Updated: December 04, 2020

This Privacy Policy explains how information about you is collected by BlueZoo, Inc. (“BlueZoo,” “we,” or “us”) in connection with our Services, and how we use and share this information. “Services” refers to (1) our foot traffic analytics services enabled by Wi-Fi “Sensor” devices (both our own sensors and third-party sensors), which our customers use to measure aggregate visitor trends around our Sensors, and (2) our websites (www.bluezoo.io, www.bluefox.io, www.partysquasher.com), mobile apps and online services (“General Services”).

We may change this Privacy Policy from time to time. If we make changes, we will provide notice by revising the date at the top of this policy and posting to our websites and apps, and in some cases, we may provide additional notice (such as via our websites or mobile app or by sending an email notification to account holders).

The topics of our Privacy Policy are

1. Sensors

This section of our Privacy Policy applies to the information we collect from the Sensor and how we use and share this information. These Sensors can be BlueZoo’s own Sensors (e.g. Party Squasher, or BlueFox) or they can be third-party Sensors (e.g. in the equipment of partners, like BrightSign). In addition to this section of the policy, please also review the “Common Information Practices” section below, which applies to information we collect in connection with all Services.

Information We Collect from the Sensor

Whenever a WiFi-enabled device (such as a smartphone, computer or tablet) comes close enough to a Sensor for the Sensor to detect the device, the Sensor may automatically collect the following information about that device: a MAC address.

A MAC address is an identifier that generally has a fixed value and is assigned by the mobile device manufacturer. All mobile phones broadcast MAC addresses, primarily in order to connect to, and subsequently send/receive data on a Wi-Fi network. MAC addresses can be either “Local” or “Global” and are identified by 12 hexa-decimal characters (6 bytes). To allow Global MAC addresses to be unique across all devices worldwide, allocation of Global MAC addresses is regulated by the Institute of Electrical and Electronics Engineers (IEEE).

Some modern mobile phones broadcast “Local” MAC addresses that are selected at random from a set of trillions of possible numbers. Because two different mobile phones can broadcast the same MAC address, it is impossible to identify a phone knowing only its broadcast (i.e. “probing”) MAC address. Further, when mobile phones change over time the Local MAC addresses that they broadcast, identifying such individual mobile phones over time becomes impossible.

To help protect the privacy of the device owner, the Sensor appends a secret key (“salts”) the MAC address and then encrypts the combination (using a “hash”). This pseudonymization process occurs on the Sensor itself (on average in less than 1 second after detection). As a result, after this very brief initial processing, no MAC address remains. Our cloud servers receive the resulting encrypted value but not the underlying MAC address.

Customers of BlueZoo receive neither consumer personal data nor encrypted data. Instead, BlueZoo customers receive only aggregated data from BlueZoo (e.g. how many persons were near a certain location at a given time, or how long persons were present on aggregate during a 15-minute period).

We leverage specialized probabilistic data structures to manage ensembles of salted and hashed MAC addresses without having to record them individually. The obfuscation process creates a data structure with enough information to make useful approximations of device recurrence, without knowing with certainty that a device has been seen before. Said another way, these probabilistic data structures enable BlueZoo to provide its customers with an estimate of repeat visitor rates without identifying specific individual visitors.

Because these data structures cannot be converted back into even pseudonymized MAC addresses, they provide full anonymization of mobile phones.

How We Use This Information

We use the information we collect from the Sensor to provide, maintain, and improve our Services for our customers that install Sensors in their facilities, and to develop new products and services. For more information about our Services, please visit www.bluefox.io or www.partysquasher.com.

How We Disclose This Information

We disclose the information we collect from a Sensor in aggregate form to our customers. Our customers are able to see the number of devices detected by the Sensor and other aggregate statistics related to the time or signal strength detected. Our Services do not report any information about any one particular device (such as the pseudonymized MAC address that we collect from the Sensor). As customers will not see information about particular devices, it follows that they will not see any information about individuals, even in an anonymized format. In addition to this aggregate sharing, we may also share the information we collect from Sensors as described in the “Common Information Practices” section below.

2. General Services

This section of our policy applies to the information we collect from the BlueZoo websites, apps and related online services we provide in connection with those websites and apps (collectively, the “General Services”) and also when you otherwise interact with us, such as for customer support. For information about choices available to you in connection with the information practices described below, please see the “Your Choices” section below.

Collection of Information

Information You Provide to Us

We collect information you provide to us when you register for an account, sign up to receive updates, fill out a form, or when you communicate with us. The types of information we may collect include your name, address, mobile phone number, email address, username and password you create for your account, WiFi network name and password (i.e., to connect the Sensor to your location’s WiFi network), location size and any other information you choose to provide. We also work with a third-party service provider that collects payment information, such as credit card information, in order to process payments you may make in connection with our Services.

Information We Collect Automatically from our General Services

When you use our General Services, we automatically collect information about you, including as follows:

• Log Information: We collect standard server logs in connection with your use of our Services, including the type of browser you use, access times, pages viewed, IP address and the web page you visited before navigating to our websites.
• Device Information: We collect information about the computer or mobile device you use to access our Services, including the hardware model, operating system and version, unique device identifiers and mobile network information.
• Information Collected by Tracking Technologies: We and our service providers may use various technologies to collect information in connection with your use of our Services, including the following:
  • Cookies, which are small files that are sent to your computer or mobile device when you visit a website. Cookies allow our websites to recognize your browser and track your usage each time you visit;
  • Local storage, which stores data locally in your browser, including user preferences; and
  • Pixel tags, which are small blocks of code often used in connection with cookies. Pixel tags may be placed on our websites and emails, and allow us to track website usage and determine when emails have been opened and acted upon.

