Privacy policy
Updated 23 October 2026
1. About this policy
This policy explains how personal data is processed when you use the Unloc apps (iOS, Android or web), and our website. It is written for you as a user: a tenant, resident, employee, contractor or guest who has been granted access through Unloc.
Unloc is a keyless software platform. We do not own or run the buildings you access. The property owner, landlord, employer, operator or user that gave you access decides who gets access credentials, to which doors and for how long.
2. Who is responsible for your data
Who is responsible depends on what the data is used for.
| Data and purpose | Responsible (controller) | Unloc's role |
|---|---|---|
| Your keyless access, which doors you can open, and your log | The organisation that gave you access (for example your landlord, property owner or employer) | Processor – we process it on their behalf and only on their instructions |
| Your Unloc user account, login and app security | Unloc | Controller |
| Support requests you send to Unloc | Unloc | Controller |
| Visits to our website, emails, texts and marketing | Unloc | Controller |
More than one organisation and person can give you access credentials. For example, your landlord may give you access to the main entrance, and your employer to its own office. Each issuer is responsible for the access credentials it issues and the access logs for its doors.
For questions about who has been given access, for what purpose, or how long logs are kept for your building, contact the organisation or person that gave you access. You can see which organisations or persons have issued your keys in our apps. You can also contact us if you need help.
3. What data we process and why
We process only what is needed to give you a keyless experience and keep the service secure.
| Category | Examples | Why | Legal basis |
|---|---|---|---|
| Identity and contact | Name, phone number, email, user ID | Create your account, send you access credentials and login codes | Organisation's basis for key data; for your account, necessary to provide the service you use (GDPR art. 6(1)(b)) |
| Authentication | Login tokens | Keep your account secure | Necessary to provide the service (6(1)(b)) and our legitimate interest in security (6(1)(f)) |
| Access rights | Which locks you can open, and where they are | Show and deliver your access credentials | Determined by the organisation that gave you access |
| Access log | Which access credentials opened which lock, and when | Let the organisation or person see and manage access to its doors, and investigate incidents | Determined by the organisation that gave you access |
| Technical | Device ID, IP address, app and security logs | Run the service, prevent misuse, fix errors | Our legitimate interest in security and operation (6(1)(f)) |
| Support | Messages you send us | Help you | Legitimate interest (6(1)(f)) |
We do not sell your data. We do not use your access log for advertising or profiling, and we do not use it to train AI models. We use aggregated, anonymised data and statistics – which cannot identify you – to improve the service.
4. Who can see your access log
Your access log shows which of your access credentials opened which lock, and when. It is visible to:
Administrators at the organisation that issued the access credentials and the issuer themselves. They see the log for their own doors only. Organisations or persons cannot see how you use access credentials issued by others.
Unloc personnel, when needed. Only authorised staff, only to provide support, investigate security incidents or fix errors, and only when the issuer or recipient of access credentials asked us or it is necessary to keep the service secure. Access is strictly role-based and requires two-factor login.
Public authorities, only when we are legally required to disclose it.
The organisation decides how it uses the log. If it wants to use access data to monitor employees – for example attendance – it must have a lawful basis and follow applicable employment and privacy law. Unloc does not use your access log to monitor you.
Unloc staff are not permitted to give themselves access credentials to any door unless explicitly issued or requested by the organisation or person that controls the door.
5. Permissions the app asks for
The app only asks for permissions it needs, and you can review and change them in your phone's settings at any time.
The app uses native crash reporting to identify errors.
6. How long we keep data – and what happens when you move out
| Data | Kept for |
|---|---|
| Access log | 60 days, then deleted automatically |
| Technical and security logs | Up to 12 months or longer if maintenance needed |
| Account, contact details and access rights | Until your user profile is deleted |
| Backups | Deleted in line with our regular backup cycle |
When you move out or change jobs
The organisation removes your keys, and you lose access to its doors. Your access log for those doors is deleted after 60 days, like all other logs.
Your Unloc account is not deleted automatically, since you may have keys from other organisations. If you no longer need it, delete it yourself.
Deleting your account
In the apps, via your profile. Or email us at support@unloc.co.uk. We will then delete your profile, and data in backups follows the backup cycle. If we must keep something by law, we will tell you what and why.
7. Sharing and where data is stored
We share data only with the organisations that gave you access, with service providers that help us run Unloc, and with authorities where the law requires it.
Our service providers (sub-processors) are listed, with purpose and location, on our sub-processors page. They may only use data to deliver their service to us, and are bound by written data protection agreements.
Data is stored in the EEA. Some providers are based outside the EEA and the UK – for example, text messages to non-European phone numbers are sent via a US provider. Such transfers are protected by the EU Standard Contractual Clauses and, for the UK, the UK Addendum or International Data Transfer Agreement.
8. How we protect your data
Data is encrypted in transit and at rest. Staff access is limited to those who need it, requires two-factor login and is reviewed regularly. The app and platform are tested by external security experts on a regular basis, and our developers work from the EEA.
If a breach affects your data, we notify the organisation that gave you access without undue delay, so they can inform you and the authorities. Where Unloc is responsible for your data (section 2), we will inform you directly when the law requires it.
9. Your rights
You have the right to:
see the data we hold about you, and get a copy
have wrong data corrected
have data deleted
restrict or object to processing
receive your data in a machine-readable format
withdraw consent you have given, such as for newsletters
How to use them. For your account and support data, contact us at support@unloc.co.uk. For keys and access logs, contact the organisation that gave you access – or contact us, and we will forward your request and help them answer. We respond within one month.
You can complain to the data protection authority where you live or work. In Norway this is Datatilsynet, in the UK the Information Commissioner's Office. We would appreciate the chance to resolve it with you first.
10. Our website
When you visit our website, we collect your IP address, browser type and pages visited, and use cookies to run and improve the site. By using the website you also consent to the utilization of non-essential cookies.
11. Children
Unloc accounts are best suited for people aged 13 and over, but not restricted. If an organisation or person gives access credentials to a younger person, they are responsible for doing so lawfully.
12. Changes to this policy
We update this policy when our service or the law changes. The date at the top shows the latest version. If we make significant changes, we will tell you in the apps or by email before they take effect.
13. Contact
Unloc AS, organisation number 919 424 508, Kongens gate 6, Oslo, Norway.
support@unloc.co.uk