
safexs.eu uses no analytics, no tracking and no third-party content. It sets one functional cookie, sx_lang, to remember your language for a year. Our hosting provider keeps technical server logs (including IP addresses) for security purposes for a limited period. If you e-mail us, we only use your message to answer it.
8. Your rights
You may ask for access to, correction or deletion of your data, restrict or object to its use, and ask for a copy. For data in a lock system, please contact its administrator first; we will help them. You can always reach us at info@safexs.eu. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Changes
We may update this policy when our products change. The date at the top shows the latest version.