Legal

Privacy policy

We collect as little personal information as we can and still run two secure buildings. This policy explains what we collect, why, how long we keep it and what you can ask us to do.

This website

This website sets no cookies, runs no analytics and loads nothing from any other company. Our hosting provider keeps routine logs of requests, including the address they came from, for a short time for security. If you use the tour request form, we use what you give us only to arrange your visit, and delete it twelve months later if you do not become a customer.

Our buildings

When you visit SEC1 or NWK1 we record your name, your company, the photo ID you showed (its type and the last four characters of its number, not a copy), the times you entered and left each controlled area, and, if you are enrolled for regular access, a template of your palm vein pattern. The template cannot be turned back into an image of your hand. We record video in shared spaces and keep it for 90 days.

We use this information to keep the buildings secure, to meet our obligations to customers and auditors, and to investigate incidents. Access records are kept for seven years, because our customers’ auditors ask for them; palm templates are deleted within 30 days of your access ending.

Customers and the portal

For customers, we keep the names and business contact details of the people on their accounts, their access lists, their tickets and their invoices, for as long as the account is open and seven years afterwards. We do not look at the data on customers’ equipment, and we have no means of doing so.

Who we share it with

We share personal information with the customer on whose behalf you visit or act; with our auditors, under confidentiality; with service providers who work for us, under contract; and with law enforcement when the law requires it. We tell customers about law enforcement requests for their information unless the law forbids it. We do not sell personal information.

Your rights

Depending on where you live, laws such as the GDPR or the privacy laws of U.S. states may give you the right to see the personal information we hold about you, correct it, delete it or object to our using it. Write to privacy@cordgrassdata.com and we will reply within 30 days. If you are not satisfied with our answer, you may complain to your local data protection authority.

Who we are

Cordgrass Data LLC, 615 Sedgebank Road, Secaucus, NJ 07094, is responsible for this information. Telephone +1 201 016 2730.