Information From Other Sources

We may also collect information about you from other companies. For example, if you connect your BlueFox account with a third-party service by logging into that service via our General Services, we may collect information about you and your use of that service in accordance with the authorization procedures determined by that service.

Use of Information

We may combine the information we collect under this section of the Policy and use this information to:

• Provide, maintain, deliver and improve our General Services;
• Send you technical notices and support and administrative messages;
• Communicate with you about products, services, promotions, events and other news and information we think will be of interest to you;
• Monitor and analyze trends, usage and activities in connection with our Services; and
• Detect and prevent fraudulent transactions via our websites, and protect the rights and property of BlueZoo and others.

Disclosure of Information

We may disclose the information we collect under this section of the Policy as follows:

• When you use interactive areas of our General Services, like our blog or other online forums, certain information you choose to share may be displayed publicly, such as your username, actions you take and any content you post; and
• As described in the “Disclosure of Information” section below under “Common Information Practices.

Advertising and Analytics Services Provided by Others

We may allow others to provide analytics services and serve advertisements on our behalf across the Internet and in applications. These entities may use cookies, web beacons, device identifiers and other technologies to collect information about your use of the General Services and other websites and apps, including your IP address, web browser, device identifiers, mobile network information, pages viewed, time spent on pages or in apps, and links clicked, and conversion information. This information may be used by us and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our General Services and other websites, and better understand your online activity.

Social Sharing Features

Our General Services may offer social sharing features and other integrated tools (such as the Facebook “Like” button), which let you share actions you take on our General Services with other media, and vice versa. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.

Your Choices

Account Information

You may access and update your account profile information by logging into your BlueZoo account via our General Services.

Promotional Communications

You may opt-out of receiving promotional communications from us by following the instructions in those messages or notifications. Please note that if you opt-out, we may still send you transactional or relationship messages, such as those about software updates or your account (including about billing).

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. We use cookies in a range of ways to improve your experience on our website, including:

• Keeping you signed in
• Understanding how you use our website

See more information about cookies used on our websites and our complete cookie policy.

3. Common Information Practices

This section describes common information practices that apply across all Services, including to information we collect from the Sensor, General Services, or when you otherwise interact with us.

We may disclose the information we collect as follows:

• With vendors that perform services on our behalf;
• In response to a request for information if we believe disclosure is in accordance with or required by, any applicable law, regulation or legal process;
• In response to lawful requests by public authorities, including to meet national security or law enforcement requirements;
• If we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property and safety of BlueZoo or others (including to prevent actual or potential fraud);
• In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company;
• Between and among BlueZoo and its current and future parents, affiliates, subsidiaries and other companies under common control and ownership; or
• With your consent or at your direction. We may also share aggregated or de-identified information, which cannot reasonably be used to identify you.

4. Transfer of Information to the U.S. and Other Countries

We are headquartered in the United States and the information we collect is governed by U.S. law. By accessing or using our Services or otherwise providing information to us, you consent to the processing and transfer of information in and to the U.S. and other countries, where you may not have the same rights as you do under local law. Where this is the case, we will take appropriate measures to protect your personal identifiable information.

BlueZoo has put in place appropriate safeguards and compliance measures to ensure an adequate level of protection of personal data transferred outside the EEA and Switzerland. BlueZoo’s existing measures include the EU Commission’s approved Standard Contractual Clauses (SCCs) to accommodate international data transfers.

BlueZoo respects the privacy of everyone that engages with our products and services, and we are committed to being transparent about our privacy processes and policies. If you have questions concerning the transfer of information, please please send us a message here (www.bluezoo.io/contact-us-privacy)

5. Citizen rights under the General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) strengthens the EU citizen’s right to control the personal data that is collected about them. The end-consumer, often called « data subject », can exercise 8 rights concerning his/her personal data.

1. The right of accesswhich means the right to know whether data concerning him/her are being processed and if so, to access it (GDPR Article 15).2. The data right to rectification.When personal data are inaccurate, then controllers need to correct them (GDPR Article 16).3. The right to erasure (also called « right to be forgotten ») which means that under certain circumstances, the data subject can request that it’s data is deleted. (GDPR Article 17).4. The right to the restriction of processing. Simply said, the right of the data subject to limit the processing of his/her personal data (GDPR Article 18).5. The right to be informed. Data subjects have the right to clear and correct information. Furthermore, GDPR Article 19 states that if personal data that have undergone an action as a consequence of one of the other, just mentioned data subject rights, the controller must inform recipients who got these data, where feasible. And then the data subject also has a right to know where his/her data has been accessible.6. The right to data portability. If the data has been collected by an automated means and with the consent of the data subject or in the circumstances of a contract that has been concluded between the data subject and the data controller, the data subject can ask that his/her data shall be transferred to another data controller (GDPR Article 20).
2. The right to object.This right means that data subjects can say they don’t want the personal data processing to be done or going on (GDPR Article 21).8. The data subject’s right not to be subject to a decision based solely on automated processing,including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her (GDPR Article 22).

Customer data protection has always been a top priority for all of us here at BlueZoo. If you want to exercise one of these rights, please send us a message here (www.bluezoo.io/contact-us) and we will respond promptly.