Privacy Policy

EFFECTIVE DATE: 12 November 2026

Version 2.2.

---

WHICH PART APPLIES TO YOU

PhotoSentinel runs two platforms. Which part of this Privacy Policy applies to you depends on when you contracted with us.

Where your data is processed is described in the part that applies to you. When we move you from the legacy platform to Sentinel OS, Part B applies to you from the day you accept the Sentinel OS terms, and your data is processed in your cell from then on.

THE SUB-PROCESSOR LIST

The service providers that process personal information for us, what each one does, where each one processes it, and the countries from which our personnel may access it are listed in one place, our Sub-processor List, published at https://photosentinel.com/legal/sub-processors. The Sub-processor List forms part of this Privacy Policy. We add to it and update it as our providers change, and each update carries its date. Wherever this Privacy Policy refers to a provider, a location or a country, the Sub-processor List is where the details are.

---

ABOUT US

The PhotoSentinel group of companies respects the privacy rights of our users and is committed to protecting the information collected through our software products, services and website (including www.photosentinel.com) (the "Online Services"). The company that is responsible for your information is:

In this Privacy Policy, "we", "us" and "our" mean the company that applies to you, and "Company" means that company. This Privacy Policy explains what personal information we may collect about you when you use or access the Online Services and how we collect, store, disclose, transfer, protect and otherwise process that information.

Please read this Privacy Policy carefully. By continuing to submit your personal information to us, you consent to us collecting, using and disclosing it in accordance with this Privacy Policy. If you do not accept this Privacy Policy, you should cease submitting your personal information to us and cease using the Online Services.

This Privacy Policy supplements the Master Subscription Agreement ("MSA"), the User Terms, the Order Schedule and any other terms between you and us. Where we process personal information for a customer, our MSA also applies.

We may change this Privacy Policy to reflect changes in data protection laws or our practices. It is a versioned document with a version label and an effective date, published at https://photosentinel.com/legal/privacy. We will endeavour to notify you of changes. Your continued use of the Online Services after the effective date of a change signifies your acceptance of it, as far as applicable law permits. A change to the Sub-processor List is not a change to this Privacy Policy, and is published in the Sub-processor List itself.

Whilst this Privacy Policy may be translated into languages other than English, the English language version is the primary and master version.

WHAT LAWS DOES THIS PRIVACY POLICY COMPLY WITH?

We manage personal information in accordance with the privacy laws that apply where you are located, including:

• Australia: the Australian Privacy Principles under the Privacy Act 1988 (Cth);
• New Zealand: the Privacy Act 2020 (NZ);
• United Arab Emirates: the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 ("PDPL"), and, for customers in the Dubai International Financial Centre, the DIFC Data Protection Law, DIFC Law No. 5 of 2020;
• United States: applicable state privacy laws, including the California Consumer Privacy Act as amended ("CCPA") and the Colorado Privacy Act; and
• European Union and United Kingdom: the GDPR and the UK GDPR, to the extent they apply to our processing.

THE LOCATION OF YOUR ORGANISATION DETERMINES WHERE YOUR DATA IS PROCESSED

Sentinel OS runs in three sovereign cells: the United States, Dubai (UAE) and Australia (Oceania). Each cell is a separate deployment with its own contracting company, its own currency and its own hosting region. A customer's organisation is established in one cell, based on where the customer is located, and that cell determines which company contracts with it and where its data is hosted and processed. The cell for your organisation is stated in your Order Schedule. A customer group with organisations in more than one cell has a separate account and agreement in each. The legacy platform has its own locations, set out in Part A of the Sub-processor List.

---

PART A: LEGACY PLATFORM

Applies to customers whose contract with PhotoSentinel started before November 2026. The legacy platform closes in June 2027.

A1. What the legacy platform is

The legacy platform is the original Buildcam platform used for contracts signed before November 2026. Between December 2026 and June 2027 we move each legacy customer to Sentinel OS, and the legacy platform closes in June 2027. This Part A is the data processing statement for the legacy platform until it closes.

A2. Where legacy data is processed

The providers that host and process legacy platform data, and the location each one uses, are listed in Part A of the Sub-processor List. Legacy customer data is held in the region that serves the customer, and may be accessed by our personnel from the countries listed there.

A3. What happens at the end

Your data is moved to Sentinel OS at some point between December 2026 and June 2027. It is deleted from the legacy platform when the legacy platform closes in June 2027. From the day you accept the Sentinel OS terms, Part B applies to you. Support for legacy customers moves to Sentinel OS support as part of the move.

---

PART B: SENTINEL OS

Applies to customers whose contract with PhotoSentinel started from November 2026.

