I. Purpose
The purpose of these terms is to define the conditions under which My Keeper undertakes to process personal and sensitive data, as defined below, on behalf of users of the MyKeeper SOS app.
Within the framework of their contractual relationship, the parties undertake to comply with the regulations in force applicable to the processing of personal data and, in particular, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, applicable as of May 25, 2018 (hereinafter, “the European General Data Protection Regulation”).
II. Description of the treatment
The personal and sensitive data processed are limited to:
X Access to SMS messaging SOLELY FOR ALERTS
X Location data SOLELY FOR ALERTS
X Automatic call answering SOLELY IN RESPONSE TO AN ALERT
A. Access to SMS messaging
When you first connect to the My Keeper SOS app, it will ask for permission to send SMS messages from your device. Once the user grants this permission, the app will only send SMS messages when the user chooses to send an alert via a physical action. Three physical actions are available to trigger the alert: repeatedly clicking the device’s power button (with a configurable number of clicks), using the SOS button on the app’s main page, and using the alert trigger button on a persistent notification that can be used even when the phone is locked. Sending the SMS via the last two predefined actions occurs only after a configurable pre-alert delay; if the user cancels using the associated notification button, the alert is not sent. The device sends a notification to alert the user that it has detected the intent to send an alert, giving the user sufficient time to cancel the alert if it is not relevant. The app will never send an SMS on its own initiative.
B. Access to location data
When you first log in to the My Keeper SOS app, it will ask for permission to access your device’s location. Once the user grants this permission, the app uses the device’s location to generate the alert text message. My Keeper SOS reminds you that SMS messages are sent only as a result of the user’s physical action described in the previous paragraph. The app will never send an SMS on its own and therefore will not send the device’s location without user input. To obtain an accurate location when sending an alert SMS, the device’s geolocation must be running in the background; the app does not collect real-time location data, and it is by no means a tracker, as the transmission of the location is exclusively dependent on the user sending the SMS.
C. How the app runs in the background
Once configured, My Keeper SOS is designed to run in the background as a user alert and security app. The app will continue to run after the initial setup, which means it will automatically restart after the device is restarted. My Keeper SOS reminds users that only a physical action by the user will trigger an action by the app. No data is collected, and no actions are performed in the background. The app is in no way a tracker.
D. Automatic disconnection following the sending of an alert:
My Keeper SOS allows users to set the duration during which the phone automatically answers incoming calls after an alert is triggered. The purpose of this is to enable discreet monitoring without requiring the user to take any action to answer the call, which can be difficult to do in the event of danger or a serious fall. Thus, our tele-assistance center listens discreetly to dispatch the appropriate emergency services. After this period following the alert activation, the phone returns to normal mode, and incoming calls cause the phone to ring. A notification appears when the device is in automatic answer mode; in addition to providing information, this notification allows you to cancel this mode before the time specified in the settings expires.
III. My Keeper's Obligations
A. My Keeper's Obligations
My Keeper undertakes to:
1. Process data solely for the purpose(s) covered by the application’s function, namely the sending of an SMS alert.
2. Ensure the confidentiality of personal data processed under this agreement.
3. Ensure that persons authorized to process personal data under this contract:
◦ Undertake to respect confidentiality or are subject to an appropriate legal obligation of confidentiality.
◦ Receive the necessary training regarding the protection of personal data.
4. Process the data in accordance with the documented instructions of the data controller set forth in this contract. If My Keeper considers that an instruction constitutes a violation of the European General Data Protection Regulation or any other provision of Union law or the data protection laws of Member States, it shall immediately inform the user and reserves the right not to apply said instruction until its lawfulness is demonstrated by the Party acting in good faith.
5. To take into account, with regard to its tools, products, applications, or services, the principles of data protection by design and data protection by default.
6. Furthermore, if My Keeper is required to transfer data to a third country or an international organization under Union law or the law of the Member State to which it is subject, it must inform the controller of this legal obligation prior to processing, unless the relevant law prohibits such information on important grounds of public interest.
7. Ensure that user data is not sold.
B. Data subjects’ right to information
It is My Keeper’s responsibility to provide information to the individuals affected by data processing activities at the time the data is collected.
C. Exercise of Individual Rights
My Keeper is designed to help users fulfill their obligation to respond to requests from data subjects to exercise their rights: the right of access, rectification, erasure, and objection; the right to restrict processing; the right to data portability; and the right not to be subject to automated individual decision-making (including profiling).
D. Notification of Personal Data Breaches
My Keeper notifies the user of any personal data breach as soon as possible after becoming aware of it, by contacting the user’s Data Protection Officer. This notification is accompanied by any relevant documentation to enable the data controller, if necessary, to report the breach to the competent supervisory authority.
The notification shall include at least the following:
• A description of the nature of the personal data breach, including, where possible, the categories and approximate number of data subjects affected by the breach and the categories and approximate number of personal data records affected;
• The name and contact details of the data protection officer or another contact point from whom further information may be obtained;
• A description of the likely consequences of the personal data breach;
• A description of the measures taken or proposed by the controller to address the personal data breach, including, where appropriate, measures to mitigate any potential adverse consequences.
If, and to the extent that it is not possible to provide all this information at the same time, the information may be provided in stages without undue delay.
E. Data Location
My Keeper undertakes to process and host this data in France or within the European Union and to take all necessary administrative and technical steps to ensure that such processing complies with applicable laws. My Keeper may add other sites located in France or the European Union without requiring the user’s consent, provided that this change does not affect the service.
Data must remain stored on servers located exclusively within the European Union.
These new sites will be located exclusively in France or within the European Union.
F. Security Measures
My Keeper undertakes to take all necessary precautions to ensure the security of the information, including protecting it against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access—particularly when the processing involves the transmission of data over a network—as well as against any other form of unlawful processing or disclosure to unauthorized persons. In particular, My Keeper undertakes to implement the following security measures:
- Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
- Measures to ensure the timely restoration of the availability of and access to personal data in the event of a physical or technical incident;
- A procedure designed to regularly test, analyze, and evaluate the effectiveness of technical and organizational measures to ensure the security of processing.
G. Data Disposal
Upon completion of the services related to the processing of such data, and for any reason whatsoever, My Keeper agrees to return all personal data to the data controller.
The return must be accompanied by the destruction of all existing copies in the processor’s information systems. Once destroyed, My Keeper must provide written proof of the destruction.
