Apple App Store

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us in relation to the Blackout Platform only. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it in relation to the Blackout Platform. For how we deal with your personal data in other contexts, please contact us at [info@blackout-technologies.com] . By using the Blackout Platform, you are accepting the practices described in this policy

We may collect and use the following information about you:

• Information you give us. You may give us information about you by using the Platform or by corresponding with us by e-mail or otherwise. For end users of the app, this is limited to the details your organisation registers you with — typically your name and your work or school email address. If you contact us directly, or you are an administrator at a customer organisation, we may also hold the business contact details you choose to give us.
• Information we collect about you. We automatically collect certain data from you, including your IP address or other unique device identifiers, mobile carrier, time zone setting, operating system and platform and information regarding your use of the Platform.
• Location data (fleet and office installations only — not collected in schools). Where enabled for fleet or office deployments, we use location to determine whether you are within a configured zone, using signals such as IP-based derivation, geo-fencing and, where necessary, the device's GPS. In school deployments location is switched off and we do not collect location data at all.
• Information from third parties. We may receive information about you from your institution (our customer) when you use our Platform, and from the service providers and sub-processors we use to deliver and secure the Platform. We do not receive information about you from advertising networks, and we do not sell personal data or share it for third-party marketing.

The nature of the Platform means that we need to be able to process sensitive data. The Platform may request certain permissions that allow it to access your data as described below.

Please note that the revoking of such permissions might impact the proper functioning of the Platform.

• Location & Bluetooth (fleet and office installations only — not applicable to schools). Used to determine whether a device is inside a configured zone, such as a geofence, a Bluetooth beacon area, or a designated Wi-Fi network. This establishes which zone a device is in rather than storing precise coordinates, and we do not track your location in real time. In school deployments these permissions are not requested at all, so Blackout cannot access location or Bluetooth data in schools.
• Screen Time Permission: We use Apple's Screen Time API to block apps and disconnect distractions. We don't gather data about which apps you use, how long you use them, or what you do inside them. We do count how often the blocking screen has been shown, which is not linked to any particular app.
• VPN / Content Filtering: As a backstop to Screen Time, network traffic is routed through a secure proxy that Blackout operates on its own infrastructure and is filtered by approved domain only (currently limited to Blackout, Apple and Safe365); all other traffic is blocked during restricted periods. We do not inspect the content of your traffic and we do not log or retain your browsing activity. Traffic is encrypted in transit.
• Notifications: Used by administrators to send reminders and nudges, and to support future safeguarding prompts. This permission is outbound only and does not collect data about you.

By granting any of the permissions listed, you agree that the respective Personal Data may be processed (i.e., accessed to, modified or removed) by the Platform.

For a plain-language summary of every permission we request and why, see our App Permissions page.

We will only use your personal data when data protection law allows us to. We will use your information in the following ways:

• As it is in our legitimate interests to ensure the proper functioning of our organisation, our staff's productivity and the security of our organisation's confidential information, we may use your information to:
• • disable certain features (including the camera and certain applications) of your personal device within certain prescribed areas during the course of your employment;
  • notify you about changes to the Platform's service;
  • allow Blackout to provide you with user support;
  • enforce our and Blackout's terms, conditions and policies; and
  • communicate with you.

We may share your personal data with selected third parties in or outside your country, including our suppliers and subcontractors who help us run the Platform.

We may share your information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, in each case in or outside your country, for the purposes set out above (“how we use your personal data”).

We may share your information with law enforcement agencies, public authorities or other organisations if legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

• comply with legal obligation, process or request;
• enforce our terms of service and other agreements, policies, and standards, including investigation of any potential violation thereof;
• detect, prevent or otherwise address security, fraud or technical issues; or
• protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law (including exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction). We may also disclose your information to third parties:
• in the event that we sell or buy any business or assets, in which case we may disclose your data to the prospective seller or buyer of such business or assets; or
• if we sell, buy, merge or partner with other companies or businesses, or sell some or all of our assets. In such transactions, user information may be among the transferred assets.

The information that we collect from you may be transferred to, and stored at, a destination outside of your country and the European Economic Area ("EEA"). It may also be processed by staff operating outside your country or the EEA who work for us, for one of our suppliers or one of our business partners. By submitting your information, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your information is treated securely and in accordance with this policy.

Please contact us at: [info@blackout-technologies.com] . if you want further information on the specific mechanism used by us when transferring your personal data out of your country or the EEA.

• Data rights. In certain circumstances, you have the right to access a copy of the personal data we hold about you, to rectify any personal data held about you that is inaccurate, to receive a copy of the personal data we hold about you in a structured, commonly used and machine-readable format, and to request the deletion of personal data held about you. You can exercise your rights by contacting us at [info@blackout-technologies.com].
• Consent. You also have the right to withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. If you wish to withdraw consent, please contact us at [info@blackout-technologies.com].
• Complaints. In the event that you wish to make a complaint about how we process your personal data, please contact us in the first instance at [info@blackout-technologies.com] and we will endeavour to deal with your request as soon as possible. This is without prejudice to your right to launch a claim with your data protection authority. You also have the right to make a complaint at any time to your local authority. In the United Kingdom, this is the Information Commissioner's Office (ICO). The ICO's website can be found at: [https://ico.org.uk].

Questions, comments and requests regarding this policy are welcomed and should be addressed to [info@blackout-technologies.com].