Visitor privacy notice

1. Who is responsible

The organisation that invited you (the "host organisation") is responsible for your data. It decides why and how it uses it. Lemorange Ltd, a company registered in Cyprus and based in Nicosia, runs the Attendance service for it and processes your data on its instructions. Lemorange Ltd is the processor.

If you want to know who the host organisation is, check your invite or your pass page.

2. What data we hold

• your name, email address, telephone number and company, as your host entered them;
• the name of your host;
• the planned and actual times of your visit;
• a pass token, which is a random code in your link;
• the entry and exit log for the visit.

If you use a kiosk at reception, the kiosk may record that you signed in. If the host organisation has a camera or an intercom at the entrance, it will put up a notice.

3. Why we use it

• to send you the invite and your pass;
• to let reception and security know you are expected;
• to tell your host that you have arrived. This may be done by WhatsApp, if the host organisation has turned this on;
• to keep a record of who was on site, for site security and for safety in an emergency.

We do not use your data for marketing and we do not sell it.

4. Who sees it

Your host and the host organisation's authorised staff, such as reception and security. Lemorange Ltd and its sub-processors handle data to run the service: hosting, email, messages and push notifications. The list is at attendance.cy/sub-processors. We do not sell personal data.

5. How long we keep it

The host organisation decides the actual retention period for a supplied visitor register or pass. Ask the host for its period and deletion process.

The retention and deletion of a standalone visitor register or kiosk are set by the host organisation. Intercom still images are kept for 30 days by default (the host can set 1 to 365 days); call metadata has a separate schedule. Ask the host organisation for its actual period and any legal hold.

6. Your rights

You can ask the host organisation for access, correction, erasure, restriction or portability of your data, and you can object to the use of your data.

Deleting your data. Ask the host organisation that invited you to export or delete your record; its managers can do this.

If you write to Lemorange Ltd at support@lemorange.com, we will pass your request to the host organisation without delay.

Some information may need to be kept in a form that does not identify you, for example a count of visits, or longer if the law requires it.

7. Complaints

You can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (https://www.dataprotection.gov.cy/) or to the authority in the country where you live or work.

8. More information

Read the Privacy Notice for Lemorange Attendance at attendance.cy/privacy.

9. Intercom and feature scope

An intercom call may collect the room or floor entered, a still image, time, answer and door-opening outcome. Authorised call recipients and scoped log readers may see those records. For live audio or video, gateway buffers, any recording and the relay provider, ask the host or write to support@lemorange.com. The host must give notice before camera capture.

A separate visitor register and kiosk are not part of the standard intercom service. If one is supplied, the host must explain actual fields, recipients, shared-screen clearing, purpose and retention before use. A presence record is not proof that everyone is safe in an emergency.