Vega ACMS Privacy Policy
Version of November 1, 2026.
1. The short version
- Vega ACMS is a building access control service. It runs the Vega ACMS panel at acms.cloud and the Vega Pass and Vega Access mobile apps.
- It records who has which fob or card and who opened which door, and when. That can reveal a person's habits, so we treat it with care.
- Your building manager usually decides what is collected and why. We provide the system and follow their instructions.
- We do not process camera footage.
- We keep door opening records for exactly 365 days (one year). Any change to this period is agreed separately with the Customer.
- You can ask to see or correct your information. Start with your building manager, or contact us (section 4).
2. Who we are
Vega ACMS is operated by Vega Security. In this policy, "we" means Vega Security.
Some buildings use the service under their manager's own brand. This policy still applies.
3. Who is responsible for your information
Your building manager. The manager, owner, syndicate or other organization that runs your building decides which people and doors are in the system. It is responsible for that information and answers to you for it. We call this organization the "Customer".
Us, as service provider. We hold and process that information on the Customer's behalf and under a written contract. We use it only to provide the service.
Us, in our own right. We are responsible for the information we collect for our own purposes:
- website visitors and people who contact our sales team;
- Customer contacts and billing records;
- security records of the service itself, such as sign-in events.
The roles above are the usual case. If a contract sets them differently, tell us and we will explain how it affects you.
4. Our person in charge of privacy
You can reach our person in charge of the protection of personal information, and ask any other privacy question, through the contact form on our website.
5. What we collect
| Information | About whom | Comes from | Why |
|---|---|---|---|
| Name, email, phone, unit | Tenants | Building manager | Identify the person, send invitations and sign-in codes, link doors to a unit |
| Fob or card number (chip number and printed number), type, validity dates, status | Tenants, staff | Building manager, supplier list, or a tap on a reader | Decide whether a door opens |
| PIN codes and mobile keys | Tenants, guests, staff | Building manager, the app | Same |
| Door events: door, credential or person, method, time, success or refusal and the reason | Anyone using a door | The locks, door controllers and apps | History for the building, security, investigating incidents |
| Staff accounts: name, email, role, permissions, password in hashed form, two-factor settings | Staff, installers, Customer contacts | Customer, the person | Sign-in and limiting access |
| Sign-in events: time, IP address, device or browser, result | All account holders | Automatic | Security, investigating misuse |
| Email sign-in codes and a record of email sent (recipient, type, time, result) | All account holders | Automatic | Sign-in, proof of delivery |
| Administrative actions: who issued, blocked or restored a card, opened a door remotely or changed a setting, and when | Staff and any person concerned | Automatic | Audit trail |
| App and device data: notification token, language, app and device details | App users | Your phone | Run the app, send door notifications |
| Distance from the building when you open a door remotely (see section 6) | Vega Pass users, where the building requires it | Your phone | Check you are nearby |
| Name, email, company, phone, message and portfolio details | People who contact us | You | Reply to you, prepare a quote |
| Website technical data | Website visitors | Automatic | Run and protect the site |
If your building manager links a garage remote or long-range tag to a vehicle, we also hold that vehicle's plate, colour, make and model, the unit and parking spot it is for, and the dates it occupied that spot. If your building manager records drivers for a vehicle, we also hold each driver's name, phone number and email address, and use them to send the parking notices the manager writes.
Tenant history. For each building, we keep the steps recorded on a tenant's file there, such as move-in, move-out, disabling or archiving, and the history of their fobs in that building, with dates. The building manager's authorized staff use it to see what happened to a person's access.
Vehicle history. We keep a history of each vehicle: what changed on it and when, and its parking spots and dates. It stays when the vehicle is archived, until the vehicle is permanently deleted.
Plate recognition. Automatic plate recognition is planned and is not active: nothing in Vega ACMS reads plates from a camera today. We would update this policy, as section 15 describes, before using it.
Entries, not exits. We record who opened a door. We do not track when a person leaves.
What we do not collect.
- Camera footage. Vega ACMS does not process it, even if the building has cameras.
- Biometrics. Vega ACMS does not collect or store fingerprints, faces or other biometric data.
6. Phone features: Bluetooth, location, app lock, notifications
You control these in your phone's settings. Turning one off may limit the app, but does not affect your fob or card.
- Bluetooth. Vega Pass uses it to open a door when you are next to it. Vega Access uses it to pair, test and service locks and gateways.
- Location (optional gate). A building may require you to be nearby to open a door remotely. Only then, Vega Pass asks for your location, while you are using the app, at the moment you open. The server uses it to work out your distance from the building. It does not store your coordinates; the audit record keeps the distance. We do not track your location. If you refuse, you can still open with Bluetooth at the door or with your fob. Vega Access uses location only while a lock or gateway is being set up nearby.
- Face or fingerprint app lock. You can lock the app with your phone's own unlock. Your phone does the check. We never receive your face or fingerprint data.
- Notifications. If you allow them, we send door and account notices through the phone's notification service.
7. How we use information, and consent
We use the information to:
- operate doors and credentials as the Customer has set them;
- show history to people authorized to see it;
- sign people in and protect accounts;
- send service messages;
- investigate security incidents and fix problems;
- meet legal duties.
