CCTVpilot – Product-Specific Data Controls Notice

Effective Date: 26th of February 2026 • Last Updated: 26th of February 2026

Product: CCTVpilot — the “Service” as defined in the CCTVpilot Terms of Service, covering cctvpilot.lumocodes.com, app.cctvpilot.lumocodes.com, and all other current or future subdomains of cctvpilot.lumocodes.com
Provider: LumoCodes (lumocodes.com)

1. Purpose and Relationship to the LumoCodes Privacy Policy

This document is a supplementary data controls notice for CCTVpilot. It supplements and does not replace the LumoCodes Privacy Policy. Both documents must be read together to understand how your data is handled when you use CCTVpilot.

Division of scope:

• The LumoCodes Privacy Policy governs: account registration data, technical and telemetry data, payment and billing data, data storage infrastructure, data retention, general user rights, and the third-party services used across all LumoCodes products (including Firebase, Stripe, PayHere, Mailgun, and Google Analytics).
• This document governs: data categories that are unique to CCTVpilot’s functionality and that are not addressed in full by the company-level policy.

Where a matter is addressed in both documents, this document takes precedence with respect to CCTVpilot-specific data processing activities.

2. Data Controller and Processor Roles

2.1 LumoCodes as Data Controller

For data collected in the course of operating the CCTVpilot service — including your account credentials, usage telemetry, and subscription billing — LumoCodes is the data controller. Processing in this capacity is governed by the LumoCodes Privacy Policy.

2.2 LumoCodes as Data Processor; You as Data Controller

For all personal data that you, as the account holder, input into CCTVpilot relating to your clients, vendors, and personnel, LumoCodes acts solely as a data processor on your behalf. You are the data controller in respect of such personal data.

As the data controller, you are solely responsible for:

• (a) establishing and documenting a valid lawful basis for each category of personal data you process through the App;
• (b) providing adequate privacy notices to the individuals whose personal data you input;
• (c) handling data subject rights requests (including access, rectification, erasure, restriction, and portability) from those individuals; and
• (d) ensuring that all personal data you input has been obtained and is used in a manner consistent with applicable data protection legislation.

LumoCodes processes such data exclusively on your instruction, which is expressed through your use of the App’s features.

Data processing agreement: This notice, together with the CCTVpilot Terms of Service and the LumoCodes Privacy Policy, constitutes the data processing agreement between you and LumoCodes for purposes of applicable data protection legislation.

Data minimisation advisory: You are encouraged to input only the personal data that is strictly necessary for your operational purposes. Fields such as emergency contact information and bank account details for personnel are optional and should only be populated where there is a clear operational need and, where required, the individual’s informed consent.

2.3 General Data Access and Sharing Principles

The following principles apply to all data stored through CCTVpilot, unless otherwise stated in a specific section of this notice:

• Account isolation: All data you store in the App is accessible only to your authenticated account. No other account or user can access your data.
• Storage infrastructure: All data is stored using Google Firebase, operated by Google LLC, who acts as our infrastructure sub-processor. This is described in full in Section 13.
• No third-party sharing: Except for infrastructure providers necessary to operate the Service (such as Google Firebase), and where otherwise described in the LumoCodes Privacy Policy, your data is not transmitted to, shared with, or made accessible to any third party — including advertising networks, analytics providers, or data brokers.

3. Personnel and Payroll Data

3.1 Data Fields Collected

The App permits you to store records for employees, freelancers, contractors, and temporary staff. The following categories of personal data may be recorded per personnel record:

• Identity: Full name, email address, phone number, residential address
• Employment: Employment type (employee, freelancer, contractor, or temporary), employment status, start date, end date
• Professional: Skills, certifications, notes
• Payroll rates: Payment type (daily wage, per-camera, or per-contract), daily rate, per-camera rate, overtime rate, contract fee amount
• Financial personal data: Bank account number, bank account name, bank name, bank branch
• Emergency contact: Emergency contact information
• Payment records: A history of payments made to the individual, including payment date, amount, payment method, reference number, and payment status

3.2 Purpose

Personnel data is processed for the following purposes within the App: calculating labour costs per project, generating payroll documentation, maintaining employment records, and populating financial documents. The legal basis for this processing must be determined and upheld by you as the data controller. Applicable lawful bases may include performance of a contract (the individual’s employment or engagement contract), compliance with a legal obligation, or the individual’s explicit consent.

