EcoBreeze Smart Portal Privacy Notice

How personal information is used in ecobreezesmart.uk

Version 1.0  ·  Effective date: 25 August 2026  ·  Last updated: 25 August 2026

Washroom-Wizard Limited trading as EcoBreeze  ·  Contact: Kathleen Porter, Data Protection Officer  ·  support@ecobreeze.com

Contents

1. About this notice
2. Who we are and how to contact us
3. When EcoBreeze is a controller or processor
4. Who this notice applies to
5. Personal information handled through the Portal
6. Where the information comes from
7. Why we use personal information and our lawful bases
8. Cleaning tags, worker information and the Activity Hub
9. Anonymous visitor counting
10. Who can see information and who we share it with
11. International processing and transfers
12. How long information is kept
13. Security
14. Cookies and browser storage
15. Your data protection rights
16. Complaints
17. Business use, children and changes to this notice
18. Contact details

1. About this notice

This Privacy Notice applies to the EcoBreeze Smart Portal at https://ecobreezesmart.uk, including its account, monitoring, reporting, notification, administration and Activity Hub functions (the "Portal").

It explains how personal information is collected and used by EcoBreeze and how the Portal processes information supplied or controlled by distributors, clients and other customer organisations. It should be read together with any privacy information supplied by the organisation that invited you to use the Portal or that records information about you within it.

This notice is separate from the privacy notices for the public EcoBreeze website, ecommerce activity, commissioning application or any other service that links to a different notice.

This notice is not a contract and does not form part of an employment contract. The Portal Service Agreement and Authorised User Terms govern access to and use of the Portal.

2. Who we are and how to contact us

The Portal is operated by Washroom-Wizard Limited trading as EcoBreeze, company number 06349554. Our business address is Unit 1, Riverside Estate, Sir Thomas Longley Road, Medway City Estate, Rochester, Kent, ME2 4DP.

Our Information Commissioner's Office registration reference is ZB605746.

Our Data Protection Officer is Kathleen Porter. Questions, rights requests and data protection complaints may be sent to support@ecobreeze.com.

3. When EcoBreeze is a controller or processor

Data protection law distinguishes between a controller, which decides why and how personal information is used, and a processor, which uses personal information on a controller's documented instructions.

3.1 EcoBreeze as controller

EcoBreeze generally acts as a controller for information used to create and administer Portal accounts, authenticate users, manage security, maintain audit and technical records, provide customer support, manage the EcoBreeze service, communicate about the Portal, comply with legal obligations and establish or defend legal rights.

3.2 EcoBreeze as processor

A distributor, client or other customer organisation generally acts as controller for information that it chooses to enter, configure or make available through the Portal for its own business purposes. Examples include employee or payroll references, named cleaning-tag assignments, rota and team data, messages, media, customer forms, site contacts and other customer-created content. EcoBreeze processes that information to provide the Portal and follows the customer organisation's lawful instructions, subject to the Service Agreement and applicable law.

3.3 Independent responsibilities

Customer organisations are responsible for deciding who may use the Portal, what information they enter, the roles and permissions they grant, their lawful basis for processing worker information and the privacy information they give to their staff and other affected individuals. EcoBreeze is responsible for its own controller activities and for meeting its obligations as a processor.

4. Who this notice applies to

• EcoBreeze administrators and support personnel who use the Portal for service administration.
• Distributors, client organisations, contractors, engineers and their authorised users.
• Business contacts, site contacts and people who receive alerts, reports, invitations or support communications.
• Cleaners, employees, contractors or other workers whose names, user accounts, employee references, rota details or cleaning-tag activity are added by a customer organisation.
• People who appear in messages, uploaded media, customer forms or other content entered by an authorised user.
• People who contact EcoBreeze about the Portal or make a data protection request or complaint.

Anonymous visitor counts that cannot identify a person are not personal information. This notice nevertheless explains the counting technology so that the distinction is clear.

5. Personal information handled through the Portal

5.1 Account and identity information

• Business email address, first name and last name.
• An optional employee, payroll or internal reference entered by the customer organisation.
• Organisation, company type, company form, user role, additional role, access scope and time zone.
• Invitation, activation and account status information.
• Authentication method, including password login, Microsoft sign-in, Google sign-in and optional two-factor authentication settings.
• Records showing the version of the terms or notices presented and the acceptance or acknowledgement event.