B1. Your cell and where your data is processed

Customers in Saudi Arabia and the wider Middle East are served from the UAE cell.

Your cell is separate from the other cells. We do not move your organisation's data to another cell, with one exception that is your choice: a customer with organisations in more than one cell may link them, and linking shares summary information (organisation name, feed names, counts and billing figures) between those cells. We do not fail over to another country if your cell is unavailable. Some information about your account is shared with our global systems, described in B2.

B2. What is processed outside your cell

Some information is processed in our global systems, which are not tied to your cell:

• Account and billing information (names, business contact details, orders, invoices) is held in our internal sales, electronic signing, payments, accounting and customer relationship management systems.
• Network and request metadata (IP address, requested address and browser details) is processed by our network provider for every cell. Our network provider also holds the operational logs of requests to the platform. Those logs do not contain images or video.
• Support: support requests are handled inside Sentinel OS, so support tickets, including any personal information in them, are held within the platform and not with a separate ticketing provider. Our help chat uses a third-party AI service and does not receive images or video from your cameras.
• Delivery and communication: email, map tiles and address look-up, and weather data are provided by specialist providers.

The providers for each of these, and the country each uses, are listed in Part B of the Sub-processor List. Our people, including contractors, may access personal information from the countries listed in the Sub-processor List to provide support and engineering.

---

FOR EVERYONE

WHAT PERSONAL INFORMATION DO WE COLLECT?

The information we collect varies with the activity. It may include (as applicable):

• your name, role and organisation;
• your contact information, such as your mobile phone number, email address and business address;
• payment information (processed by our payment provider; we do not store full card details);
• hardware and software configuration, and the products you use;
• your orders and purchases;
• your IP address and device identifiers, and usage and audit logs;
• survey data, if you take part; and
• the images and video captured by cameras your organisation installs, and the camera's location and capture time.

Images and video. Cameras installed at customers' sites capture images and video of those sites. Because sites are workplaces, images may include identifiable people (such as workers, contractors and visitors) and vehicles and number plates. We do not perform facial recognition and we do not create biometric templates.

Special categories. We do not intentionally collect information about race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, health, genetic or biometric information, or criminal convictions. Our customers must not use our platform for facial recognition or biometric analysis.

Our role. For the account information of our customers and their users, and for our website and sales contacts, we are the controller of the personal information. For images, video and other content that a customer's cameras and users put into the platform, the customer decides how it is used and we process it on the customer's behalf as its processor, under the MSA. If you appear in an image captured by a customer's camera and want to exercise a privacy right, please contact the customer first. We will pass on requests we receive and help the customer to respond.

Developing our products. We also use images and video captured by customers' cameras to train, develop and improve our products, including artificial intelligence features. For that use we act on our own account. We de-identify images, or remove or obscure identifiable people, where reasonably practicable, and we never use images to identify anyone or for facial recognition or biometric analysis.

We may combine information we collect from different sources, and we may collect it from your website, public sources, or a third-party account that you connect to ours.

WHAT USAGE INFORMATION DO WE COLLECT?

When you use our products and services, we receive information about your use, such as a hardware ID, IP address, MAC address or other device ID, device use information, and statistics about your use of the products and services. We may collect it while you are offline and receive it when you next connect to the internet. We may monitor usage by automated means to make sure our software and services are used in line with the applicable terms, and we may terminate your licence if you breach them. We collect diagnostic and telemetry data from cameras (such as battery level, signal strength, firmware version and capture success) for support, maintenance and product improvement.

SPECIAL NOTES ABOUT CERTAIN INFORMATION WE COLLECT

Aggregated data. We may collect, use and share aggregated data, such as statistical data, for any purpose. Aggregated data is not personal information in law because it does not directly or indirectly reveal your identity. If we combine aggregated data with personal information so that it can identify you, we treat it as personal information.

Email correspondence. If you email us or use a contact form, we collect your name, email address and anything else in your message. We use it to respond, to provide support, and to send you transactional emails that you need to receive the services. We keep copies for quality control and ongoing support. You can deactivate your account if you do not want transactional emails.

Support requests and support access to accounts. Where you lodge a support request through our platform, your request, including any personal information in it or its attachments, is recorded in our support ticketing system. Separately, you or an administrator of your organisation's account may choose to grant our support personnel temporary access to the account to help resolve that request. That access is optional and is turned off by default; it is limited to the request you lodged; it takes effect only once a member of our support team accepts it, and expires if not accepted; once active it is time-limited and does not extend automatically; it can be revoked at any time; and every access event is logged. While such access is live, our support personnel may view the name, email address and mobile number of users on that account, but cannot change them.

