Privacy Policy

‍Blackout Technologies Limited (a company registered with company number 10437246 and located at 6^th Floor Capital Tower, 91 Waterloo Road, London SE1 8RT) are committed to protecting and respecting your privacy.  This policy (together with our frequently asked questions web-page https://www.blackout-technologies.com/faqs sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Capitalised terms not defined in this Privacy Policy shall have the meaning given to them in:
1. in the General Data Protection Regulation (EU) 2016/679 (the “EU GDPR”) or
2. the retained version of the EU GDPR in the UK as this has been established by European Union (Withdrawal) Act 2018 and amended by the Data (Use and Access) Act 2025 (“UK GDPR”).

By visiting https://www.blackout-technologies.com/ (our site) you are accepting and consenting to the practices described in this policy. For the purpose of UK GDPR, we are the data controller of the personal data owned and generated by us. However, for the purposes of the Blackout App and our customers’ use of our products and services for their students, fleet and any other end-users, we are strictly a data processor, acting under written instructions and contracts with those institutions.

Blackout is committed to protecting the security of your personal information and we take all reasonable precautions to protect it from unauthorised access, modification or disclosure. Your personal information is stored on secure servers, and data transferred between you and our services is encrypted where appropriate.

We will collect and process the following data about you: 

‍Information you give us and Device Permissions. This is information about you that you give us when using our products or services, use the Blackout App or by filling in forms on our site or by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you contact us, or give us certain permissions, request a demo, ask for support, register a device or user (where applicable), or otherwise engage with our services. The information you give us may include your name, email address, fleet/transport company details, college/school details and any information you choose to provide in your message. Depending on your organisation’s configuration and the type of device you use, the Blackout App may request certain operating-system permissions. On iOS this may include Screen Time, VPN/content filtering, and notifications, and — for fleet and office installations only — Bluetooth and location. On Android this may include usage access, VPN, display-over-other-apps (overlay), Do Not Disturb access, notifications, and an exception to battery optimisation, and — for fleet and office installations only — Bluetooth and location. The VPN permission works differently on each platform: on iOS it routes traffic through a Blackout-operated proxy that filters by approved domain only (see the security section below), while on Android it operates entirely on the device and routes nothing off it. We use these permissions solely to deliver the blocking and controlled-zone functionality and do not use them to access the content of your messages, photos, emails or other apps.

‍Information we collect. When using the Blackout App, our other services and when visiting our website, we may collect the following information:
·       technical information, including Internet protocol (IP) address, browser type and version, language preference, time zone setting, operating system, device type and identifiers, app version (where applicable), and (where available) the referring website address; and
·       usage and event information, including date and time of access/each visitor request, pages visited (for the website), and (for the Blackout App) device state and event logs such as registration status, permissions accepted/denied, app enabled/disabled status, content blocking state and time stamped records of changes to that state. Where relevant to performance and support, we may also collect battery level. We may also compile this information into aggregated statistics (for example, trends in the usage of our website), and those aggregated statistics will not identify you.
·       Location data may be collected in fleet/transport/office use cases where it is most useful to those customers, but for schools we utilise a schedule-only approach. Where location permissions are not required for the configured education deployment, we do not request them, ensuring we cannot access location data for that use case.
· In typical education deployments, therefore the collected data is limited to a small set of details such as User’s name, school email, year group/form group, device information (model, operating system and OS version, and the app version), a push notification token used to deliver device instructions, and the Blackout App's status (for example whether it is enabled/disabled and what permissions were accepted/denied).
· Across fleet, education and all uses of the Blackout App, we maintain time stamped event records of changes to device state and, within a controlled zone, limited performance data such as battery level and the number of times the blocking screen has been shown. That figure is a simple count and is not linked to any particular app.
·       We do not collect data such as your location (in education deployments), browsing history, contacts, what other apps you use, or details like your birthday and address.

‍Information we receive from other sources. This is information we receive about you from third parties. We may work with third parties such as business partners, service providers and sub-contractors in technical and delivery services, analytics and search information providers, and providers of anti-spam/security services (such as reCAPTCHA).

‍Sensitive Data.  We do not intentionally collect or process special category data (such as health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, or data concerning sex life or sexual orientation) through our website or app.

‍Information about other individuals. If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her behalf and has agreed that you can: give consent on his/her behalf to the processing of his/her personal data; receive on his/her behalf any data protection notices; and give consent to the transfer of his/her personal as contemplated in this privacy policy.