3.3 Bank Account Data: Heightened Protection Requirement

Bank account details (comprising account number, account name, bank name, and bank branch) recorded under a personnel record constitute sensitive financial personal data. Before entering any individual’s bank account details into the App, you must ensure that you hold the explicit, informed consent of that individual for the specific purpose of payroll documentation, or that you otherwise hold a valid legal basis under applicable data protection legislation. By entering such data, you represent and warrant to LumoCodes that the required consent or lawful basis exists.

3.4 User Consent Responsibility

By entering personal data of any individual into the Personnel section of the App, you represent and warrant that you have:

• (a) informed the relevant individual that their personal data will be stored and processed using a third-party software application;
• (b) obtained any consent required under applicable data protection legislation for the specific purposes of your intended processing; and
• (c) documented a valid lawful basis for each category of personal data entered.

LumoCodes, acting as your data processor, bears no responsibility for the legality of processing activities you authorise.

4. Client Data

4.1 Data Fields Collected

Client personal data stored through the App includes: full name, email address, phone number, and postal address. Project records associated with a client may additionally include site address.

4.2 Processor Role

LumoCodes processes client personal data solely as your data processor. You are the data controller. You are responsible for: having a valid lawful basis for storing and processing client data; providing clients with an appropriate privacy notice; and responding to any data subject rights requests submitted by your clients.

4.3 No Independent Use by LumoCodes

LumoCodes does not independently collect, analyse, profile, or monetise client personal data entered into the App. This data is stored solely to enable the service features you use, such as project management, document generation, and record-keeping.

4.4 No Profiling, Advertising, or Model Training

LumoCodes does not use user-input data for profiling, behavioural advertising, model training, or cross-account analytics. This applies to all personal data you enter into the App, including client, vendor, and personnel records.

5. Vendor Data

5.1 Data Fields Collected

Vendor records may include: company name, contact person name, email address, phone number, postal address, and notes.

5.2 Processor Role and User Responsibility

Contact persons named within vendor records are natural persons and may hold rights under applicable data protection legislation. LumoCodes processes this data as your data processor. You are responsible for informing vendor contact persons that their details are stored in a third-party application and for maintaining a valid lawful basis for such processing. The same consent and responsibility principles set out in Section 4.2 apply to vendor contact data.

6. Company Banking Information (Settings)

6.1 Data Fields Collected

The Settings section of the App permits you to record your company’s bank account details for use in financial documents. The following fields may be stored: bank account number, bank account name, bank name, and bank branch.

6.2 Sole Purpose: Document Auto-Population

This data is used exclusively to auto-populate the company details fields of financial documents generated by the App, including quotations, invoices, and receipts. It is not used for any payment processing, fund movement, or platform-level billing, and is not accessible to payment processors or billing providers.

6.3 LumoCodes Access

LumoCodes does not access this data in the ordinary course of providing the Service.

6.4 Account Holder Responsibility

Anyone with valid access to your CCTVpilot account can view this information. You are responsible for maintaining strong, unique credentials for your account and for restricting access to authorised individuals only.

7. Financial and Commercial Data

7.1 Quotation Data

Quotation records include itemised line items with commercially sensitive fields per item, including: retail price, price adjustment, dealer price, actual purchase price, quantity, vendor name, and item type.

7.2 Invoices

Invoice records include: invoice number, subtotal, tax amount, total amount, and due date.

7.3 Receipts

Receipt records include: receipt number, receipt type (advance, balance, tips, or opening balance), and amount.

7.4 Cash Flow Entries

Cash flow records include: description, vendor or customer name, entry type (such as advance, balance, cost of goods sold, logistics, labour, or miscellaneous), amount, quantity, total, and entry date.

7.5 Aggregated Project Statistics

The App pre-computes and persistently stores aggregated financial figures per project to power the Statistics dashboard, including totals for retail value, dealer cost, actual cost, non-quoted costs, amounts paid, and tips. These figures are persistently stored data records, not computed on demand.

8. Site Plans and Spatial Data

8.1 Nature of Data

The site plan drawing tool stores spatial data per project, including camera placement coordinates and coverage zones, cable path routing data, and floor plan annotations. This data is stored per site plan record and linked to a specific project.

8.2 Confidentiality

Site plan data documents the physical security infrastructure of a client’s premises. You should treat this data with a corresponding level of confidentiality and limit access to authorised personnel only.

8.3 No Image Storage

The site plan tool stores vector and coordinate data only. Background image uploads are not retained.

9. Inventory and Equipment Data

9.1 Equipment Catalogue

Your equipment catalogue includes: equipment name, description, retail price, dealer price, associated vendor, category, warranty information, and price last updated date. This data constitutes commercially sensitive business information.

9.2 Physical Inventory

Physical inventory records include: equipment name, description, quantity, unit cost, total cost, and serial numbers.

9.3 Barcode and QR Scan Data

Serial numbers may be captured via barcode or QR code scanning. Only the decoded text string (serial number) is retained as part of the inventory record. Scan images are not captured or stored by the App. No biometric or image data is retained as a result of scanning.

10. Offline Functionality and Local Data Cache

10.1 Mechanism

The App supports offline functionality by maintaining a local data cache in your browser. This enables read and write access to your data when internet connectivity is not available. Changes made offline are queued locally and synchronised to our servers when connectivity is restored.

10.2 Conflict Resolution

Where the same record is modified simultaneously across multiple browser tabs or devices, the most recently written version of the record will overwrite earlier concurrent changes. LumoCodes is not responsible for data loss resulting from concurrent editing conflicts.

10.3 Local Cache Risk Disclosure

You acknowledge and accept the following risks associated with offline data storage:

1. Browser storage clearing: If your browser’s local cache is cleared or reset before offline changes have been synchronised, those changes will be permanently lost and cannot be recovered by LumoCodes.
2. Storage quota exceeded: If your browser’s storage quota is reached while you are offline, new changes may fail to be queued for synchronisation. LumoCodes is not liable for data loss occurring in this scenario.

10.4 Device Security Responsibility

Data held in the local browser cache is not encrypted at rest on your device. You are solely responsible for implementing appropriate device-level security measures — including device encryption, access controls, and screen locking — to prevent unauthorised access to locally cached data. This responsibility is heightened when a persistent session is maintained on a shared or unattended device.

LumoCodes shall not be liable for any loss, unauthorised disclosure, or corruption of data arising from: (i) the clearing of local browser storage before offline changes have been synchronised; (ii) the exhaustion of browser storage quotas; (iii) device failure, theft, or loss; or (iv) concurrent editing conflicts. All limitations of liability set out in the CCTVpilot Terms of Service apply to this notice.

11. User-Uploaded Documents

11.1 Company Logo

You may upload a company logo image. This image is displayed as your account profile picture within the App and on generated financial documents.

11.2 Custom Terms of Service PDF

You may upload a PDF of your own Terms of Service to be appended to printed or exported quotations.

11.3 Purpose Limitation

These files are used exclusively for the purposes described above. They are not indexed, analysed, used for model training, or applied to any other purpose by LumoCodes.

12. Technical Calculators: No Data Persistence

12.1 Calculator Features

The App includes CCTV-specific technical estimation tools, including: disk storage estimator, network bandwidth calculator, field of view (FOV) calculator, and PoE power budget calculator.

12.2 Session-Only Processing

All inputs provided to these calculators — including camera specifications, resolution, frame rates, network parameters, storage duration targets, lens angles, and power draw values — and all results generated, are processed entirely within your browser session. No calculator input, intermediate value, or calculation result is transmitted to LumoCodes servers, stored against your user account, or retained after the browser session ends or the calculator is closed.

Calculator results are provided as estimation aids only. LumoCodes makes no warranty as to the accuracy or fitness for purpose of calculation results for professional, commercial, or regulatory applications. You are responsible for independently verifying all technical calculations before acting on them.

13. Data Storage Infrastructure

13.1 Primary Data Store

All CCTVpilot application data is stored using Google Firebase (cloud database and file storage services), operated by Google LLC. All data in transit is encrypted using SSL/TLS.

13.2 Access Controls

All data stored within the App is accessible only to the authenticated account holder. Security controls enforce strict per-account isolation; no cross-account data access is possible.

13.3 Sub-Processor: Google LLC

Google LLC operates the cloud infrastructure used by CCTVpilot and acts as a sub-processor of personal data stored through the App, including third-party personal data you input. Google processes this data in accordance with its Data Processing and Security Terms. By using the App, you acknowledge Google’s role as sub-processor.

13.4 International Data Transfers

Data stored through the App may be processed on Google’s infrastructure across multiple countries, including countries outside the European Economic Area or your jurisdiction of operation. Such transfers are subject to the safeguards described in Google’s data processing terms. By using the App, you acknowledge and accept that your data, including any third-party personal data you input, may be subject to cross-border transfer under those safeguards.

13.5 Security Measures

LumoCodes implements reasonable technical and organisational security measures appropriate to the nature of the data processed, including access controls, authentication safeguards, and encryption of data in transit. These measures are designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

14. Data Retention for User-Input Third-Party Data

• In-app deletion: Client, vendor, and personnel records deleted within the App are immediately removed from active storage and are no longer accessible.
• Account deletion: Upon deletion of your CCTVpilot account, all data and uploaded files associated with your account will be purged in accordance with the retention schedule set out in the LumoCodes Privacy Policy.
• Backup and recovery: LumoCodes does not maintain application-level backups of individual user data. Data deleted within the App or upon account deletion cannot be recovered by LumoCodes.

15. Data Subject Rights: CCTVpilot-Specific Procedures

15.1 Your Own Account and Business Data

You may access and update your business profile information (including company name, address, contact details, and banking information) directly through the Settings section of the App. To request full account deletion, including all associated data, contact [email protected].

15.2 Third-Party Data You Control

As data controller for client, vendor, and personnel data, you are responsible for receiving and responding to data subject rights requests from those individuals. You may fulfil most requests — including access, rectification, and erasure — directly within the App by updating or deleting the relevant records. Where you require LumoCodes’ assistance in fulfilling a data subject request, submit a written request to [email protected].

15.3 Data Portability

Financial documents (quotations, invoices, receipts) may be exported as PDF directly from within the App. This constitutes the primary data portability mechanism for financial records. For bulk data export requests beyond PDF generation, contact [email protected].

16. Data Breach Notification

In the event of a personal data breach affecting data held within CCTVpilot, LumoCodes will notify affected account holders without undue delay following discovery of the breach, subject to verification and investigation, and in accordance with applicable legal obligations.

Where the affected data includes personal data of your clients, vendors, or personnel — for which you are the data controller — you are responsible for assessing whether notification obligations to those individuals apply under governing data protection legislation and for taking appropriate action. LumoCodes will provide reasonable assistance upon request.

For breach-related communications, contact: [email protected]

17. Changes to This Notice

LumoCodes may update this notice from time to time. Any changes will be published at this location with a revised “Last Updated” date. Continued use of CCTVpilot following the publication of changes constitutes acceptance of the updated notice.

18. Contact

For questions or concerns regarding this notice or data handling within CCTVpilot:

Email: [email protected]

This notice is to be read in conjunction with the LumoCodes Privacy Policy.