This Privacy Policy explains how Bastian Ltd. ("we," "us," "our") collects, uses, shares, and protects personal information through the Security Guard Management System (SGMS), including its web portal and mobile applications (the "Service"). The Service is intended for security companies, their clients, and their guards and staff located in the United States.

1. Information We Collect

• Account and identity data: name, email, phone number, username, password (hashed), employee/guard ID, role, and profile photo.
• Employment and licensing data: address, date of birth, guard card/license number and expiry, certifications, work history, emergency contacts, and application details. We do not request full Social Security numbers unless a customer enables a feature that requires it.
• Work and operations data: shifts, schedules, attendance and clock-in/out, patrol and checkpoint scans, daily activity reports, incident and emergency reports, visitor logs, parking violations, pass-on logs, leave requests, and uploaded photos, videos, signatures, and documents.
• Location data: precise GPS location of guards' mobile devices during active shifts and patrols, geofence entry/exit events, and site coordinates.
• Device and usage data: IP address, device type, operating system, app version, browser type, log data, and cookies/session identifiers.
• Visitor data: names, company, vehicle/plate details, and purpose of visit entered by guards at client sites.

2. How We Use Information

• To provide the Service: scheduling, patrol tracking, attendance, incident reporting, and client reporting.
• To verify guard presence at assigned sites and support safety, including emergency alerts.
• To authenticate users, secure the Service, prevent fraud, and investigate misuse.
• To send service notifications, such as shift assignments, alerts, and password resets.
• To maintain records required by law, contracts, licensing authorities, and insurers.
• To improve, troubleshoot, and support the Service.

3. Location Tracking

Location is collected only through the mobile app and, unless your employer configures otherwise, only while a guard is on an active shift or patrol. Guards are notified of tracking and the app requests device location permission. Location data is visible to the guard's employer (the security company) and, where configured, the client for the site being served. Guards can revoke permission in device settings, but doing so may prevent them from performing assigned duties in the app.

4. Our Role: Service Provider

In most cases the security company that licenses SGMS (our "Customer") decides what data is collected about its guards, clients, and visitors and why. We process that data on the Customer's behalf as a service provider/processor. If you have a question about your employment data, contact your employer first. For data we control directly (for example, account administration data), we are the business/controller.

5. How We Share Information

• Customers and their clients: information is shared with the security company and, as configured, with the client whose site is being served (for example, patrol logs and incident reports).
• Service providers: hosting, storage, email/SMS delivery, maps, and push notification vendors bound by confidentiality and data-protection obligations.
• Legal and safety: to comply with law, subpoenas, or court orders; to protect rights, property, or safety; or to cooperate with law enforcement or licensing regulators.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets.

We do not sell personal information and do not share it for cross-context behavioral advertising.

6. Data Retention

We keep information for as long as the Customer's account is active and as needed to meet contractual, legal, tax, insurance, and licensing recordkeeping requirements. Customers can request deletion or export of their data at the end of their agreement, subject to legal retention obligations.

7. Security

We use administrative, technical, and physical safeguards, including encrypted connections (HTTPS), hashed passwords, role-based access controls, and activity logging. No system is perfectly secure; if a breach affects your information, we will notify affected parties and regulators as required by applicable state breach-notification laws.

8. Your U.S. State Privacy Rights

Depending on your state of residence (for example, California, Colorado, Connecticut, Virginia, Texas, Utah, and others), you may have the right to:

• know and access the personal information we hold about you;
• correct inaccurate information;
• delete your personal information, subject to legal exceptions;
• obtain a portable copy of your information;
• opt out of the sale or sharing of personal information and targeted advertising (we do neither);
• limit the use of sensitive personal information, including precise geolocation, to what is necessary to provide the Service; and
• not be discriminated against for exercising these rights.

To exercise these rights, email info@bastianss.com. We will verify your identity and respond within the period required by law (generally 45 days). You may use an authorized agent. If your request concerns data held on behalf of an employer, we may direct you to that employer. You may appeal a denial by replying to our response.

9. California Notice at Collection

In the last 12 months we collected the categories of personal information listed in Section 1, including identifiers, employment-related information, geolocation data (sensitive), internet activity, and audio/visual content uploaded to the Service, for the purposes described in Section 2. We disclosed these categories to the recipients listed in Section 5 for business purposes. We do not sell or share personal information, and we retain it as described in Section 6.

10. Biometric Information

SGMS does not collect fingerprints, face geometry, or other biometric identifiers by default. If a Customer enables a biometric feature, that Customer is responsible for providing the notices and obtaining the written consents required by laws such as the Illinois Biometric Information Privacy Act, and for its retention and destruction schedule.

11. Cookies

We use essential cookies to keep you signed in and protect against cross-site request forgery. We do not use third-party advertising cookies, and we do not sell or share personal information, so there is nothing to opt out of when a browser sends a Global Privacy Control signal.

12. Children

The Service is for adults. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify account administrators.

14. Contact Us

Questions or requests: info@bastianss.com, or write to Bastian Ltd., [Company mailing address, City, State ZIP], United States.

---

Contact: Bastian Ltd., [Company mailing address, City, State ZIP], United States · info@bastianss.com