Children. We do not knowingly collect personal information from children under 13 years old (or older, if an applicable law provides for different protections). If we become aware that a child has submitted information to us, we delete it. If we have actual knowledge that the person we are communicating with is under 13, we delete their email address and message immediately after responding.

Job applications. If you submit a résumé, we use it only to evaluate candidates for job postings. A separate policy on the application process will be given on request, and applies in priority to this Privacy Policy.

WHY DO WE STORE YOUR PERSONAL INFORMATION?

We collect information primarily to provide the Online Services and our other services. Reasons include to: create and manage an account; enable you to stay logged in between uses; provide services to you through the Online Services; record data and analytics that let us improve the Online Services; meet our reporting obligations to regulators; properly perform our obligations to you in providing goods or services; and maintain account records, tracing and verification in accordance with our security and verification procedures.

WHEN DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect your personal information when you use the Online Services, when you use our services, and when you interact with us by phone, in writing (including online) or in person. For example, when you create or manage an account, use our website, register for products or events, subscribe to newsletters or alerts, purchase products or services, use "contact us" features, request technical support, or take part in surveys.

WHAT HAPPENS WHEN WE ARE UNABLE TO COLLECT YOUR PERSONAL INFORMATION?

Where we need to collect personal information by law, or under a contract we have with you, and you do not provide it, we may not be able to perform the contract or provide you with products or services. If we have to cancel a product or service because you did not provide required information, we will notify you before doing so. We may still be able to provide some products or services, but your use of some features may be limited.

HOW DO WE STORE AND PROTECT YOUR PERSONAL INFORMATION?

We maintain reasonable safeguards to protect the security, integrity and privacy of information. Information is encrypted in transit using TLS. On Sentinel OS, images and video are encrypted at rest using AES-256, and our databases are encrypted at rest. Access is restricted by role, and access by our support personnel to a customer's account is limited and logged. No system can be 100% secure, and, to the fullest extent permitted by law, we assume no liability for unauthorised access to your information. You are responsible for the strength and confidentiality of your login credentials. We will notify you as soon as reasonably practicable if we have reason to believe there has been a personal information breach by us that could adversely affect your rights and freedoms.

HOW WE USE YOUR PERSONAL INFORMATION

We use personal information to: provide access to our products and services; fulfil product orders; respond to "contact us" requests, questions, comments and technical problems; send you transactional communications; send you promotional materials where you have not told us not to; carry out market research and demographic studies; personalise content; and carry out other business activities where you have, or ought reasonably to have, an expectation that we will process your information for that purpose, including fulfilling our agreements with you.

Service providers. We engage third-party service providers to process personal information on our behalf, including for cloud hosting and storage, identity and authentication, email delivery, customer relationship management, support ticketing, payments, accounting and analytics. These providers act on our documented instructions, are bound by written agreements imposing confidentiality and security obligations no less protective than this policy, and are not permitted to use personal information for their own purposes, including their own marketing. The providers are listed in the Sub-processor List. Our sales team also uses contact-data and artificial intelligence tools to research and prioritise prospective customers. Those tools hold business contact details only and do not receive customers' images, video or account content.

We may share personal information with third parties in connection with an investigation of fraud, intellectual property infringement or other illegal activity, as required by law enforcement or government, or where we believe disclosure is necessary to protect our rights, property, operations or users, to enforce our terms, or to comply with legal process. We may disclose personal information to a successor in connection with a merger, acquisition, reorganisation, insolvency or similar event.

We do not sell your personal information. We may share data with partners in providing the agreed services with your consent, and those partners may use it only for the reasons agreed with us. We may share it with our employees, contractors and service providers to the extent needed to provide services to you; with our business advisers, such as accountants and lawyers; and with any person or body authorised by law.

Marketing use of customers' content. The MSA allows us to use a customer's content for promotional purposes unless the customer switches that off in its account configuration or by written notice. This does not extend to content that identifies, or could reasonably identify, an individual, which we use only with separate express consent.

We may use personal information for secondary purposes closely related to the purposes above where you would reasonably expect it. We will not use your personal information for marketing where you have told us not to, and you can unsubscribe at any time by contacting us or using the "unsubscribe" option in your account or our emails.

HOW YOU CAN ACCESS YOUR PERSONAL INFORMATION

You have the right to access the personal information we hold about you. Contact our Privacy Office (details below). It may take a few days to collate. Subject to applicable law, you may also have the right to: request a copy of your personal information; correct inaccurate or incomplete information; ask us to erase it; ask us to restrict its processing; have it transferred to another organisation; object to certain processing; and complain. Please give your country of residence when you contact us.

