Privacy Statement

PRIVACY STATEMENT
for dormakaba B-COMM SaaS Services – B2B

Version: April 2026 

1. SCOPE AND SUBJECT OF THIS PRIVACY STATEMENT
   
   1. General. This privacy statement applies to a dormakaba solution which consists of or combines the following types of components (including their related documentation and updates): 

1. a web portal or cloud service which is accessible – directly or indirectly - via a web browser (“Web Portal”), and/or
2. a mobile application (“Mobile App”).

2. Specific. dormakaba B-COMM SaaS Services is a cloud-based software-as-as-service solution designed as a platform for recording and processing time, labor and access control data which is connected to the customer’s HCM system. The B-COMM Cloud Service and the B-COMM SMILE App including related documentation and updates thereto, are components of the B-COMM SaaS Services and are individually and collectively herein also referred to as “Service”.
3. dormakaba or one of its affiliated companies is providing the Services to its business customers (each a “Customer”). A Customer may grant access for the use of the Services to natural persons. 
4. This Privacy Statement informs natural persons using the Service (“You”) of the types of personal data we collect from You in connection with the provision of the Service, the purposes this data is processed for and the rights You have in relation to the processing of Your data.
5. Country Specific Information. In addition, deviation or replacement of the data protection information set out herein, there may be country specific information which apply to You. Such country specific information, if any, are set out in section 11 – Country Specific Information or in a country specific annex or in a country specific Privacy Statement for B-COMM SaaS Services.

2. CONTROLLER, CONTACT INFORMATION, DATA PROTECTION REPRESENTATIVE
   
   1. dormakaba Deutschland GmbH, DORMA Platz 1, 58256 Ennepetal, Germany is the operator of the Service ("we", “us” or “our”). We are the controller for the processing of the personal data described in 

• Section 4 - Data Collected, Processing Purposes and Legal Bases
• Section 5 - Use of Analytics Tools; Cookies

2. Further, we process certain personal data on behalf of  Customer. Customer may be Your employer, account owner, account manager, property manager, administrator, or another company or an individual. Please note that where we process personal data on behalf of Customer, we are not the controller for the processing of personal data. For your convenience, we inform you of personal data that we might, if applicable, process on behalf of Customer, in 

• Section 6 – Personal Data Processed by us on behalf of our Customer.

For further information please contact the data controller for the respective processing.

3. Data of third parties provided by You. The Service provides functionalities that may allow You to enter personal data of third parties within the Service who are not users of the Service. We will collect and process data of such third parties which You provide to us within the Service  (e.g. e-mail, name, mobile number, additional information in a free text field), as well as statistical data related thereto. You are responsible to comply with the related legal obligations regarding data protection. 
4. dormakaba Data Protection Representatives. 

1. General (for all countries): You can reach our Group Data Protection Officer at data.protection@dormakaba.com .
2. Specific (European Union): As our data protection representative in the European Union within the meaning of Art. 27 GDPR we have designated dormakaba Deutschland GmbH, DORMA Platz 1, 58256 Ennepetal, Germany, ("EU Representative")   data.protection@dormakaba.com .

3. OUR DATA PROCESSING PRINCIPLES

We process personal data in accordance with the applicable data protection laws and regulations, as amended from time to time (“Applicable Data Protection Laws”).  

4. DATA COLLECTED, PROCESSING PURPOSES AND LEGAL BASES
   
   1. Registration to the Mobile App (if any, and if applicable to You). 

When You register in the Service, You need to enter Your contact information such as first name, last name and Your email address and define a password. To continue with the registration process, you may have to use the service  of the applicable customer identity management provider; Your registration data will be shared with such customer identity management provider, if any. Further, the Service may used to send an activiation code to Your mobile phone number for You to be able to use the Mobile App.

We process Your registration data, related IP address statistical data (e.g. type of device, version OS), as well as respective consent management data (e.g. which dormakaba terms You have accepted at which point in time), if any to permit us to provide the service offered and / or to perform a contract with You. We may also process Your contact data to provide You information about the Service (e.g. release notes). 

2. If You contact us by email, Your email address, including the information provided by You, will be stored by us for the purposes of processing the request and in case of follow-up question. If the aim of the contact request is to clarify problems with the Service or to provide other services as part of the customer service provided by us, the legal basis for the processing of Your personal data is the performance of our contractual obligation.
3. dormakaba B-COMM SaaS Services collects data to operate effectively and provide you the best experiences with our products. Most of the personal data stored in the b-comm application comes from a direct integration to your organization’s master HR system. Your organization has the ability to provide additional data directly, such as when you configure and administer the b-comm application, or when you contact us for support. We also get some data by recording how you interact with our products by, for example, using access credentials on time clock devices, and receiving error reports or usage data from software running on a time clock device. We may also obtain data from third parties or other integration partners as applicable for your business needs.
   
   The following may be collected depending on your organization’s configuration:
   
   Employee ID used for: Identification

Badge Number used for: Identification

First name / Last name used for: Identification

Username / Password used for: Identification
Face used for:    Identification

E-Mail address used for: Contact

Phone number used for: Contact

Language used for: Organization defined purpose

Birthday used for: Organization defined purpose

Government ID used for: Organization defined purpose

Job / Position Title used for: Function

Comment used for: Organization defined purpose

Picture used for: Facilitated identification

Company name used for: Contact, identification

IP address / Terminal ID used for: Location

Longitude / Latitude used for: Location

Permissions in the respective platform used for: Access rights

Transaction data of individual persons used for: History/access logs

Check In/Out dates/times used for: Payroll

Time off Requests used for: Payroll

5. USE OF ANALYSIS TOOLS; COOKIES 
   
   1. Analysis Tools. We do not use anaylsis tools.
   2. Cookies. We use the following Cookies.

We use strictly necessary cookies, which are essential for the Service to function.  No personal data stored in any cookie.
JSESSIONID                   used for: SessionID
BCoreDictionaryName    used for: Language of the logged-in use

More information about the cookies we use can be found at: https://www.cookieyes.com/blog/session-cookies/. 

