PRIVACY POLICY

Last updated: May 2026

1. Data Controller

The ALMA system is a technology platform provided by LEGRAND GROUP ESPAÑA S.L, used by organizations delivering care services.

Within the use of ALMA:

• The customer (care service provider) acts as the data controller.
• Legrand Care acts as a data processor, providing the technology platform.

2. Scope

This Privacy Policy applies to the entire ALMA system, including:

• Mobile application (used by caregivers)
• Web-based platform (used by supervisors and technical staff)

3. Categories of Users

• Professional users (caregivers, technicians, supervisors)
• End users (residents or assisted individuals)

4. Personal Data Processed

Professional users:

• Email address
• Phone number (MFA)
• Login credentials
• Platform activity

End users:

• User identification
• Location
• Events and alarms
• Device-related data
• Video access (where applicable)

5. Use of the Mobile Application

The ALMA mobile application enables caregivers to receive and manage alarms in real time.

• No personal data is stored locally
• Information is displayed from the backend
• No independent data processing is carried out

Displayed information includes:

• alarm type
• associated user
• location
• GPS position
• video access where applicable

6. Video Access and Third-Party Platforms

Video access is provided through an external platform integrated via embedded display.

Legrand does not directly process video images through the mobile application.

7. App Permissions

The app may request access to:

• Camera
• Microphone
• Location

These permissions are used solely for technical purposes and do not involve storing personal data on the device.

8. ALMA Web Platform (Backend)

The web platform enables full system management, including:

• User management
• Resident management
• Device configuration
• Alarm monitoring
• Video access
• Reporting and analytics

9. Authentication and Security

Access to the system is secured through:

• Secure authentication
• Multi-factor authentication (MFA)
• Passwords and OTP codes

10. Purpose of Processing

• Delivery of care services
• Alarm and event management
• System security
• Monitoring and supervision

11. Legal Basis

• Contractual necessity (Art. 6(1)(b) GDPR)
• Legitimate interest (security)

12. Data Retention

Data is retained as long as necessary for service provision and in accordance with applicable legal obligations.

13. Data Subject Rights

Users may exercise their rights (access, rectification, erasure, etc.) through the data controller.

14. Information Security

Appropriate technical and organizational measures are implemented to protect personal data.