We collect only what these purposes need. We ask for new consent before using information for a different purpose, unless the law allows it without consent.
The Customer is responsible for telling tenants and staff about the system and for obtaining any consent the law requires.
You can withdraw consent, subject to legal and contract limits. Without a credential or an account you may not be able to use controlled doors through this system; your building manager can tell you the alternatives.
Door decisions follow rules the Customer sets; we do not score or profile people.
8. Who can see your information
- Your building manager and the staff it authorizes, limited by role and building. Other Customers cannot see it.
- Our support staff, only when needed to help your building, and their actions are logged.
- Service providers who help us run the service, listed below, under written contracts that limit how they may use the information.
- Authorities or others when the law requires or allows it, for example a valid court order. We check that a request is lawful and give only what is needed.
- A buyer or successor of the business, if the law's conditions are met.
| Provider | What it does | Information | Where |
|---|---|---|---|
| OVH | Hosting | All service data | Canada |
| Email sending service | Delivers invitations, sign-in codes and notices | Email address, message content | May be outside Canada |
| TTLock Open Platform | Cloud service for apartment door locks and their gateways | Lock details, card and code numbers, lock events, key names | May be outside Canada |
| UniFi Access | Common door controller installed at the building and run for the Customer | Names, fob numbers, door policies, door logs | On site |
| Notification services (Expo, Google, Apple) | Deliver phone notifications | Device token, notification content | May be outside Canada |
9. Transfers outside Quebec and Canada
We host the service in Canada. Some providers above may handle information outside Quebec or outside Canada, and it may then be subject to the laws of that place.
Before information is sent outside Quebec, Quebec law requires a privacy impact assessment showing it will get adequate protection, and a written agreement that reduces the risks found.
10. How long we keep information
| Information | Kept for |
|---|---|
| Door events | Exactly 365 days (one year). Any change to this period is agreed separately with the Customer |
| Deleted tenants | When a tenant is deleted, the tenant and their history, including name and email, go to an archive and are kept at least 90 days from the deletion. After that a Workspace admin may delete them permanently by hand. If nothing is done, door events still follow the door events period above. A permanent deletion also erases that person's door events, which can be earlier than the door events period. |
| Sign-in events, audit trail, email log | For as long as they are needed for the security of the service and to show what was done |
| Tenant history | Kept with the tenant's file. The audit trail keeps the tenant's name after a permanent deletion |
| Vehicles, drivers and vehicle history | Kept while the vehicle is on file. An archived vehicle and its history are kept at least 90 days; after that a Workspace admin may delete them permanently |
| Email sign-in codes | Valid for 10 minutes and for one use only |
| Tenant and staff records, credentials | While the person has access. For a deleted tenant, the row on deleted tenants applies |
| Location coordinates | Not stored. The distance stays with the audit record |
| Sales enquiries | For as long as they are needed to reply and follow up |
| Backups | Encrypted and rotated. Deleted information can remain in backups for up to about 6 months |
When a contract ends, we return or destroy the Customer's information as the contract provides. Records may be kept longer if the law requires it or if they are needed for a dispute or an investigation.
11. How we protect information
We use role-based access, separate workspaces for each Customer, HTTPS, hashed passwords, encrypted storage for integration credentials, optional two-factor sign-in, sign-in history, an audit trail and encrypted daily backups with tested restores.
No system is perfectly secure. Fobs and cards have their own limits: see our Terms of Service.
12. Security incidents
If a confidentiality incident happens, such as unauthorized access to or loss of personal information, we act to reduce the harm and to prevent it happening again.
If there is a risk of serious injury, the people affected and the Commission d'accès à l'information must be told promptly. Where federal law applies, the same is true for the Office of the Privacy Commissioner of Canada when there is a real risk of significant harm. For information we hold for a Customer, we tell the Customer without delay and help it respond.
To report a suspected incident, use the contact form on our website.
13. Your rights
You may:
- ask whether we hold information about you, and get a copy;
- have inaccurate, incomplete or out-of-date information corrected;
- get information you provided in a structured, commonly used format, or have it sent to another organization, where the law provides;
- ask how information was collected and who has received it;
- withdraw consent;
- ask for information to be deleted when it is no longer needed or was not lawfully collected;
- complain.
How to ask. For building data, write to your building manager first, because it decides what happens to that information. If you write to us, we will pass your request on or tell you whom to contact. For our own records, write to the person in section 4. A reply is due in writing within 30 days. We may need to confirm your identity, and we cannot give out information about other people.
Complaints. You can complain to us first. You can also complain to:
- the Commission d'accès à l'information du Québec: https://www.cai.gouv.qc.ca
- the Office of the Privacy Commissioner of Canada: https://www.priv.gc.ca
- the privacy commissioner of your province, if it has its own private sector privacy law.
14. Children
Tenants and household members under 14 may be given a fob or an account only with the consent of a parent or tutor, which the Customer is responsible for obtaining.
15. Changes and language
We will post changes here with a new date, and tell Customers and account holders about important ones before they apply.
A French version of this policy is available. Where the law requires it, the French version prevails.