Privacy Policy

This Privacy Policy governs the manner in which EB Systems collects, uses, maintains and discloses information collected from users (each, a User) of the https://ebsystems.co Website/App (Site/App) and the eBeacons mobile application (App). This privacy policy applies to the Site/App and all products and services offered by EB Systems.

Personal identification information

We may collect personal identification information from Users in a variety of ways, including, but not limited to, real-time background location, when Users visit our Site/App, register on the Site/App, subscribe to the newsletter, respond to a survey, fill out a form, and in connection with other activities, services, features or resources we make available on our Site/App. Users may be asked for, as appropriate, name, email address, mailing address, phone number. Users may, however, visit our Site/App anonymously. We will collect personal identification information from Users only if they voluntarily submit such information to us. Users can always refuse to supply personally identification information, except that it may prevent them from engaging in certain Site/App related activities.

Non-personal identification information

We may collect non-personal identification information about Users whenever they interact with our Site/App. Non-personal identification information may include the browser name, the type of computer and technical information about Users means of connection to our Site/App, such as the operating system and the Internet service providers utilized and other similar information.

Bluetooth Scanning Technology

EB Systems uses Bluetooth beacon scanning technology to provide enhanced services while prioritizing user privacy and security. Our solution is designed to ensure that no personally identifiable information (PII) is collected, stored, or shared at any point.

What Data We Collect from Bluetooth Scanning

Our Bluetooth scanning technology only collects anonymous, randomly generated static Bluetooth addresses (Random Static Addresses) broadcasted by devices. These addresses:

• Are public, non-identifiable signals emitted by Bluetooth devices.
• Contain no information that can be used to identify an individual or the device owner.

To further enhance privacy, our system rehashes these addresses during data processing. This additional layer of encryption ensures that even the original static address cannot be linked back to the source device.

How We Use Bluetooth Data

The collected Bluetooth data is used exclusively for the following purposes:

• Pedestrian Flow Analysis: To measure foot traffic and movement patterns in public spaces.
• Event Analytics: To provide aggregate statistics for event organizers, such as peak traffic times and high-density areas.
• Wayfinding and Notifications: To deliver contextual, location-based notifications and audio guidance through integrated apps and wearables.

This data is always processed and reported in aggregate, ensuring no individual device or user can be identified.

Bluetooth Privacy Measures

Our Bluetooth scanning technology incorporates multiple layers of privacy protection:

• No PII Collection: Our system does not collect or store any personally identifiable information (e.g., names, phone numbers, or email addresses).
• Anonymized Data: All collected Bluetooth addresses are randomized and hashed to prevent identification or tracking of individual devices.
• Data Encryption: Data is encrypted both in transit and at rest to ensure maximum security.
• Event-Day Only: We never follow a device across days or between events. Within a single event day, anonymized identifiers are matched only to count repeat visits and zone-to-zone journeys, and are reported in aggregate.
• Anonymous and Aggregated: All analytics and reports are based on aggregate data, providing insights without compromising individual privacy.
• Limited Data Retention: Data is retained only for the duration necessary to perform analytics and reporting, after which it is securely deleted.
• Compliance with Privacy Standards: Our practices align with global privacy regulations, including GDPR, CCPA, and other relevant frameworks.

Legal basis for Bluetooth data processing

Legitimate Interest: Our data processing activities are conducted under our legitimate interest to analyze crowd trends (such as estimated attendance and dwell time) and improve event experiences, as permitted by Article 6(1)(f) of the GDPR. We also rely on the statistical counting exception under the ePrivacy Directive: we process device identifiers solely for anonymous crowd counting and movement pattern analysis, limited to the event venue and duration. We have assessed that our processing does not override your fundamental rights and freedoms, given the temporary, aggregated nature of the processing and the public event context.

Anonymization Impact: Because the data is anonymized and processed in aggregate, it does not constitute personal data as defined by the GDPR. In the unlikely event that any data could be linked to an individual, appropriate legal safeguards and the possibility to exercise data subject rights would apply.

What we explicitly do not do

We explicitly do not:

• Attempt to identify or track the permanent “public” MAC address of your device
• Try to link randomized addresses back to your device’s true identity
• Circumvent manufacturer privacy protections
• Track specific individuals across events or over time
• Create individual profiles or behavioral patterns
• Use data for targeted advertising or marketing
• Share data with third-party advertisers
• Attempt to identify device owners

We do not collect:

• Names, email addresses, or contact information
• The content of any communications
• Precise GPS coordinates of individual devices
• Information from your device storage or applications
• Permanent/static MAC addresses

Data processing and anonymization

We implement multiple layers of privacy protection.

Layer 1 — Device-level privacy (before we detect): Modern devices broadcast Random Static or Random Private addresses — these are already anonymized by your device manufacturer and rotate periodically (built-in iOS and Android privacy features). We detect only these temporary, randomized identifiers — not your device’s permanent MAC address.

Layer 2 — Our additional processing:

• Immediate hashing: Even these already-random addresses are cryptographically hashed using one-way algorithms with rotating salts within seconds of detection.
• Rapid aggregation: Data is immediately aggregated into statistical counts and movement patterns.
• No long-term tracking: Device identifiers are not tracked across multiple days or events.
• Double anonymization: The combination of device randomization and our hashing means data is anonymized twice.
• Automated processing: No human reviews individual MAC addresses.

