Privacy Policy - Crystal Alarm

1. Introduction

Crystal Alarm AB (reg. no. 556822-8034) provides personal alarm services and security solutions. We are committed to protecting your privacy and ensuring that all processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR). This document describes how we collect, use, and protect your personal data when you use our services or visit our website.

Important notice

Crystal Alarm acts in two distinct roles with respect to personal data:

• When you use the personal alarm as an end user: Your employer is the data controller, and Crystal Alarm acts as the data processor. This means we process your personal data in accordance with your employer's instructions.
• For business contacts, website visitors, and marketing purposes: Crystal Alarm acts as the data controller for our own processing of personal data related to customer management, marketing, and website usage.

2. Where Crystal Alarm Acts as Data Processor (End Users of the Alarm)

2.1 What data is collected?

When you use Crystal Alarm as an end user, we collect the following data:

Basic information:

• Name, phone number, email address
• Alarm group and any role as an alarm recipient
• Information about your device (model, operating system, mobile carrier)

Upon alarm activation:

• Time and date of the alarm
• Location (GPS, Wi-Fi, Bluetooth beacons for indoor positioning)
• Audio recordings during the alarm (if the appropriate settings have been configured)
• Video (if the feature has been enabled)
• Alarm status and action plan

Technical information:

• Device identifiers and network information
• Technical logs for troubleshooting
• App usage and configuration status
• Aggregated statistics (without individual identification)

Profile images:

• Optional upload of a profile picture for visual identification during an alarm
• We do not use facial recognition or biometric authentication

2.2 Why is this data processed?

The data is processed in order to:

• Enable alarm functionality and ensure safety
• Locate you in emergency situations (including indoors where GPS is unavailable)
• Dispatch assistance in accordance with the action plan
• Assess alarm situations (audio/video)
• Provide technical support and resolve issues
• Ensure the security and stability of the service
• Detect misconfigurations and assist users
• Send functional safety notifications (onboarding, alerts, test alarm reminders)
• Send consolidated reports to administrators at your employer
• Comply with the requirements of occupational health and safety legislation

2.3 Legal basis

Your employer is the data controller, and Crystal Alarm processes data as data processor on the basis of:

• Performance of a contract – to provide the security service
• Legitimate interests – for security and occupational health and safety purposes
• Vital interests – in acute emergency situations involving audio/video recording (Article 9(2)(c) GDPR)
• Legal claims – for the storage of audio/video recordings following an alarm (Article 9(2)(f) GDPR)

2.4 Who has access to your data?

Upon alarm activation, the following parties may have access:

• Alarm monitoring centre (if you use an external monitoring centre)
• Colleagues designated as alarm recipients
• Your employer's administrators (via the self-service portal)
• Crystal Alarm's technical staff (only for troubleshooting purposes)

Functional email communications: You will receive functional safety messages from us via Mautic (self-hosted within the EU), including:

• Welcome emails and activation assistance
• Alerts regarding misconfigurations (e.g. GPS disabled, notifications disabled)
• Test alarm reminders
• Security updates

These communications are critical to the functioning of the alarm service and cannot be opted out of.

Reports to administrators: Your employer's administrators receive consolidated reports covering:

• Users with misconfigurations
• Inactive users
• Test alarm statistics
• System status

Important: These reports do not enable individual tracking of working hours or locations outside of alarm events.

Positioning and tracking: Crystal Alarm does not continuously track your location. Positioning (including indoor positioning via Bluetooth beacons and Wi-Fi) is activated only when you trigger an alarm function such as Emergency Alarm, Timed Alarm, Safe Return Home, Man Down, or any other alarm function that requires location data. Positioning never occurs in the background without an alarm function being active.

2.5 How long is data retained?

• Basic data: For as long as you are an active user
• Alarm data and recordings: In accordance with your employer's settings in the self-service portal
• System logs: Configurable per customer
• Backup: Retained for a limited period for disaster recovery purposes, after which data is deleted automatically

When you no longer require the service, all data will be deleted or returned to your employer in accordance with their instructions.

