Scope of This Document
At CriticalArc, we take you and your Users’ privacy seriously. We know that customers place an immense priority on their safety and wellbeing and are only willing to entrust their well-being to those who can provide the fastest and most reliable service. We’ve seen over a million people download our technology and it humbles us to know they’ve trusted SafeZone with something of such consequence – their lives.

Purpose of this Global Privacy Policy
This Global Privacy Policy aims to provide you with information on how CriticalArc collects and processes your Personal Data through your use  of our Websites (as defined below) and in the provision of our services, including any data you may provide through our Websites when you ask us to contact you or purchase a product or service, in accordance with the relevant data protection legislation (including UK and EU General Data Protection Regulation) (GDPR)(the “Data Protection Legislation”).

Depending on how you interact with us, CriticalArc acts as either:

• a data processor, when we process Personal Data on behalf of our Customers in connection with the SafeZone Services; or
• a data controller, when we process Personal Data for our own purposes, such as operating our Websites, managing customer relationships, marketing our Services, recruiting employees and administering our business.

This Global Privacy Policy applies to our SafeZone Command, SafeZone OmniGuard, SafeZone App and SafeTrans Services, (collectively referred to as our “Services”) – https://www.criticalarc.com and https://safezoneapp.com (collectively referred to as our “Websites”).

Our Products, Services and Websites are not directed to minors, including children under the age of 13, and we request that they do not, under any circumstances, provide Personal Data through our Services.  Additionally, we do not knowingly collect data relating to children. We do not sell any Personal Data of Customers, Visitors or Users, including those aged between 13 to 16. For the avoidance of doubt:

• “Customers” means organizations, institutions, or businesses that license or purchase CriticalArc’s products and services, including SafeZone Command, SafeZone OmniGuard, SafeZone App, and SafeTrans.
• “Visitors” means individuals who interact with CriticalArc’s Websites or online services, including but not limited to accessing content, submitting forms, or signing up for newsletters or demos.
• “Users” means individuals who access or use the Services provided by CriticalArc under a Customer’s license, such as employees, students or members of the Customer’s organization.

We have implemented additional robust mechanisms for detecting and preventing data collection from minors under the local adult-age thresholds. These mechanisms include age verification processes and regular audits to ensure compliance with applicable laws.

 If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will take prompt steps to permanently delete the information. If you are a parent or guardian who believes their child has provided us with personal information, you may contact us at privacy@criticalarc.com to request deletion.

This Global Privacy Policy applies to all users of our Services, users of our websites, clients, suppliers and third parties that we may instruct from time to time to carry out the services on our behalf.

It is important that you read this Global Privacy Policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing Personal Data about you, to be fully aware of how and why we are using your data. This Global Privacy Policy supplements our other policies and is not intended to override them.

You have the right to make a complaint at any time to the relevant supervisory authority for data protection issues.

Please find below the relevant supervisory authority depending on the location you reside in, including direct links to each complaint portal:

We would, however, appreciate the chance to deal with your concerns prior to you contacting these authorities. Please contact us in the first instance.

Asia/Pacific – Head Quarters
Address: Suite 5, Level 11
288 Forest Road
Hurstville NSW 222, Australia
Telephone: +61 1300 13 53 40
Email: contact@criticalarc.com

Europe, Middle East and Africa
Address: Creative Industries Centre, University of Wolverhampton Science Park, Glaisher Drive, Wolverhampton WV10 9RU
Telephone: +44 (0) 800 368 9876
Email: contact@criticalarc.com

Americas
Address: 200 Union Boulevard, Suite 200 Lakewood, Denver CO 80228, USA
Telephone: +1 800 985 9402
Email: contact@criticalarc.com

Changes to the Global Privacy Policy and Your Duty to Inform Us of Changes
The first version of this Privacy Policy was issued in May 2018. This version was most recently updated in October 2026. Any prior versions of this policy can be obtained by contacting us at privacy@criticalarc.com.

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your relationship with us. If you wish to update your Personal Data, please contact us by emailing privacy@criticalarc.com.

Third-party links
Our websites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control any of these third-party websites and are not responsible for their privacy statements and / or obligations. When you access a third-party website via our websites, we encourage you to read the Privacy Policy of every website you visit.

