Lima Shield Connect privacy policy

This privacy policy applies to the Lima Shield Connect mobile app, available on iOS (Apple App Store) and Android (Google Play Store), and to the associated backend services.

It describes what data is collected, for what purposes, on what legal bases, for how long, and what your rights are.

1. Scope

This policy applies:

• to the Lima Shield Connect mobile app on iOS and Android
• to the backend services required for their operation
• to exchanges between the app, the LIMA SHIELD servers and the LIMA SHIELD devices installed on site

It does not cover:

• third-party websites
• external payment services
• video surveillance or alarm systems from other manufacturers

2. Data collected

We apply a strict data minimisation principle: only the data needed for the operation and security of the service is collected.

2.1 Account data

• First name and surname
• Email address
• Phone number (optional, only for SMS alerts)
• Password (stored in hashed form, never in plain text)
• Country

2.2 Device data

• Name of the protected site
• Site address (if entered by the user)
• Unique identifier of each LIMA SHIELD device
• List of devices associated with the account

2.3 Usage and event data

For each device:

• arming and disarming
• sound activations and intrusion events
• tamper detection
• battery status and technical alerts
• dates and times of events
• identifier of the device and of the account that initiated the action

This data makes it possible to display the history, trace events and provide assistance in the event of an incident.

2.4 Technical data

• phone model and operating system version (iOS or Android)
• app version
• limited technical logs in the event of an error or malfunction

2.5 Technical identifiers

• internal account identifier (user_id)
• device identifier (shield_id)
• push notification tokens (APNs for iOS, FCM for Android)
• temporary session identifiers

No advertising identifiers (IDFA, GAID), no cross-app tracking, no fingerprinting.

2.6 Data not collected

We do not collect or access:

• GPS geolocation
• your microphone
• your contacts, photos, files or calls
• user audio, text or video content
• advertising or marketing data

3. App permissions

The app may request the following permissions, always with an explanation of their use before the request:

• Bluetooth: used only to pair or locally configure a LIMA SHIELD device. If you decline, you can enter the device code manually or use another way of adding it, if one is offered.
• Camera: used only to scan the QR code on a LIMA SHIELD device when adding it. If you decline, you can enter the serial number by hand.
• Notifications: used to send you intrusion, tamper and low battery alerts, or important information about the service. If you decline, the app will still work but you will not receive push notifications.
• Temporary session identifiers to authenticate you with the server

The current version of the app does not request:

• Location permission
• Permission to access your SMS messages
• Permission to access the microphone, files or address book

4. Purposes and legal bases

4.1 Performance of the service contract

We process your data in order to:

• Create and manage your account
• Associate your LIMA SHIELD devices with your account
• Enable arming, disarming and triggering of the devices
• Display the event history
• Send you alerts in the event of an intrusion, tampering or a technical problem

4.2 Security, fraud prevention and proper operation

We use certain technical and usage data to:

• Secure access to your devices
• Detect abnormal or abusive use
• Diagnose technical incidents
• Improve the reliability of the system

4.3 Communication and support

We use your contact details to:

• Respond to your support requests
• Inform you of important changes concerning the security or operation of the service

4.4 SMS alerts

If you enable the SMS option, your phone number is used to send you SMS alerts in the event of an intrusion or critical events relating to your devices.

4.5 No marketing use or targeted advertising

We do not use your app data to:

• Display targeted advertising
• Resell your data
• Retarget you with advertising on other websites or apps

5. Data recipients

The data may be accessed only by:

• The internal teams of LIMA SHIELD SASU who need it to provide the service and support
• Technical service providers that host our servers or provide services needed for the app to work, under strict contractual terms
• The SMS service provider, if you have enabled this option

We do not share your data with third parties for commercial or advertising purposes.

6. Retention periods

We apply retention periods that are limited and consistent with our operational needs.

6.1 User account

• Account data (name, email, phone, settings)retained as long as the account is active
• If the user deletes their accountthe data is deleted or anonymised, except for data that must be retained to meet our legal obligations, for example for accounting or evidential purposes

6.2 Event history

• Event history (arming, alarms, tampering, etc.)retained in the area visible to the user for up to 12 months, as a guideline
• Beyond that, events may be deleted or anonymised, for example to keep only aggregated statistics with no identifiable link to a user

6.3 Technical logs

• Technical logs and diagnostic data retained for a short period, in principle between 3 and 6 months, solely for resolving incidents and improving the service

These periods may be adjusted according to the legal requirements of the country in which you reside and to technical needs, but we make sure not to keep personal data longer than necessary.

7. Data security

We implement appropriate technical and organisational security measures, including:

• Encryption of communications between the app, the servers and the LIMA SHIELD devices using HTTPS/TLS-type protocols
• Storage of passwords in hashed form
• Storage of session tokens in the Android Keystore / iOS Keychain.
• Access rights management mechanisms per account and per device
• the ability to revoke sessions if the phone is lost or stolen

Despite these measures, no system is completely secure. We undertake to report significant incidents in accordance with applicable law.

8. International transfers

Data processed through our services is hosted differently depending on its nature:

• Usage data and content (database)Data generated by use of the app is stored via the Firebase Realtime Database service, on servers located in Belgium (European Union).
• Authentication data: to manage user accounts, we use Firebase Authentication. Data related to your account (email address, identifiers needed for authentication) may be processed by Google on servers located in the United States.

Safeguards for transfers outside the European Union. When data is processed outside the European Union, these transfers are governed in accordance with applicable regulations. Google implements the Standard Contractual Clauses (SCCs) adopted by the European Commission, incorporated into its Data Processing Agreement (DPA). In addition, Google is certified under the EU-U.S. Data Privacy Framework, ensuring a level of data protection recognised as substantially equivalent to GDPR requirements.

Google acts solely as a technical processor (hosting and authentication). No data is used for advertising purposes.

9. Your rights

In accordance with the GDPR, you have in particular the following rights over your data:

• Access
• Rectification
• Erasure
• Restriction of processing
• Objection
• Right to data portability where applicable

You may also set instructions regarding what happens to your data after your death, where local law provides for this.

To exercise your rights or ask a question about this policy, you can contact:

• By email: support@limashield.com
• By post: LIMA SHIELD SASU, 26 avenue Hergé, 77700 Chessy, France

You also have the right to lodge a complaint with the competent supervisory authority in your country of residence, for example the CNIL in France.

10. Deleting and exporting your data

We provide the following mechanisms in the app and through our support team:

• Deletion of your account and of the data directly linked to it, unless legal obligations require otherwise
• Clearing or anonymisation of the event history associated with a LIMA SHIELD device
• Provision, on request, of an export of the main data linked to your account and your devices

Deletion requests are processed within a maximum of 30 days of receipt.

11. Minors' data

The Lima Shield Connect service is intended for adult users or professionals. We do not specifically target minors and we do not seek to collect data from minors.

12. Changes to the privacy policy

This privacy policy may change in the event of:

• The addition of new features likely to affect your data
• A change of technical service providers
• Changes in regulations

In the event of a significant change, we will inform you by appropriate means, such as a message in the app or an email, before the changes take effect where required.