3. Where Crystal Alarm Acts as Data Controller

3.1 Business contacts and customer management (CRM)

Data processed:

• Name, email address, phone number
• Company affiliation, role/title
• Billing address
• Contact history and pipeline status (for prospective customers)

Purpose and legal basis:

• Existing customers: Contract management, invoicing, self-service portal (Article 6(1)(b) GDPR – Performance of a contract)
• Prospective customers (leads): Sales process management, documentation of contact history (Article 6(1)(f) GDPR – Legitimate interests)

Retention period:

• Existing customers: Up to 7 years following the termination of the agreement (in accordance with the Swedish Accounting Act)
• Prospective customers: For as long as an active business interest exists

3.2 Support and technical assistance

Data processed:

• Name, email address, phone number
• Company affiliation
• Technical information relating to the issue

Legal basis: Performance of a contract (Article 6(1)(b) GDPR)

Retention period: Closed support cases are retained for up to 7 years to enable handling of recurring issues.

3.3 Marketing and prospecting

3.3.1 Customer Match / Retargeting

We use Customer Match technology to display relevant advertisements to business contacts at existing and prospective customer organisations on Google, Meta (Facebook/Instagram), LinkedIn, Microsoft, and Gartner Digital Markets (Capterra).

What this means:

• Email addresses are hashed using SHA-256 before any matching takes place
• Advertisements are displayed on Google, Facebook, Instagram, LinkedIn, Microsoft, and Capterra
• Only B2B contacts are targeted — end users of the alarm service are never included

Exclusion lists (suppression of end users): We also upload end users' email addresses to advertising platforms for the sole purpose of excluding them from seeing our advertisements. This protects end users from irrelevant advertising and optimises our advertising spend. Email addresses are used exclusively for suppression purposes — never for targeted advertising directed at end users.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR)

Opt-out: Contact us at support@crystalalarm.se

Retention period: 12 months following the end of the customer relationship or active CRM engagement.

3.3.2 AI-assisted prospecting

We use lead enrichment and AI tools to identify and analyse relevant business contacts (see Section 7.1 for a list of suppliers).

Data processed:

• Name, job title, email address, phone number
• Company affiliation
• Publicly available information from LinkedIn and company websites

Legal basis: Legitimate interests (Article 6(1)(f) GDPR)

Retention period: 12 months from the date of last contact attempt

Opt-out: At the time of first contact, you will always be given the opportunity to unsubscribe from future marketing communications.

3.3.3 Email marketing via Mautic

We send B2B marketing communications via Mautic (self-hosted within the EU), including:

• Newsletters about product improvements
• Information about new features
• Invitations to webinars

Legal basis: Legitimate interests (Article 6(1)(f) GDPR)

Opt-out: Every email contains an unsubscribe link.

Please note: Functional safety emails sent to end users (onboarding, alerts, test alarm reminders) cannot be opted out of, as they are critical to the functioning of the alarm service. These are processed under the data processor arrangement described in Section 2.

3.4 Website usage and tracking

We use several tools to analyse and optimise our website:

Tools used:

• Google Analytics (GA4) – Visitor statistics and user flows
• Mautic Tracking – Visitor tracking and lead scoring (self-hosted within the EU)
• Meta Pixel (Facebook) – Measuring advertising performance and retargeting
• LinkedIn Insight Tag – Measuring advertising performance and retargeting
• Microsoft UET Tag – Measuring advertising performance in Microsoft Ads
• Gartner Digital Markets (Capterra) – Measuring advertising performance and retargeting

Legal basis: Consent (Article 6(1)(a) GDPR) via Cookiebot. All tracking tools are blocked until you actively provide your consent via the Cookiebot widget. You may accept or decline cookies and may withdraw your consent at any time.

Safeguards:

• IP anonymisation in Google Analytics
• Mautic self-hosted within the EU (data does not leave the EU)
• Standard Contractual Clauses (SCCs) in place with Google, Meta, LinkedIn, Microsoft, and Gartner Digital Markets

Chat function: Our chat provider uses cookies to enable you to continue a conversation as you navigate between pages.