Data protection principles
We will comply with Data Protection Legislation which states that the Personal Data we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

The Personal Data that we collect about you

In some circumstances, our organization may request information to assist in providing the best response and improve Services. This may include, but is not limited to, special medical and/or accessibility information such as allergies, Medical Conditions, PEEPS (Personal Emergency Evacuation Plans), for example. These are Special Categories of Personal Data about you which will only be collected where necessary to provide the Services and for the specific purposes described in this Privacy Policy. We do not collect any other Special Categories of your Personal Data. 

We also collect, use and share Aggregated Data, such as statistical or demographic data, for any purpose. Aggregated Data may be derived from your Personal Data, however this type of data is not considered Personal Data in law, given that it does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat this combined data as Personal Data, which will be used in accordance with this Privacy Policy.

We do not currently use Personal Data to make solely automated decisions that produce legal or similarly significant effects about individuals. We may use automated tools, including AI-enabled technologies, to support service delivery, security monitoring, operational efficiency and customer support. Where automated processing is used, appropriate safeguards will be applied in accordance with applicable data protection laws, including providing information about relevant decisions, enabling individuals to raise representations, request human intervention where applicable, and challenge decisions where required.

If you fail to provide Personal Data
Where we need to collect Personal Data by law, or under the terms of a contract we have with your organization and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with your organization (for example, to respond to you if you request assistance through the use of our services). In this case, we may have to cancel a Product or Service you have with us or disallow the use of such Service, however we will notify you, if this is the case at the time.

How we collect Personal Data from you
We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity and Contact data by filling in forms or by opting-in having been invited to do so by your organization when they purchase a service from us.
• Automated technologies or interactions. As you interact with our Websites, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this Personal Data through cookies, server logs and other similar technologies. We may also receive Technical Data about you, should you visit other websites employing our cookies. Please see our cookie policy below for further details.
• Third parties or publicly available sources. We receive Identity Data, Contact Data, Financial Data, Professional Information and Special Categories of Personal Data about you from third parties, when:
  •  we provide our client services or other parties send us your Personal Data to enable the provision of those Services; 
  • you provide your Personal Data to a third party for the purpose of sharing it with us. 
• When using our Websites, we may receive Personal Data about you from various third parties and public sources as set out below:
  • Technical Data from the following parties:
    • analytics providers such as Google based outside the EU;
    • navigation data such as Lucky Orange based outside the EU;
    • Internet Protocol data such as LeadFeeder or LeadForensics.
• Marketing and Communications Data. When you use our Websites, our Services or other electronic platforms and portals which we offer or which we have agreed with you to use, or when you review the publications or marketing communications we send you. 

Some Personal Data may be collected about you from the forms and surveys you complete, from records of our correspondence and phone calls and details of your visits to our Websites, including but not limited to personally identifying information such as Internet Protocol (IP) addresses. We may also collect statistics about the behaviour of Visitors to our Website.

How we use your Personal Data

Where required by law, we will obtain your consent before sending you direct marketing communications. You may withdraw your consent at any time by following the unsubscribe instructions in our communications or by contacting marketing@criticalarc.com.We do not sell your Personal Data or share it with third parties for their own direct marketing purposes.

Cookies
We use cookies, pixel tags, device identifiers, and similar technologies to provide, protect, and improve our services. These technologies help us:

• Enable essential website functionality.
• Measure website performance.
• Provide personalized advertising.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this Website may become inaccessible or not function properly. More details on how we use cookies can be found in our Cookie Policy.

Where required by law, we will request your explicit consent before placing non-essential cookies on your device. You can manage or withdraw your consent at any time through Cokie Hub or by adjusting your browser settings.

For more details, please access our Cookie Policy here: https://criticalarc.com/cookie-policy/.

Change of purpose
We will only use your Personal Data for the purposes for which it was collected, unless we have a legitimate reason to use it for another purpose and that purpose is compatible with the original one.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so prior to any further use.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Data sharing

Who We Share Personal Data With
We may share Personal Data with:

• CriticalArc group companies.
• Cloud hosting and IT providers.
• Customer support providers.
• Identity verification providers.
• Analytics providers.
• Professional advisers.
• Regulators, courts and law enforcement where required by law.
• Organizations involved in a merger, acquisition or sale of our business.

We require all third parties to protect Personal Data and only process it for authorized purposes.