5.2 Organisation, site and service information

• Distributor, client, contractor and engineer relationships and the organisational hierarchy used to control access.
• Site names, codes, regions, divisions, countries, cities, contact details and operational notes.
• Business telephone numbers, contact email addresses and information about users responsible for a site, device or service.
• Device identifiers, installation and connection status, service status, diagnostic information, QR code or job assignment information and related management records.

5.3 Activity Hub and customer-created content

• Messages and associated sender, recipient, organisation and date information.
• Cleaning-session records, rota information, teams and user associations.
• Media, files, images and other material uploaded or shared by authorised users.
• Customer forms and other content made available through beta or future Portal features.
• Permissions and access records showing who can view or manage the content.

5.4 Cleaning tags and cleaning activity

• A cleaning-tag number or identifier.
• An optional link between a tag and a named person or user account, including the period for which an assignment applies.
• The relevant site, zone or device, together with the time and duration of a detected cleaning session.
• Reports, alerts or activity records derived from those sessions.

The tag technology detects Bluetooth proximity to an EcoBreeze device. The Portal does not use the cleaning tag to collect GPS location, audio, photographs, facial images or biometric identifiers.

5.5 Alerts, reports and support

• Portal and email notification preferences, alert thresholds, mute settings and alert history.
• Generated reports and spreadsheet exports, including operational summaries and user-selected filters.
• Support requests, onboarding information, correspondence and records of actions taken to resolve an issue.
• Servicing, troubleshooting and device-health information linked to an organisation, site or authorised user.

5.6 Technical, security and usage information

• Internet Protocol address, browser type, operating system or device information and user-agent details.
• Successful and failed authentication events, account lockout information and security events.
• User-action audit records showing who performed an action and when.
• Application, error, crash, diagnostic and performance logs generated by Azure monitoring services.
• Session cookies, anti-forgery cookies, external sign-in cookies, two-factor cookies and minor user-interface preferences stored in the browser.
• SIM, connectivity and data-consumption information associated with connected EcoBreeze devices.

5.7 Information we do not seek through the standard Portal

The Portal is not designed for payment card information, bank details, National Insurance numbers, medical records, criminal-offence information or other special category information. Customer organisations and users must not upload such information unless EcoBreeze has expressly agreed the use in writing and all legal requirements and safeguards have been addressed.

6. Where the information comes from

• You, when you activate or use an account, choose settings, upload content, send a message, contact support or use an external sign-in provider.
• The distributor, client, employer, contractor or other organisation that invites you, manages your account, assigns roles or enters information about you.
• EcoBreeze devices, cleaning tags, connectivity services and Portal functions that generate operational records.
• Microsoft or Google when you choose their sign-in service.
• Our technology and communications providers when they return delivery, authentication, security, diagnostic or support information.
• Public authorities, professional advisers or other parties where necessary for legal, regulatory or dispute-related purposes.

7. Why we use personal information and our lawful bases

EcoBreeze uses personal information only where there is a lawful reason to do so. The lawful basis may depend on the relationship and the particular information. Where EcoBreeze acts as processor, the customer organisation determines the lawful basis and instructs EcoBreeze through the Service Agreement, Portal configuration and support requests.

7.1 Legitimate interests

Where we rely on legitimate interests, those interests include providing and securing the Portal, fulfilling our commitments to customer organisations, supporting connected devices, maintaining appropriate records and improving service reliability. We consider the necessity of the processing and its effect on individuals. You may object to processing based on legitimate interests as explained in section 15.

7.2 Consent

We do not normally rely on consent for the core Portal service. Choosing Microsoft or Google sign-in, enabling optional two-factor authentication or selecting a user preference does not mean that consent is used as the data protection basis for all related processing. Where consent is specifically required for a separate optional purpose, it will be requested clearly and may be withdrawn.

7.3 Automated decisions

EcoBreeze does not use Portal information to make solely automated decisions about individuals that produce legal or similarly significant effects. Reports, alerts and cleaning records are management aids and any employment or operational decision remains the responsibility of the relevant customer organisation and its authorised decision-makers.