For a plain-language summary of every permission we request and why, see our App Permissions page.

Blackout Technologies uses cookies (small data files stored on your device) to improve functionality, remember your preferences, manage accounts and logins, and enhance user experience. Disabling cookies may limit how the site works. We also use Google’s Invisible reCAPTCHA to prevent spam and abuse, which may collect technical and behavioural data (e.g. IP address, device info, user activity) and share it with Google under its privacy policy. This processing is based on legitimate interests in site security. For more detail, we have a separate Cookies Policy available on our website here: https://www.blackout-technologies.com/legal/cookie-policy

There are six potential lawful bases for processing personal data under data protection law. Which lawful basis applies will depend on the context and your relationship with us (for example, whether you are a website visitor, an educational establishment, a fleet company, a driver, a student, or other kind of administrator or end user of the Blackout App provided by your organisation). Where we process personal data as a processor on behalf of a customer (such as a school or employer), our customer is the controller and will need to confirm the lawful basis for that particular processing. Our primary lawful bases for different kinds of data processing are captured in the table below:

We may use your contact details to send you information about App updates, new services or other features that may interest you, either directly or via selected third parties. Where required, we will obtain your consent. For schools, other educational establishments or corporates, we may rely on legitimate interests, and you can object at any time.

You have the right to object to or restrict direct marketing. See the “Your Rights” section for details on how to exercise this.

When assessing objections, we consider factors such as reasonable expectations, impacts on all parties, and whether less intrusive alternatives are available. If your objection is upheld, we will stop processing your data unless there are compelling legal grounds.

If you have consented to marketing and later change your mind, you can opt out at any time using the unsubscribe link in communications or by contacting us.

We will also give you the option to opt out of your personal data being shared with third parties or used for new purposes.

It is important to state that Blackout is designed to provide only the information needed to enable effective blocking in a controlled zone/period. We do not access or disclose what apps are installed on your device, nor what you do while using your device.  Furthermore, we do not track your browsing activity or record the content of your online use.

Access to your personal data shall always be limited and protected at law.   Access is limited to authorised administrators at your organisation (for example, approved school staff) and Blackout administrators only where support/training is requested. We act primarily as a processor (as defined in UK GDPR) and do not access customer data unless instructed by the customer. All access is audited.

We use a limited number of sub-processors to provide the service. These are currently limited to providers such as Google Cloud services (including Firebase) and Amazon Web Services (including hosting in Dublin), and our app development is conducted in the UK. We use different tools such as Airbyte for internal operational tasks. We do not sell personal data and do not share it with third parties for their own marketing purposes.

We may have to disclose small amounts of personal information:
•  If Blackout Technologies Limited is bought or sold in which case some personal data mainly connected to the contracts with schools and transport /logistics customers may need to be disclosed in a very closed protected environment or data room.
•  If we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

By submitting your personal data to us, you agree to the transfer, storing and processing of your data by us or on our behalf as described in this policy. Where we transfer personal information internationally (which can happen when we use Google or Amazon services and/or their data centres), we will take steps to ensure that your information is treated securely and in accordance with this privacy policy and applicable data protection laws and regulations.

Our core personal data is stored in the EU (AWS, Dublin). Some operational components — such as push notifications and crash reporting (via Google/Firebase) and AWS's global service-operations infrastructure — may involve limited transfers to the United States, protected by appropriate safeguards such as EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

On iOS, the app routes network traffic in transit through a Blackout-operated filtering proxy hosted within our own environment (AWS, Dublin), the same environment as the rest of our infrastructure. This traffic is filtered by approved domain only and is not logged or retained, and it is not shared with any third party.

Blackout Technologies Limited is committed to protecting the confidentiality, integrity and accuracy of your personal data. We maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.  We also recognise we live in an era of rapid technological advancement, and we commit to keeping pace with change and best practice in IT security.

Part of this vigilance will be to continually review where machine learning and the use of large language models adds value and security to our products and services.  We have no immediate need to deploy any form of artificial intelligence into our App but will always look for economies and enhancements in the running of our internal operations where new and modern tools can assist (in our software development, customer support functions, compliance and marketing functions for example).

