Policies

01Who we are

This policy applies to the Eyecon cloud monitoring service operated by Topica LLC (registration number 9011025094, 'we').

Registered address: Topica Office 3A, Chingeltei district 1st khoroo, Ulaanbaatar 15170. Contact: 75554488, info@topica.mn.

02Our role

As processor. Data in a customer organisation's workspace — sensor readings, device configuration, that organisation's user accounts and alarm history — is processed on the customer's instructions. The customer determines the purposes and the configuration.

As controller. We process our own customer records, contracts, invoices, support history and correspondence, and website enquiries for our own purposes, and act as controller for those.

03What we collect

Account data: username, first and last name, e-mail address, phone number, job title, profile photo (where the user uploads one) and a password hash.

Workspace data: organisation name, device names, locations, buildings, floor plans, threshold values and the e-mail addresses that receive reports.

Measurement data: sensor values, the time of measurement and the location are generally not personal data, but they may become personal data where they relate to a particular person's room or workplace

Activity logs: sign-ins, configuration changes, who acknowledged an alarm, when, any note left, and devices going online or offline.

Support correspondence: e-mails and attachments sent to us.

04What we use it for

Delivering the Service: storing readings, comparing them against thresholds, sending alarms and generating reports.

Identifying users, determining their permissions and maintaining security (sign-in protection, two-step verification).

Providing support and answering questions.

Diagnosing faults in the Service and improving it.

Meeting the obligations imposed on us by law

05Legal basis

Delivering the Service is processing necessary to perform our contract.

Security and fraud prevention rely on our legitimate interests.

Accounting and tax records rely on legal obligations.

Where necessary we rely on consent, and consent may be withdrawn at any time.

06Who we share it with

Within the customer organisation: the workspace owner/admin and authorised users. Access is limited by device group.

Sub-processors: cloud hosting Topica LLC, e-mail delivery Gmail

We will update this policy if the list changes.

Authorities: where required on a lawful basis.

We do not sell personal data or pass it to third parties for advertising.

Workspaces are isolated: one organisation's data is not visible to another.

07Where data is stored

Data is stored on servers located in Mongolia.

08How long we keep it

Measurement data: 30 days in the live window, older data is moved to the archive.

Activity logs: 12 months.

Backups: 36 months.

Account data: until the user is deleted. A user may delete their own account, and the organisation's devices and measurement history remain with the organisation.

After the agreement ends: 90 days.

09Security measures

Connections between the browser and the server are encrypted with HTTPS.

Passwords are stored as hashes.

Two-step verification is available.

Repeated failed sign-in attempts are throttled, and a new account is confirmed with a code sent by e-mail.

A session is closed automatically after 10 idle minutes.

Each organisation's data is isolated, and access is limited by user role and device group.

Sign-ins and configuration changes are recorded so that they cannot be edited or deleted.

Backups are taken regularly.

10Your rights

To see the data held about you and obtain a copy.

To have inaccurate data corrected.

To have data deleted where the law allows it.

To restrict or object to processing.

To receive your data in a readable format (PDF, Excel, CSV).

To withdraw consent where processing is based on it.

Send requests to support@eyecon.mn. If you are an employee of a customer organisation, raise the request with an administrator in your own organisation first.

11Cookies and browser storage

The website and the Service use cookies that are strictly necessary to keep a sign-in session.

Language and light/dark preferences are kept in the browser's local storage (localStorage). They are not sent to us.

We do not use advertising or third-party tracking cookies.

12Children's data

The Service is intended for organisations and is not directed at children.

13Breach notification

If personal data is lost or accessed without authorisation, we will establish the facts and take steps to limit the harm.

Where the law requires it, we will notify the competent authority and the affected customers within 72 hours.

14Changes to this policy

If we change this policy we will update the date shown and notify material changes by e-mail or through the Service.

01Definitions

Provider — Topica LLC, registration number 9011025094, registered address Topica Office 3A, Chingeltei district 1st khoroo, Ulaanbaatar 15170.

Customer — the legal entity that subscribes to the Service.

Service — the Eyecon cloud monitoring platform operated by the Provider, including its web and mobile interfaces.