If your organization has opted in to one of our Alliances, and you have provided your consent to do so, your Personal Data will be shared with other organizations, locally and globally, within the Alliance. An “Alliance” is a single community network offered by CriticalArc that allows participating organizations to provide mutual assistance to each other when they are located within another participating organization’s designated area. 

Where applicable, we will only share the necessary amount of Personal Data for the purpose of providing services directly related to our SafeZone Alliance. The legal basis for sharing the necessary data is your explicit consent, which you may withdraw at any time.

How secure is my information with third-party service providers and other entities in our group?
All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your Personal Data in line with our policies. We permit third parties to process your Personal Data for specified purposes and in accordance with our instructions.

For GDPR (EU/UK) residents: you have the right to object to any processing based on our legitimate interests. You can exercise this right by contacting us at privacy@criticalarc.com.

International Transfers
As a global organization, CriticalArc may transfer Personal Data to countries other than the country in which it was collected, including where our offices, Customers, affiliates or trusted service providers are located. Where we transfer Personal Data internationally, we implement appropriate safeguards to ensure it remains protected in accordance with applicable data protection laws.

Transfers from the UK and European Economic Area (EEA)
Where Personal Data is transferred outside the UK or EEA, we will ensure that an appropriate transfer mechanism is in place. Depending on the circumstances, this may include:

• transferring Personal Data to countries that have been recognised as providing an adequate level of protection by the UK Government or the European Commission;
• using the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs), or the European Commission’s Standard Contractual Clauses, together with any supplementary measures required to protect Personal Data; or
• relying on another lawful transfer mechanism permitted under applicable data protection laws.

Where appropriate, we assess international transfers and implement additional technical, contractual and organizational safeguards to ensure Personal Data continues to receive an equivalent level of protection in accordance with applicable data protection law.

Transfers from Australia
Where Personal Data is transferred outside Australia, we take reasonable steps to ensure overseas recipients handle Personal Data in accordance with the Australian Privacy Principles or are otherwise subject to comparable privacy obligations. Where required by law, we rely on your consent or another lawful basis for the transfer.

Transfers from New Zealand
Where Personal Data is transferred outside New Zealand, we take reasonable steps to ensure the recipient protects the information in a manner that provides safeguards comparable to those required under the New Zealand Privacy Act 2020. Where appropriate, we may seek your consent before transferring your Personal Data internationally.

Transfers from the United States
Where Personal Data, including protected health information (PHI) where applicable, is transferred internationally from the United States, we implement appropriate contractual, technical and organizational safeguards consistent with applicable U.S. laws, including HIPAA where relevant.

If you would like more information about the safeguards we use for international transfers, please contact us at privacy@criticalarc.com.

Your Privacy Rights
Depending on your location and the applicable privacy laws, you may have the following rights in relation to your Personal Data:

• Right to be informed – To receive clear and transparent information about how we collect, use and share your Personal Data.
• Right of access – To request access to the Personal Data we hold about you and obtain a copy where permitted by law.
• Right to rectification – To request that we correct inaccurate or incomplete Personal Data.
• Right to erasure – To request deletion of your Personal Data where applicable, for example where it is no longer required or where processing is unlawful.
• Right to restrict processing – To ask us to limit how we process your Personal Data in certain circumstances.
• Right to data portability – To receive your Personal Data in a structured, commonly used and machine-readable format and, where technically feasible, have it transferred to another organization.
• Right to object – To object to processing based on our legitimate interests or to the use of your Personal Data for direct marketing.
• Right to withdraw consent – Where we rely on your consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint – To make a complaint to us or your local data protection or privacy regulator if you believe your privacy rights have been infringed.

Not all rights apply in every jurisdiction or to every processing activity. If you wish to exercise any of your rights, please contact us using the details provided in this Privacy Policy.

Additional Rights by Jurisdiction

Depending on where you are located, you may also have additional rights under applicable privacy laws.

Australia
Under the Australian Privacy Principles (APPs), where lawful and practicable, you may choose to interact with us anonymously or using a pseudonym. You also have the right to be informed if your Personal Data will be transferred overseas and the safeguards that apply to those transfers.

New Zealand
Under the Privacy Act 2020, if an eligible privacy breach is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner where required by law.