4. Special Provisions Regarding Sensitive Personal Data

Crystal Alarm does not process special categories of personal data as defined under Article 9 GDPR (such as health data, biometric data, or data relating to ethnic origin). Location data is not classified as sensitive personal data under GDPR; however, we treat it with particular care and restrict its collection to active alarm situations.

4.1 Audio and video recordings during alarms

When you activate an alarm, audio is recorded automatically if the appropriate settings have been configured. If you have enabled the video feature, video will also be recorded.

Purpose: To assist the alarm monitoring centre and colleagues in assessing the situation and responding promptly.

Crystal Alarm's role: We act as data processor — your employer is the data controller.

Legal basis (your employer is responsible for):

• During an active alarm: Vital interests (Article 9(2)(c) GDPR) — necessary to protect life and health
• Storage after the alarm: Legal claims (Article 9(2)(f) GDPR) — may be required as evidence in investigations

Access:

• Alarm monitoring centre (during an active alarm)
• Alarm recipients/colleagues (during an active alarm)
• Your employer (after the alarm, via the self-service portal)
• You (via the app)
• Crystal Alarm's technical staff (only for troubleshooting purposes)

Security measures:

• Encryption of stored recordings
• Restricted access — authorised personnel only
• Access logging (Audit Log)
• Automatic deletion in accordance with configured settings
• We do not use facial recognition or biometric authentication

Retention period: In accordance with your employer's settings. Backup copies are retained for a limited period for disaster recovery purposes.

5. Your Rights

You have the following rights under GDPR:

• Right to information: You have the right to be informed about how your personal data is processed.
• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request the correction of inaccurate data.
• Right to erasure: You may request the deletion of your data under certain conditions.
• Right to restriction of processing: You may request that the processing of your data be restricted.
• Right to data portability: You may request your data in a machine-readable format.
• Right to object: You may object to processing based on legitimate interests.
• Right not to be subject to automated decision-making: We do not use automated decisions that have a legal or similarly significant effect on you.

How to exercise your rights:

• End users: Please contact your employer in the first instance, as they are the data controller. If you do not receive assistance, you may contact us at support@crystalalarm.se.
• Business contacts: Contact us directly at support@crystalalarm.se.
• Complaints: You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at www.imy.se.

6. Data Security

We take security seriously and have implemented comprehensive protective measures.

Technical measures:

• Encryption of stored personal data
• Secure transmission (TLS/HTTPS)
• Two-factor authentication for staff access
• Network security and monitoring
• Automatic deletion in accordance with defined retention periods
• Backup for disaster recovery
• Strict tenant isolation (each customer's data is stored separately)

Organisational measures:

• Restricted access — authorised personnel only
• Confidentiality agreements for all staff
• Regular security training
• Documented procedures for handling GDPR requests
• Annual review of security measures

In the event of a data breach: In the event of a serious breach, all affected customers will be notified promptly, including information about the scope of the breach.

7. Sharing Data with Third Parties

7.1 Data processors

We engage the following external suppliers who may process personal data on our behalf:

Advertising platforms (Customer Match and exclusion lists):

• Google LLC (USA) – Standard Contractual Clauses (SCCs) in place
• Meta Platforms Inc (USA) – Standard Contractual Clauses (SCCs) in place
• LinkedIn Corporation (USA) – Standard Contractual Clauses (SCCs) in place
• Microsoft Corporation (USA) – Standard Contractual Clauses (SCCs) in place
• Gartner Digital Markets / Capterra (USA) – Standard Contractual Clauses (SCCs) in place

Lead enrichment and AI:

• Clay (USA) – GDPR-compliant
• Apollo (USA) – GDPR-compliant
• Anthropic / Claude (USA) – GDPR-compliant

Email automation:

• Mautic (self-hosted within the EU)

Web analytics:

• Google Analytics (USA) – with consent via Cookiebot
• Meta Pixel (USA) – with consent via Cookiebot
• LinkedIn Insight Tag (USA) – with consent via Cookiebot
• Microsoft UET Tag (USA) – with consent via Cookiebot
• Gartner Digital Markets / Capterra (USA) – with consent via Cookiebot

All of our data processors have signed Data Processing Agreements (DPAs) and are GDPR-compliant.