Workspace — the account holding the Customer's data, devices and user records.

Sensor — one physical device registered in the Service that sends readings.

Order — the quotation or order form agreed by the parties.

02The Service

The Provider supplies the Service on a subscription basis. The Customer does not acquire or install the software — it receives the right to use the Service through a browser.

The Service includes the following core capabilities: receiving and storing sensor readings, comparing them against configured thresholds and raising warnings and alarms, notifying when a sensor or gateway stops reporting, acknowledging alarms with notes, history and reports, managing user permissions and device groups.

The Provider may improve the Service continuously. If an existing material feature is withdrawn, the Provider will notify the Customer 30 days in advance.

03Limitations and warnings

The Service is not a life-safety or property-protection system. It does not replace fire alarms, security alarms, medical monitoring or any other system required by law. Such systems must operate independently and to their own standards.

Notifications are delivered by e-mail, so they depend on the Customer's internet connection, mail service, spam filtering, sensor batteries, site power and gateway operation. The Provider is not responsible for these third-party factors.

Sensors send readings at a configured interval, so the time taken to detect a breach depends on that interval.

Offline notifications are switched on in the configuration by the Provider's team. Where they have not been switched on, no such notification is sent.

The Service does not guarantee the accuracy of sensor measurements. Calibration of measuring instruments is the Customer's responsibility and is agreed separately.

04Accounts and access

The Customer appoints a system administrator and invites other users by e-mail.

Credentials are personal and must not be transferred. Enabling two-step verification is recommended.

The Customer is responsible for the actions of its users and for configuring their permissions correctly.

The Customer must notify the Provider without delay if it suspects that credentials have been compromised.

05Equipment and connectivity

Sensors, gateways and other equipment are covered by a separate supply agreement. Manufacturer warranties are given by the relevant manufacturer.

The Service currently runs with Milesight devices. The ability to connect other models is checked and confirmed case by case.

Power, internet connectivity, equipment placement and mounting at the monitored site are the Customer's responsibility.

Integrating independent systems such as fire or security alarms is assessed and confirmed separately, based on the technical conditions at the site.

06Fees

Fees are calculated per registered sensor, as set out in the Order. There is no additional charge for gateways, users, alarms or reports.

One physical device counts as one sensor regardless of how many measurements it sends.

Sensors added during the term are charged from the month in which they are added.

Payment terms, invoicing and taxes are set out in the Order. If payment is overdue, the Provider may suspend the Service after 30 days, and data is not deleted.

07Term and termination

The term is set out in the Order. Either party may terminate on 30 days' written notice.

On expiry or termination the Workspace is locked and new readings are no longer shown, but data is not deleted immediately.

For 90 days after the agreement ends the Customer may export its data as PDF, Excel or CSV. After that period the Provider deletes the data.

The Provider will delete the data earlier at the Customer's written request.

08Ownership of data

Customer data — sensor readings, configuration and alarm history — remains the property of the Customer.

The Provider uses that data only to deliver the Service, provide support and maintain security.

The Provider may use aggregated statistics that cannot identify a particular Customer in order to improve the Service.

The processing of personal data is governed by the Privacy Policy and, where required, by the Data Processing Agreement.

09Operation and support

The Provider operates the Service and is responsible for updates and backups.

Availability commitment: 99%

Planned maintenance will be announced in advance where practicable.

Support hours and response times:

Support is provided by e-mail.

Connection, initial configuration and training are performed by the Provider's team.

10Acceptable use

The Customer will use the Service lawfully and without infringing the rights of others.

Reverse engineering, extracting the source code, copying the Service or letting a third party use it is prohibited.

Actions that disrupt or overload the normal operation of the Service are prohibited.

11Liability

The Provider will deliver the Service with professional care and due diligence.

The Provider is not liable for indirect loss, loss of profit or reputational harm.

The exclusion of indirect loss does not apply to wilful misconduct or where the law prohibits such a limitation.

12Confidentiality

Each party will protect the other's confidential information and use it only for the purposes of the agreement.

13Changes to these terms

The Provider will give 30 days' notice of changes to these terms by e-mail or through the Service.