United States
Privacy rights vary by state. Where applicable, you may have additional rights under state privacy laws, including the right to know, delete, correct or obtain a copy of your Personal Data, and to opt out of certain processing activities. Further information is provided in the applicable U.S. Privacy Schedule.

United Kingdom and European Union
If you are located in the UK or EEA, you also have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal or similarly significant effects, except where permitted by applicable law.

Data security
We have implemented appropriate technical and organizational security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know your information. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.

Where we have given you (or where you have chosen) a password that enables you to access certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

We maintain incident response procedures to detect, assess, and respond to suspected data breaches. If a breach occurs and the law requires us to notify you, we will do so promptly and in accordance with the timeframes set by the relevant Data Protection Legislation. For example, this may mean notifying within 72 hours in the UK and EU, or as soon as practicable in Australia and New Zealand. In the United States and other regions, requirements vary, and we will meet all applicable obligations.

Data retention

How long will you use my Personal Data for?
We will only retain your Personal Data for as long as necessary to provide our Services or to fulfil our business purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements and in accordance with the applicable Data Protection Legislation.

When determining the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your Personal Data are available in our retention policy which you can request from us by contacting us.

In certain circumstances, and where permitted under applicable law, you can ask us to delete your data: please find further information on your Right to erasure above under the “Your Personal Rights” section within this Privacy Policy.

In some circumstances we may anonymize your Personal Data (so that it can no longer be associated with you) for research, reporting or statistical purposes in which case we may use this information indefinitely without further notice to you.

Third parties that we work with, who are the data controllers of your Personal Data, may keep your Personal Data for periods of time that differ from our retention policy. We do not control these third parties and are not responsible for how they manage or use your Personal Data. We encourage you to review their privacy policies for further information on how they handle your Personal Data.

Data storage
Data is held in CriticalArc using different (multiple) secure servers.

CriticalArc and Third-Party Vendors

• How We Use Your Personal Data for Advertising

We use your Personal Data to improve your experience with our services and to provide you with personalized advertising. This may include using cookies and device identifiers to understand your preferences and show you advertisements that are relevant to your interests. Advertising may appear on our Website, our app, and on third-party sites or apps.

• Third-Party Vendors

We work with third-party advertising vendors to display ads on sites across the Internet. These vendors use cookies and/or device identifiers to serve ads based on your past visits to our Website or use of our app.

• Use of Cookies and Device Identifiers

Third-party vendors may use cookies and/or device identifiers to collect information about your interactions with our Website and app. This information is used to show you ads that are relevant to your interests.

• Opting Out

You can opt out of Google’s use of cookies or device identifiers by visiting Google’s Ads Settings. Alternatively, you can opt out of a third-party vendor’s use of cookies by visiting the Network Advertising Initiative opt-out page or control the use of device identifiers through your device’s settings: https://optout.networkadvertising.org/?c=1

Alternatively, you can control advertising cookies and tracking technologies through our cookie consent tool and your browser settings.

• Overseas Transfers
  Some vendors are located outside your country of residence. Where we transfer data internationally, we take steps to ensure equivalent privacy protection – including contractual safeguards, adequacy determinations, or your explicit consent

AI-related Use
We may use artificial intelligence (AI) and machine learning technologies to support and improve our Services, including customer support, operational efficiency, security monitoring and service improvement.

Where these technologies involve the processing of Personal Data, we process such data only where we have an appropriate lawful basis under applicable data protection laws.

We do not use Personal Data to train public or general-purpose AI models.

Where third-party AI providers process Personal Data on our behalf, we require appropriate contractual, technical and organizational safeguards to protect that Personal Data.

AI-assisted outputs and decisions are subject to appropriate governance and oversight measures. Where required by applicable law, we provide appropriate human oversight and enable individuals to exercise their applicable rights in relation to automated decision-making.

If you have any questions or concerns about this Privacy Policy or our use of AI tools, please contact us at privacy@criticalarc.com.

No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Changes to this Privacy Policy
We may update this Privacy Policy periodically and/or to reflect changes in our practices or relevant laws. Updated versions of the Privacy Policy will be posted on our website with the effective date shown.

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact our Data Protection Officer Swati Chaudhary at:

• Email: privacy@criticalarc.com
• Phone: +61 1300 13 53 40
• Web Form: https://criticalarc.com/contact/