7.4 Sale and advertising

EcoBreeze does not sell Portal personal information and does not use the Portal for behavioural advertising. No advertising or third-party tracking cookies are currently used.

8. Cleaning tags, worker information and the Activity Hub

Customer-controlled worker data. A cleaning-tag number may begin as a pseudonymous identifier. Once a customer links it to a name, user account or employee reference, the Portal can attribute cleaning sessions to that individual. The customer organisation controls whether it makes that link and is responsible for using the information lawfully, fairly and transparently.

Named cleaning-tag assignments, rota information, teams, messages and related Activity Hub records may reveal when and where a person carried out work and for how long. This can amount to worker monitoring. EcoBreeze provides the technical service but does not decide whether a customer should monitor a worker or use the information for performance, attendance, disciplinary or employment purposes.

A customer organisation that uses these functions should, as appropriate:

• identify and document a lawful, necessary and proportionate purpose;
• give workers clear privacy information before using named tracking or monitoring;
• consider and document whether a data protection impact assessment is required;
• limit access to people who genuinely need it and review permissions regularly;
• avoid using the information as the sole basis for an employment decision;
• check accuracy and allow the worker to explain or challenge a record; and
• apply its own appropriate retention, deletion and rights-handling processes.

Users should avoid including sensitive or excessive personal information in messages, media, rota entries, forms or free-text fields. EcoBreeze administrators may access customer content where reasonably necessary to provide support, maintain security, investigate misuse or comply with law, subject to access controls and confidentiality obligations.

9. Anonymous visitor counting

EcoBreeze devices use passive infrared sensing to count movement or visits for operational reporting. The visitor-counting function does not capture photographs, video, audio, facial images, biometric templates, mobile-device identifiers or the identity of individual visitors. The Portal receives numerical counts and related site or time information.

EcoBreeze does not attempt to identify a visitor from those counts. If a customer combines a count with other information from a separate system, the customer is responsible for that separate processing and for providing any required privacy information.

10. Who can see information and who we share it with

10.1 Portal hierarchy and permissions

Portal access is role based. A distributor may create and administer its own clients, sites and users. A client may create and administer its own users. The hierarchy and the permissions assigned by an organisation determine what an authorised user can see or change. EcoBreeze administrators can access information across the Portal where required for administration, support, security, servicing, troubleshooting, legal compliance or enforcement of the terms.

Customer organisations are responsible for granting appropriate permissions and removing or changing access when a person changes role or leaves the organisation.

10.2 Service providers

Providers are permitted to use personal information only for the relevant service and under contractual, confidentiality and security controls. Some device and connectivity information may not identify an individual, but the same safeguards are applied where it constitutes personal information.

11. International processing and transfers

The main operational Portal application, SQL databases, database backups, uploaded files and Power BI capacity are hosted in Microsoft Azure UK South. The notification service runs in UK West. Limited notification-service telemetry and diagnostic information is processed in Canada Central. Historic legacy data, rather than current operational Portal data, may remain in Microsoft Azure storage in East US.

Microsoft personnel may access information from outside the United Kingdom for support or operational purposes. EcoBreeze personnel are UK based but may access the Portal while working temporarily abroad. Authorised customer users may also access the Portal from other countries. Other providers, including sign-in, email delivery, IoT and connectivity providers, may use infrastructure or support locations outside the United Kingdom.

Where a restricted transfer is made, EcoBreeze uses a transfer mechanism permitted by UK data protection law. Depending on the destination and provider, this may include United Kingdom adequacy regulations, the United Kingdom International Data Transfer Agreement, the United Kingdom Addendum to approved standard contractual clauses or another legally recognised safeguard. We also use contractual, access-control, encryption and data-minimisation measures appropriate to the service.

You may contact the Data Protection Officer for further information about the safeguards relevant to a particular transfer. Commercially sensitive security details or documents relating to other customers may be withheld or summarised where appropriate.

12. How long information is kept

We retain personal information only for as long as it is reasonably required for the purpose for which it is used. The applicable period depends on the nature and sensitivity of the information, whether the Portal relationship remains active, customer instructions, operational and security needs, legal and regulatory requirements, the need to resolve disputes or defend claims, and whether the information can be anonymised.