If the Customer does not accept a change, it may terminate before the change takes effect and receive a refund of the unused part of any prepaid fees.

14Force majeure

Neither party is liable for failure to perform caused by force majeure, including natural disaster, war, acts of authorities and major power or telecommunications outages.

15Governing law and disputes

These terms are governed by the laws of Mongolia.

The parties will first seek to resolve any dispute by negotiation. Failing that, the dispute will be resolved by the competent court of Mongolia.

Notices are sent to the e-mail address given in the Order.

01What this section covers

Eyecon is a hosted service, so a customer's sensor readings, device configuration and user accounts are held on our infrastructure. This section sets out who decides about that data, what we use it for, how long we keep it and who it is passed to.

This is a public statement, not a contract. An organisation that needs a signed data processing addendum can ask for one at support@eyecon.mn.

The privacy policy covers personal data in general. This section concentrates on the data in a customer organisation's Workspace.

02Who decides, who processes

The customer decides: which sensors are placed where, what the thresholds are, who the users are and who receives notifications is determined by the customer. The data in the workspace belongs to the customer.

We process. We process that data on the customer's instructions and configuration: receiving readings, displaying them, sending alarms, producing reports and providing support.

What we decide ourselves. Sign-in security records, audit logs, invoices, contracts and support correspondence are processed for our own purposes, and we are the controller for those.

03What data we process

Sensor readings, alarm history and acknowledgement notes.

Device configuration: name, model, location, thresholds and the point on a floor plan.

User accounts: name, e-mail, phone, job title and role.

Sign-in and activity records: who did what and when, and the IP address.

Notification settings: the e-mail addresses that receive alarms and reports.

Technical diagnostic data.

04What we use it for, and what we do not

We use the data to deliver the Service, send alarms, produce reports, maintain security, fix faults and provide support.

We do not sell the data, use it for advertising, show it to another customer, or study it in order to design new features.

For planning and performance work we use only aggregated, de-identified statistics. Those statistics cannot identify a customer, its staff or a location.

Where the law requires disclosure to an authorised body we must comply, and we will tell the customer unless the law forbids it.

05Sensors are not for monitoring people

Eyecon monitors the environment of a building: temperature, humidity, leaks, smoke and door state. It is not a tool for monitoring people.

A customer must not place sensors in order to track a particular person's attendance, movement or behaviour. If they do, the customer is fully responsible for the legal basis and for informing the people concerned.

06Who else can reach it

The outside services that can reach the data: cloud hosting Topica LLC; the mail service that delivers alarms and reports, Gmail. Backups are held on the same infrastructure.

We do not pass data to any third party outside that list. If the list changes we will update this section and give 30 days' notice.

Every sub-processor is under a confidentiality obligation, and we answer for their actions as for our own.

07Where it is held

Mongolia — where the servers holding the data are located.

Workspaces are isolated - one organisation's data is not visible to another.

08Security

Web access uses HTTPS; device data arrives over MQTT/TLS.

Passwords are stored in a form that cannot be reversed; two-factor secrets are encrypted.

Access is limited by role and by device group.

Sign-ins, configuration changes and data exports are written to the audit log.

Backups run daily.

Staff access is limited to what the work requires and carries an indefinite confidentiality obligation.

09How long we keep it

Kept for 12 months — readings and alarm history archive

[Log retention period] — audit records and IP addresses.

Kept for 36 months — backup copies.

When a subscription ends the customer can export their data as CSV or Excel. After 90 days it is deleted from the live system, and backup copies fall away as the backup cycle turns over.

Invoices and tax records are kept for the period the law requires.

10If data is lost

If personal data is lost or an unauthorised access is found, we notify the customer in writing within 72 hours of becoming aware: what happened, which data was involved, the likely consequences and the steps taken.

If the full picture is not clear within that time we send an initial notice and follow it promptly with the rest.

11Your rights

A data subject may see their data, get a copy, have it corrected or deleted, object to processing and lodge a complaint.

If you are a user inside a workspace, address these requests to an administrator in your own organisation.

A request that reaches us directly is passed to the relevant organisation within 5 working days.

For anything about personal data, write to support@eyecon.mn.