FacilityOps provides operational logging, records and alerts generated from a customer's existing CCTV. This policy explains how personal data is handled. It is written to align with Jordan's Personal Data Protection Law (PDPL) and equivalent regimes.
The customer (the organization deploying FacilityOps on its premises and cameras) is the data controller. FacilityOps acts as a processor, processing data only on the customer's instructions and infrastructure. The customer is responsible for establishing a lawful basis, providing employee/visitor notice, and obtaining any required consent.
Camera footage remains on the customer's own network. FacilityOps does not sell personal data or use it for advertising.
FacilityOps produces records and alerts only. It does not make employment, pay, access or disciplinary decisions — those are made by the customer's team.
Retention periods, data residency and access controls are configured and owned by the customer. Records are exportable and deletable at the customer's direction.
Individuals may exercise rights (access, correction, deletion, objection) through the customer organization, which manages the records. Requests reaching FacilityOps are referred to the relevant customer controller.
Processing runs on the customer's infrastructure; remote management interfaces are protected by access controls and encryption in transit (HTTPS). Customers are responsible for securing their own network and cameras.
Questions about this policy: contact us.