Customer-controlled information may be deleted, returned or anonymised in response to an authorised instruction, account closure or the end of the relevant service, subject to applicable law, legitimate record-keeping requirements and the technical operation of protected backup and recovery systems.

Items deleted through the Portal may first be placed in a soft-deleted state and cease to be visible in normal use. Some copies may remain in protected live, audit, diagnostic or backup systems until they are securely removed or anonymised through the relevant operational, legal and technical processes. Such residual information is not used for unrelated purposes.

Audit, security, acceptance, complaint and legal records may be retained where necessary to demonstrate accountability, protect the Portal, investigate misuse, comply with law or establish, exercise or defend legal rights. We review retention requirements and delete or anonymise information when it is no longer reasonably needed.

13. Security

EcoBreeze uses technical and organisational safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:

• HTTPS/TLS encryption for data in transit;
• Azure database and storage encryption for data at rest, including backups;
• salted and iterated PBKDF2 password hashing through ASP.NET Identity;
• role-based access, granular permission claims and per-user access restrictions;
• optional authenticator-app two-factor authentication;
• user-action audit records and technical logging;
• Azure SQL point-in-time backups supplemented by manual backup processes; and
• access controls and confidentiality obligations for personnel and providers.

No online service can be guaranteed completely secure. Users must keep credentials confidential, use a strong unique password, enable two-factor authentication where appropriate and notify EcoBreeze or their organisation immediately if they suspect unauthorised access.

14. Cookies and browser storage

The Portal uses only authentication, security, session and limited preference technologies. It does not currently use analytics, advertising or behavioural tracking cookies. The following items may be placed on or accessed from a user's browser:

These technologies are used because they are necessary to provide the requested login, security and preference functions. A user may remove them through browser settings, but blocking necessary technologies may prevent the Portal from working properly. This notice will be updated and consent mechanisms introduced where required before non-essential analytics, advertising or tracking technologies are used.

15. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

• ask for confirmation that your personal information is being used and obtain a copy;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be deleted where there is no lawful reason to retain it;
• ask for processing to be restricted in certain circumstances;
• object to processing based on legitimate interests;
• receive information you provided in a structured, commonly used and machine-readable format where the portability right applies;
• withdraw consent where a specific processing activity relies on consent, without affecting earlier lawful processing;
• ask for human involvement and challenge a solely automated decision where the relevant legal right applies; and
• make a data protection complaint to EcoBreeze and to the Information Commissioner's Office.

To exercise a right concerning EcoBreeze's own controller activities, contact support@ecobreeze.com. We may need reasonable information to confirm identity and locate the relevant records. We will respond within the period required by applicable law.

Where the information is controlled by your employer, distributor, client or another customer organisation, you should normally contact that organisation first. EcoBreeze will assist it with a valid request in accordance with the Data Processing Schedule. We may redirect a request where the customer organisation is best placed to decide it.

Rights are not absolute. A request may be limited or refused where the law permits, for example to protect another person's rights, preserve legal privilege or comply with a legal obligation. We will explain the relevant reason where required.

16. Complaints

You can make a data protection complaint by writing to the Data Protection Officer at support@ecobreeze.com or the postal address in section 2. Please describe the concern, the Portal account or organisation involved and the outcome you are seeking. We will acknowledge, investigate, keep you appropriately informed and communicate the outcome in accordance with applicable law.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom supervisory authority. Information about making a complaint is available at ico.org.uk. We encourage you to contact us first so that we have an opportunity to address the issue.

17. Business use, children and changes to this notice

17.1 Business users only

The Portal is invitation only and intended for use in a business or professional capacity. It is not directed to consumers or children, and EcoBreeze does not knowingly invite children to create Portal accounts. Customer organisations must not create accounts for children or use the Portal to collect children's information unless expressly agreed in writing and lawfully configured for that purpose.

17.2 External links and sign-in providers

The Portal may link to another service or allow Microsoft or Google sign-in. Those providers process information under their own terms and privacy notices for their independent activities. EcoBreeze is not responsible for the content or privacy practices of an unrelated external website.

17.3 Changes

We may update this notice to reflect changes in law, Portal features, providers, locations or business practices. The current version will be made available through the Portal. We will bring material changes to users' attention in an appropriate way, such as an in-Portal notice, email or renewed acknowledgement.

18. Contact details