HOW LONG DO WE STORE YOUR PERSONAL INFORMATION?

We keep personal information only for as long as we need it for the purposes described in this Privacy Policy, and then delete or de-identify it. Subject to your right to ask us to erase it, and to the legal requirements below:

• Platform accounts. We keep a user's account information while the account is active and as needed to provide or administer our services. If an account is inactive, we keep it for as long as we reasonably expect the user to return, then delete it, including the email address and login credentials, and we will try to notify the user first.
• Customer content. After a customer's contract ends, the customer has 30 days to export its images, video and other content. After that we may delete it, and we delete it if the customer asks us to. Copies may remain in backups for up to 35 days.
• Business contact and relationship records. We keep records of our customers, former customers, prospective customers and partners, including names, business contact details, and the history of our quotes, orders, contracts and correspondence, in our customer relationship management and sales systems. We keep them for as long as we have a business relationship, or a reasonable prospect of one, with the organisation concerned, and we review them at least every three years. Closing a platform account does not delete these records. You can ask us to delete them at any time.
• Financial, contract and tax records. We keep these for as long as the law requires, which is generally seven years.
• Marketing preferences. If you unsubscribe, we keep a record of that so that we can respect it.

We may also keep information for a reasonable period to resolve disputes, enforce our agreements, and for the security, integrity and operation of the Online Services.

DO WE DISCLOSE YOUR PERSONAL INFORMATION OVERSEAS?

We disclose personal information outside the country in which it was collected only where permitted by applicable privacy or data protection laws, and we take steps to keep it safe. We may do so because we use data processors in other countries, we operate globally and employ people in other countries, and some customer data is held in another country, as described in Part A (legacy) and Parts B1 and B2 (Sentinel OS).

The countries to which personal information may be disclosed, and the countries from which our personnel may access it, are listed in the Sub-processor List, for the legacy platform and for each Sentinel OS cell. We transfer personal information only to recipients whose processing is subject to appropriate safeguards, including contractual obligations modelled on international standards. The recipients are third-party data processors (such as cloud service providers) whose services we use to run our business, and other entities in our corporate group with whom we share internal services such as human resources, finance and legal.

COOKIES AND WEB BROWSING

Our website uses cookies and similar technologies. A "cookie" is a small piece of record-keeping information that a website stores on your device, used to identify your browser or device and to remember things about prior visits. You can set your browser to refuse or alert you to cookies, but some features may then not work. We keep log files of IP addresses and device identifiers used to access the Online Services, and these may be linked to your account. We use analytics tools and log files for our own service design, technical support and demographic studies. Our website uses analytics, advertising measurement and remarketing tools and a bot-detection service, which are listed in the Sub-processor List; the Sentinel OS and legacy platforms do not display third-party advertising. Our systems may not respond to "Do Not Track" signals.

UNSOLICITED PHONE CALLS OR EMAILS

We contact existing customers about an existing account or enquiry. We may contact you for marketing where you have given permission. Email from us comes only from addresses ending @photosentinel.com. If you receive an email claiming to be from us from another address, or a suspicious call, please tell us in writing or by phone and do not respond to it.

YOUR RIGHTS BY LOCATION

Australia and New Zealand. You have the rights to access and correct your personal information under the Privacy Act 1988 (Cth) and the Privacy Act 2020 (NZ), and to complain to us and then to the Office of the Australian Information Commissioner or the NZ Privacy Commissioner.

United States, including California and Colorado. Depending on your state, you may have the right to know what personal information we collect and use, to access, correct and delete it, to opt out of its sale or sharing (we do not sell it), and not to be discriminated against for exercising these rights.

United Arab Emirates. Under the PDPL you may have the right to request erasure; to have inaccurate data corrected or completed; to object to decisions made solely by automated means and to obtain human review; to be informed about what is processed and how; to obtain your data in a machine-readable format and have it transferred to another controller; and to restrict, suspend or stop processing.

European Economic Area and United Kingdom. If the GDPR or UK GDPR applies, you may have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to a supervisory authority.

We respond to requests in the same way for residents of every country, as set out in this Privacy Policy.

COMPLAINTS AND THE PRIVACY OFFICE

If you believe we have breached your privacy rights, please contact the Privacy Office:

Privacy Office, 115 Scanlon Drive, Epping VIC 3076, Australia privacy@photosentinel.com

The Privacy Office will investigate and respond. Please give the date and time of the incident or communication, the circumstances and your concerns. If your complaint is about something that is not covered by applicable privacy laws, we will explain why we cannot take further action. Please allow a few days for us to investigate and respond.

End.