6. PERSONAL DATA PROCESSED BY US ON BEHALF OF OUR CUSTOMER

We process certain personal data on behalf of our Customer. For example, our Customer may be a manufacturer or health care company and an education campus or public organization where we collect time and labor data. For your convenience, we would like to inform you of personal data that we might, if applicable, process on behalf of Customer. Please note that we are not the controller for the processing of personal data mentioned in this section 6 – Personal Data Processed by us on behalf of our Customer. For further information please contact the data controller for the respective processing. 

1. Registration to the B-COMM SaaS Services

We will provide customer with login credential to access B-COMM SaaS Services. This login credential will designate You as authorized user.

2. Requests / queries through the Service

We process the data You provide through the Service to send requested information or respond to queries raised. We process the information that You entered into the Service, only for Customer’s behalf. 

3. Access Log Data 

Customer as well as certain of its Authorized Users have the technical possibility to see in the Service information about which access point, door has been used with which access medium at which point in time, as follows:
 

Type of Door

Access to Access Log Data by

Customer

technical  

support staff

dormakaba 

support

Authorized User

Common Doors (online)

Yes

Yes 

Yes

Yes

7. RECIPIENTS; LOCATION OF DATA PROCESSING

We may transfer Your personal data to processors engaged by us, including the following: 

• the provider(s) of analysis tools mentioned in Section 5 – Use of Analysis Tools; Cookies may receive limited personal data as further set out in that section;
• dormakaba Group: our affiliated companies may receive or have access to Your personal data if they provide internal group services centrally and on our behalf;
• third-party service provider: we may engage third-party service providers to process personal data on our behalf, e.g. for hosting services.

Applicable Data Protection Laws may contain restrictions for the transfer of personal data to third countries or jurisdictions. Where we transfer Your personal data to a third country or jurisdictions, we shall comply with the Applicable Data Protection Laws and implement data transfer mechanisms and safeguards in accordance with such Applicable Data Protection Laws, if and to the extent required for such cross-border transfer. As a result, when your personal data is processed in a country or jurisdiction other than where you are residing, it may be subject to the law of this foreign country or jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that country or jurisdiction.

With regards to a transfer of personal data from the EU to Switzerland, the EU Commission has decided that Switzerland offers an adequate level of data protection. A copy of the documentation on the measures taken by us is available from us on request.

8. STORAGE DURATION AND DELETION

We store Your personal data in accordance with the Applicable Data Protection Laws if and for as long as this is required for the processing purposes referred to in this Privacy Statement. We then delete Your personal data in accordance with our data retention and deletion policies or take measures to properly anonymize the data. An exception to this is where we are legally obliged to keep Your personal data longer (e.g. for tax, accounting and auditing purposes). The data transmitted by You by email is kept by us until the purpose for the data storage ceases to apply (e.g. once Your request has been processed). 

9. YOUR RIGHTS

As a data subject, You have the rights vis-à-vis the data controller (see section 2 – Controller, Contact Information, Data Protection Representative). When the data controller is us, and depending on the country or jurisdiction in which You reside, You may have the following rights vis-à-vis us or our respective Data Protection Representative regarding Your personal data by sending an email to our respective Data Protection Representative (as listed in section 2.4 – dormakaba Data Protection Representative).

1. You may at any time withdraw any consent once given by You to the processing by us of Your personal data. As a result, we may in future no longer process Your personal data on the basis of Your consent. The withdrawal will not affect the lawfulness of any processing done on the basis of the consent up until the said withdrawal. 
2. You can request information about Your personal data as processed by us. In particular, You can request information about the purposes of processing, the category of personal data, the categories of recipients to whom Your data was or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of Your data if it was not collected directly from You, and the existence of automated decision-making including profiling and, if necessary, meaningful information on the details of the same.
3. If and to the extent, as part of Your use of the Service You may input, retrieve, correct or delete Your personal data, You are responsible for the correction, retrieval or deletion of Your data in or from the Service. In any other cases: 

3. You can request the immediate rectification of inaccurate personal data or the completion of Your personal data as stored by us and You also have the right, taking into consideration the purposes of the processing, to request the completion of incomplete personal data - including by means of an additional declaration.
4. You can request the erasure of Your personal data as stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims, whereby the right to erasure may be limited by national law.
5. You can request the restriction of the processing of Your personal data insofar as You contest the accuracy of the data, the processing is unlawful, but You object to its erasure and we no longer need the data, but it is required by You for the establishment, exercise or defense of legal claims, or You have objected to the processing.
6. You have the right to receive Your personal data that You have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller ("Right to data portability").

4. You can complain to a supervisory authority. As a rule, You may for such purposes contact the supervisory authority at Your usual place of residence, Your place of work or the headquarters of our EU Representative.

If Your personal data is processed on the basis of legitimate interests, You also have the right to object to the processing of Your personal data, provided there are grounds for this arising from Your particular situation.

If personal data is processed for direct marketing purposes, You have the right to object at any time to the processing of Your personal data for such marketing, which includes profiling insofar as it is related to such direct marketing.

10. CHANGES TO THIS PRIVACY STATEMENT

We may amend this Privacy Statement from time to time for any reason. We will notify You of any changes by posting the new Privacy Statement in the Service and changing the “Version” date. You should consult this Privacy Statement regularly for any changes. In case of relevant amendments, we may further notify You by appropriate means. 

11. COUNTRY SPECIFIC INFORMATION

[n/a]

‍