Terms of Service & Data Processing

ScanLoc8 is an RFID tag scanning, tracking and locating service, powered by Levata. These terms apply to every company and user with a ScanLoc8 account. By using the service you accept them.

Contact: simon.barnsley@levata.com

• Accounts are created for registered companies only. You are responsible for keeping sign-in details confidential and for everything done under your accounts.
• Admin accounts must use two-step sign-in. Passwords must meet the published minimum strength.
• You must not use the service unlawfully, attempt to access another company's data, or interfere with the service's operation.
• We may suspend access where we reasonably believe security or these terms are at risk.

Your company owns the operational data it puts into ScanLoc8 — items, tag numbers, locations, maps and scan history. You can export it at any time using the built-in export, and it is deleted in line with the retention settings below.

We do not sell your data or use it for advertising. We use it only to provide and secure the service.

We aim to keep ScanLoc8 available and reliable, but the service is provided "as is" and we do not guarantee uninterrupted operation. RFID reading depends on your hardware, network and environment, which are outside our control.

Nothing in these terms limits liability that cannot be limited by law. Otherwise, to the extent permitted by law, we are not liable for indirect or consequential losses, and our total liability is limited to the fees paid for the service in the 12 months before the claim.

Processing of personal data contained in the operational data a customer company stores in ScanLoc8, for the duration of that company's use of the service.

Hosting, storing, displaying and transmitting tag, item, location, user and alert data solely to provide the ScanLoc8 service, including sending alert emails the customer configures.

• Data subjects: the customer company's authorised users (employees or contractors given accounts).
• Personal data: user names, work email addresses, roles, sign-in records and alert notifications. Operational RFID data (tag numbers, items, locations) is not normally personal data; if a customer links tags to people, the customer remains controller of that data.

• Process personal data only on the customer's documented instructions, including these terms and the customer's use of the service's features.
• Ensure people with access are bound by confidentiality.
• Apply appropriate technical and organisational measures: encrypted connections, access controls, per-company data separation, two-step sign-in for admins, and strong password rules.
• Assist the customer, where reasonably possible, with data subject requests (access, correction, deletion) using the service's built-in tools.
• Notify the customer without undue delay after becoming aware of a personal data breach affecting their data.
• On request at the end of the service, return or delete the customer's data.

The customer authorises the use of the sub-processors needed to run the service, currently: Lovable Cloud (application hosting, database, authentication and file storage) and the email delivery provider used for account and alert emails. We will inform customers of any intended new sub-processor and give them the opportunity to object.

Where data is processed outside the UK, we rely on an adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or standard contractual clauses.

• Read alerts are automatically deleted after 90 days (adjustable per company).
• Scan history is automatically deleted after 365 days (adjustable per company).
• Contact enquiries are delivered by email and not stored in the service.
• Account data is kept while the account is active and deleted when the account or company is removed.

We will make available reasonable information necessary to demonstrate compliance with these terms and allow for audits subject to reasonable notice, confidentiality and cost arrangements.