No personal data shall be used to train, test and deploy AI/ML models however we reserve the right to use anonymised, aggregated or internal operational data to further our legitimate interests in continuously improving our services. Key components of our data security measures include

1. Information security governance: we maintain and periodically review our information security controls and supplier due diligence, applying a risk-based approach consistent with Article 32 UK GDPR (security of processing).
2. Access controls and training: access to systems and personal data is restricted to authorised personnel on a need-to-know basis, and we provide appropriate training and guidance to staff who handle personal data.
3. Password and username controls that are unique to you (including two-factor authentication and Single Sign On options). Where an integration requires credentials for a customer's own system — for example a MyGeotab service account — those credentials are encrypted and held in AWS's managed secrets storage, accessible only to the service that needs them. Credentials belonging to an individual administrator are used once during setup and are not retained.
4. Data Protection Impact Assessments (DPIAs): where required, we have worked with schools in the past to assess and mitigate privacy risks in a documented way, before introducing our technology into their educational environments.  We have developed a standard templated approach to the data protection impacts which flow from our technology which we are happy to share with all customers.
5. Data breach preparedness: in the event of a personal data breach, we maintain an incident response process and follow a risk-based approach to breach notification in accordance with ICO guidance and reporting timelines.
6. Diagnostics and penetration testing exercises (regularly facilitated by an independent 3rd party expert to ensure our perimeters and production environments are secure).
7. VPN / content filtering, used to manage which apps and websites are accessible during blocked times (such as school hours). On iOS, network traffic is routed through a secure proxy that Blackout operates on its own infrastructure and is filtered by approved domain only — we do not inspect the content of your traffic and we do not log or retain your browsing activity. On Android, this operates entirely on the device and routes nothing off it. This is a standard method used by safeguarding and wellbeing tools and does not track browsing activity or the content of online use.
8. Personal data is stored on secure servers.
9. We use data processing agreements and addenda where required.
10. No credit card data is stored by us.

Post-Retention Anonymisation: Data that is no longer necessary for regulatory or contractual purposes, but is valuable for refining our products or applications or developing new tools or ways of working may be subject to anonymisation. Once anonymised, this data no longer constitutes personal data under the UK GDPR and may be retained indefinitely for statistical and research purposes.

We only keep your information for so long as it is necessary to fulfil the purpose for which it was collected.

We use the following criteria to determine whether or not we need to keep your data:
• fulfilment of a contract with your institution or company,
• if you or we close your customer account,
• if you unsubscribe from direct marketing, newsletter or other material which we send to you,
• if we are required to keep a copy of your data by law or statutory regulation.

Ephemeral data, such as logs, soft deleted items, and closed events are deleted after 90 days.

You also have the ability to request that we delete your personal data at any time. See the section below on ‘Your Rights’.

Information that is archived is anonymised and kept for statistical analysis and research purposes.

Right to ask us to stop contacting you with direct marketing. Even if you have accepted the processing of your personal data for marketing purposes (by ticking the relevant box), you have the right to ask us to stop processing your personal data for such purposes. Let us know what method of contact you are not happy with if you are unhappy with certain ways of contacting you only (for example, you may be happy for us to contact you by email but not by telephone).

Right to request a copy of your information. You can request a copy of your information which we hold (this is known as a subject access request). If you would like a copy of some or it, please contact us and let us know the information you want a copy of, including any account or reference numbers, if you have them. Any subject access request may be subject to a reasonable fee to cover the cost of providing you with details of the information we hold about you.

Right to correct any mistakes in your information. You can require us to correct any mistakes in your information which we hold free of charge. If you would like to do this, please contact us and let us know the information that is incorrect and the information you want it replaced with.

Right to request we cease processing your information. You may request that we cease processing your personal data.  If you make such a request, we shall retain only the amount of personal data pertaining you that is necessary to ensure that no further processing of your personal data takes place.

Right to request deletion of your information.  We can delete or provide personal data on request, subject to our legal and contractual obligations and whether the data remains necessary to provide the service (for example, where a user is still active). Unless we have reasonable grounds to refuse to erase your personal data, all requests for erasure shall be complied with.

We may change this Privacy Policy from time to time, in our sole discretion. Most changes are likely to be minor. Please check back frequently to see any updates or changes. Your continued use of our website after any change in this Privacy Policy will constitute your acceptance of such change.

If you have any questions about this Privacy Policy, please contact our data protection lead officer Dr David Taylor via email at Privacy@blackout-technologies.com or via our Contact page on our website.

If you have any complaints about the way in which we collect, store and use your information, please write to us first, where we will strive to resolve the issue in every case.  Only where these have not been addressed by contacting us first, you can contact the supervisory authority in the United Kingdom, the Information Commissioner’s Office: https://ico.org.uk/concerns/

Our website may contain links to external sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy and terms and conditions of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites, products or services.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.