7.2 When are we required to share data?

We may be required to share data:

• During an alarm (with the alarm monitoring centre, colleagues, or employer)
• Where required by law or court order
• With law enforcement agencies in the context of criminal investigations

We never sell your personal data to third parties.

8. International Transfers

Some of our suppliers are based in the United States. When we transfer personal data to the US, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Suppliers that are GDPR-compliant
• SHA-256 hashing of email addresses prior to any matching
• Encrypted transmission (TLS/HTTPS)

9. Mobile Device Permissions

The Crystal Alarm app requires the following permissions in order to function:

Android:

• SMS_RECEIVE – Receive SMS from the service
• SMS_SEND – Send SMS for positioning and alarm purposes
• CALL_PHONE – Automatically call the alarm monitoring centre
• MODIFY_AUDIO_SETTINGS – Sound the alarm even when the device is on silent mode
• ACCESS_FINE_LOCATION – Determine location during an alarm
• Notifications – Deliver alarms and updates

iPhone:

• Always allow location – Determine location during an alarm
• Microphone – Transmit audio during an alarm
• Notifications – Deliver alarms and updates

You may deny certain permissions; however, Crystal Alarm will then not function as intended.

10. Contact Us

Data controller: Crystal Alarm AB Org. no.: 556822-8034

Addresses:

• Första Magasinsgatan 5, 803 10 Gävle, Sweden
• Gamla Brogatan 32, 111 20 Stockholm, Sweden

Privacy enquiries: Email: support@crystalalarm.se Phone: +46 26 840 06 23 (Gävle) | +46 8 55 118 990 (Stockholm)

Technical support: Phone: +46 8 55 118 993 Support form: [available on our website]

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated date. In the event of material changes, we will notify you by email or via the app.

Change log

Date Description

2026-03-03

Added Gartner Digital Markets (Capterra) as an advertising and tracking platform. Clarified that no special categories of personal data under Article 9 GDPR are processed. Extended description of alarm functions that activate positioning. Simplified hashing description. Generalised technical details relating to infrastructure and logging. Updated retention period to "up to 7 years".

2025-02-12

Major update: Clarified the distinction between data processor and data controller roles. Added information on Customer Match with exclusion lists, AI-assisted prospecting, extended web tracking (Meta Pixel, LinkedIn, Microsoft), indoor positioning, system logs, and profile images. Updated information on audio/video recordings, hashing, and legal bases.

2024-06-13

Added information on the collection of personal data in connection with marketing activities.

2024-03-14

Removed reference to: "Crystal Alarm and Crystal Code are hereinafter jointly referred to as Crystal Alarm."

2020-04-15

Added information on website statistics.

2019-02-20

Added information on mobile device permissions.

2017-06-27

First version published.

12. Cookie Declaration

This website uses cookies. We use device identifiers to personalise content and advertisements, provide social media features, and analyse our traffic. We also share such identifiers and other information from your device with the social media, advertising, and analytics companies with whom we work. These companies may in turn combine that information with other data you have provided to them or that they have collected in connection with your use of their services.

Cookies are small text files that may be used by websites to make a user's experience more efficient.

The law states that we may store cookies on your device if they are strictly necessary for the operation of this website. For all other purposes, your consent is required.

This website uses different types of cookies. Some cookies are placed by third-party services that appear on our pages.

You may change or withdraw your consent to the cookie declaration on our website at any time.

Please read our Privacy Policy for more information about who we are, how to contact us, and how we process personal data. Please include your consent ID and the date on which you contacted us regarding your consent.

Your consent applies to the following domains: www.crystalalarm.no, www.crystalalarm.dk, www.crystalalarm.de, www.crystalalarm.fr, www.crystalalarm.fi, www.personalalarm.app, www.personlarm.app, www.crystalalarm.com, www.crystalalarm.se

Your current status: Allow all.

Cookie declaration last updated: 01/12/25 by Cookiebot.