Data pipeline: Your device broadcasts a Random Private/Static address (already anonymous) → our beacon detects the temporary address → our system hashes the already-random address → aggregates it into counts → deletes the hashed identifiers → final output: only aggregate statistics, containing no personal data.

Data retention

• Raw MAC addresses: Deleted within 48 hours of event conclusion
• Hashed identifiers: Retained for up to 30 days for quality assurance
• Aggregated analytics: Retained indefinitely (contains no personal data)
• Event reports: Retained as long as needed for contractual obligations

Sharing of Bluetooth analytics

We share aggregated, anonymized analytics with event organizers (attendance reports, heat maps, flow analysis), venue operators (crowd management insights), and event sponsors (aggregate foot traffic near sponsor areas). We do not share individual device identifiers with any third parties. We may use trusted service providers (cloud hosting, data processing) who are bound by data processing agreements and GDPR compliance requirements. If data is transferred outside the EU/UK, we ensure adequate safeguards through Standard Contractual Clauses (SCCs), adequacy decisions, and appropriate technical and organizational measures.

Your rights under GDPR / UK GDPR

Although the data we process is anonymized and aggregated — and thus generally outside the scope of individual data subject rights — if, in any instance, data can be linked to an individual, you have the right to: access the data we hold about you; rectification of inaccurate data; erasure (“right to be forgotten”); restriction of processing; objection to processing based on legitimate interests; data portability; and to lodge a complaint with your national data protection authority (in the UK, the Information Commissioner’s Office — ico.org.uk, 0303 123 1113).

Note: Due to immediate hashing and aggregation, we cannot identify specific individuals or devices after initial processing. Therefore, exercising certain rights (e.g., access to or erasure of specific device data) may be technically impossible after the brief initial processing period. To exercise your rights, contact us at support@ebsystems.co.

Opting out

To avoid detection by our beacons: disable Bluetooth on your device before entering the venue, or rely on your device’s MAC address randomization feature (enabled by default on modern iOS and Android). We do not knowingly collect data from children under 16; parents or guardians concerned about a child’s device being detected should disable Bluetooth on the child’s device.

Data security

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular security assessments
• Staff training on data protection
• Secure deletion protocols
• Our anonymization and security measures are reviewed periodically, and we conduct Data Protection Impact Assessments (DPIAs) where required

Web browser cookies

Our Site/App may use cookies to enhance User experience. Users web browser places cookies on their hard drive for record-keeping purposes and sometimes to track information about them. User may choose to set their web browser to refuse cookies, or to alert you when cookies are being sent. If they do so, note that some parts of the Site/App may not function properly.

How we use real-time background location

To improve user experience and automation

Real-time background location allows us to provide a seamless workforce management and tracking experience for users. With real-time background location tracking a user is not required to constantly interact with the app to report their location and interact with Bluetooth beacons.

How we use collected information

EB Systems may collect and use Users personal information for the following purposes:

• To improve customer service: Information you provide helps us respond to your customer service requests and support needs more efficiently.
• To personalize user experience: We may use information in the aggregate to understand how our Users as a group use the services and resources provided on our Site/App.
• To improve our Site/App: We may use feedback you provide to improve our products and services.
• To send periodic emails: We may use the email address to send User information and updates pertaining to their order. It may also be used to respond to their inquiries, questions, and/or other requests. If User decides to opt-in to our mailing list, they will receive emails that may include company news, updates, related product or service information, etc. If at any time the User would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email or User may contact us via our Site/App.

How we protect your information

We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your personal information, username, password, transaction information and data stored on our Site/App.

Sensitive and private data exchange between the Site/App and its Users happens over a SSL secured communication channel and is encrypted and protected with digital signatures. Our Site/App is also in compliance with PCI vulnerability standards in order to create as secure of an environment as possible for Users.

Sharing your personal information

We do not sell, trade, or rent Users personal identification information to others. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users with our business partners, trusted affiliates and advertisers for the purposes outlined above. We may use third party service providers to help us operate our business and the Site/App or administer activities on our behalf, such as sending out newsletters or surveys. We may share your information with these third parties for those limited purposes provided that you have given us your permission.

Third party Website/Apps

Users may find advertising or other content on our Site/App that link to the Site/Apps and services of our partners, suppliers, advertisers, sponsors, licensors and other third parties. We do not control the content or links that appear on these Site/Apps and are not responsible for the practices employed by Website/Apps linked to or from our Site/App. In addition, these Site/Apps or services, including their content and links, may be constantly changing. These Site/Apps and services may have their own privacy policies and customer service policies. Browsing and interaction on any other Website/App, including Website/Apps which have a link to our Site/App, is subject to that Website/Apps own terms and policies.

Compliance with children’s online privacy protection act

Protecting the privacy of the very young is especially important. For that reason, we never collect or maintain information at our Site/App from those we actually know are under 13, and no part of our Site/App is structured to attract anyone under 13.

Changes to this privacy policy

EB Systems has the discretion to update this privacy policy at any time. When we do, we will post a notification on the main page of our Site/App, revise the updated date at the bottom of this page and send you an email. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this privacy policy periodically and become aware of modifications.

Your acceptance of these terms

By using this Site/App, you signify your acceptance of this policy and terms of service. If you do not agree to this policy, please do not use our Site/App. Your continued use of the Site/App following the posting of changes to this policy will be deemed your acceptance of those changes.

Contacting us

If you have any questions about this Privacy Policy, the practices of this Site/App, or your dealings with this Site/App, please contact us at: