Privacy policy

SmartPatrol is a business-to-business product. Our direct customers are security companies who use SmartPatrol to manage their guarding operations. This policy covers the people whose data passes through the platform: our customers' administrators and supervisors, the guards they deploy, and the client facility contacts they invite into the client portal.

Where a security company decides why and how guard and patrol data is processed, that company is the data controller and SmartCheck acts as its processor. SmartCheck is the controller for account, billing and product-usage data described below.

• Account data — name, work email, role and organisation for each administrator or supervisor.
• Authentication data — hashed credentials, multi-factor (TOTP) enrolment and single-use recovery codes, and session tokens.
• Guard and patrol data — guard identifiers, tours, checkpoint scans with timestamps, tour duration and result, and exceptions raised.
• Location data — site addresses and coordinates, checkpoint geofences, and the device location captured at the moment of a scan (checked against a checkpoint geofence).
• Evidence media — photos, audio and video a guard attaches to a checkpoint or incident.
• Device data — enrolled device model, platform, activation and revocation events.
• Client portal data — client organisation names and the contact details of facility managers invited to the portal.
• Technical data — IP address, browser type and security-relevant events, recorded in an audit log.

• To provide the platform — recording patrols, verifying scans against geofences, raising exceptions and generating reports.
• To authenticate users and protect accounts, including multi-factor authentication and abuse detection.
• To maintain an audit trail of privileged actions for our customers.
• To support our customers and diagnose faults.
• To meet legal, regulatory and contractual obligations.

We do not sell personal data, and we do not use guard, patrol or evidence data for advertising or to train machine-learning models.

SmartPatrol uses a small number of strictly necessary cookies to keep you signed in. The session refresh token is stored in an HttpOnly cookie that page scripts cannot read; the short-lived access token is held in memory only. We do not use analytics or advertising cookies on the authenticated product.

We use a small set of sub-processors to run the service, including cloud hosting and infrastructure providers and Google Maps Platform (for the site and checkpoint address pickers and the geofence map). The browser loads Google Maps components directly when you use those screens. A current list of sub-processors is available on request.

Patrol, checkpoint, exception and evidence data is retained for as long as the relevant security company's account is active, and thereafter according to that company's instructions and any legal retention requirements. Account and audit data is retained for the life of the account and for a limited period afterwards. Report exports are generated on demand and expire automatically.

The browser never contacts the backend API directly — all traffic passes through a same-origin proxy, and the backend origin is a server-side secret. Access is gated at the edge on every request, sessions are designed to resist theft from a compromised page, and administrators can enrol multi-factor authentication. Data is encrypted in transit and at rest.

Depending on where you are, you may have the right to access, correct, delete or restrict the processing of your personal data, or to object to it. If your data is held by a security company that uses SmartPatrol, please contact that company first, as they control it. You can also contact us and we will route your request appropriately.

SmartCheck Technologies Limited. Privacy enquiries: info@smartcheck.com.ng.