We may also share this information with the following entities:
- Third parties within our group (whether acting as joint controllers and/or processors), who are based in the United States, the United Kingdom, Australia, or New Zealand and provide support, marketing, and administration services and reporting. These third parties may have access to or process your Personal Data as part of providing those services to us.
- Service Providers. We may disclose your Personal Data to our third-party service providers, to facilitate services they provide to us, such as website hosting (including through provision of tools that enable us to analyze your interactions on our Services), database administration, cloud computing, advertising, data analysis, information technology and related infrastructure, email delivery, and customer support.
- Legal. We may disclose your Personal Data to third parties if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We also reserve the right to disclose your Personal Data that we believe, in good faith, is appropriate or necessary to (i) take precautions against liability, (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity, (iii) investigate and defend ourselves against any third-party claims or allegations, (iv) protect the security or integrity of our Services and any facilities or equipment used to make our Services available, or (v) protect our property or other legal rights, including to enforce our agreements, or the rights, property, or safety of others.
- Affiliates. We may share Personal Data with our affiliates and subsidiaries to which it is reasonably necessary or desirable for us to disclose Personal Data for the above-mentioned purposes.
- Merger. We may disclose or otherwise transfer Personal Data to an acquirer, successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.
- Consent. We may also disclose your Personal Data with your permission.
*Note – AMS UK Ltd only collects and processes telemetry data from the monitoring hardware and does not collect any PII data. All PII is retained and remains with the Administering Authority (Controller).
Legal Basis for Processing
The legal basis for processing personal information is obtained with your consent, except when that data is obtained by us from an Administering Authority such as a Court of Law, Department of Corrections, or other legal authority, with whom you may have a legal obligation. SCRAM Systems processes this data according to contractual and legal obligations with the Administering Authority and/or the legal jurisdiction.
SCRAM Systems will inform its customers (Controllers) if a requested process or instruction infringes applicable legislation or regulations.
PII Disclosure to third parties
SCRAM Systems will notify customers of all legally binding requests for disclosure of PII, such as court orders and subpoenas.
SCRAM Systems will reject any requests for PII disclosures that are not legally binding, consult the corresponding customer before making any PII disclosures and accepting any contractually agreed requests for PII disclosures that are authorized by the corresponding customer.
List of third parties and Subcontractors that may process PII
Microsoft Azure, AWS, Mongo Cloud Database, Google (for GPS tracking data), SendGrid, Five9,Trust Pilot, HubSpot, Twilio
This list of third-parties and subcontractors may change and shall be updated in this privacy notice from time to time. Organizations who are the controllers of the data shall be informed prior to the change, through our respective customer service departments and in accordance with the contractual obligations.
*To subscribe to notifications of changes or updates to this page, please enter your information here.
Processing personal data within the U.S. and International Data Transfers
SCRAM Systems has offices and data processing facilities in the United States. Information we collect about you will be processed in the United States for all products and services sold in the jurisdiction of the U.S. By using the SCRAM Systems’ services, you acknowledge that your personal information will be processed in the United States and shall not be transferred to any jurisdiction outside the United States.
Processing Personal Data Within Canada and International Data Transfers
SCRAM Systems has data processing facilities in Canada. Information we collect about you will be processed in Canada for all products and services sold in the jurisdiction of Canada. By using the SCRAM Systems’ services, you acknowledge that your personal information will be processed in Canada and shall not be transferred to any jurisdiction outside Canada.
Processing Personal Data Within the United Kingdom and International Data Transfers
SCRAM Systems, under contract with the Ministry of Justice (MoJ), does not collect or process personally identifiable information. All Personal information collected is under the strict control of the MoJ and their administrating authorities. Electronic monitoring telemetry data that is collected from our devices in the U.K. contains no personal identifying information and is therefore de-identified for processing in the United States. By using the SCRAM Systems’ services, you acknowledge that your personal information will be processed in the U.K. and shall not be transferred to any jurisdiction outside U.K.
Standard Contractual Clauses
Pursuant to Article 46 of the GDPR, SCRAM Systems shall provide for appropriate safeguards by entering binding, Standard Contractual Clauses (SCC), or Binding Corporate Rules (BCR) enforceable by data subjects in the EEA and the UK. These clauses are enhanced based on the guidance of the European Data Protection Board. Any future binding SCC or BCR entered into by SCRAM Systems shall be abided by as they are approved by the European Commission and the respective county’s requirements.
Data subject rights in the U.K. and European Union
The European Union’s General Data Protection Regulation and other countries’ privacy laws provide certain rights for data subjects. A good explanation of them (in English) is available on the website of the United Kingdom’s Information Commissioner’s Office. https://ico.org.uk/ See also the website for the European Data Protection Board (EDPB) https://edpb.europa.eu/edpb_en
EU-U.S. Data Privacy Framework and the UK extension of the EU-U.S. Data Privacy Framework
SCRAM Systems complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. SCRAM Systems has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) and the UK extension with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and the UK extension DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
SCRAM Systems commits to resolve complaints about our collection or use of your personal information. EU and UK individuals with inquiries or complaints regarding our handling of personal data received in reliance on EU-U.S. and the UK extension to the EU-U.S. DPF should first contact SCRAM Systems at dpo@scramsystems.com and give us the opportunity to resolve your complaint. We will respond to your complaint promptly.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, SCRAM Systems commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to PrivacyTrust, an alternative dispute resolution provider based in the United Kingdom. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.privacytrust.com/drs/alcoholmonitoringsystems for more information or to file a complaint. The services of PrivacyTrust are provided at no cost to you.
SCRAM Systems is subject to the investigatory and enforcement powers of the FTC
Finally, as a last resort and in limited situations, EU and UK individuals may seek redress from the DPF Panel a binding arbitration mechanism.
In cases of onward transfer to third parties of data of EU and UK individuals received pursuant to the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, SCRAM Systems remains liable.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, SCRAM Systems commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) with regard to unresolved complaints concerning SCRAM Systems handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of the employment relationship.
Complaints related to human resources data should not be addressed to PrivacyTrust.
Data Subject Rights in the United States
Data subject rights in the U.S. vary from state to state as there is no national standard at this time. SCRAM Systems shall respect each of the state’s requirements for data subject rights. In the following States you have the right to Opt-Out of direct marketing or data sharing with third parties for marketing purposes: California, Colorado, Connecticut, Indiana, Iowa, Montana, Tennessee, Texas, Utah, and Virginia. To exercise your right to Opt-out of direct marketing and data sharing with third parties for marketing purposes, or other rights you are entitled to, please make a request by email to dpo@scramsystems.com. SCRAM Systems will not use personal data for marketing and advertising purposes, without establishing prior consent from the data subject.
Most notable is the California Consumer Privacy Act of 2018 (“CCPA”).
If you are a California resident, please also review our California Resident Privacy Notice for more information about how to exercise your rights under California law.
Your Rights in Relation to Your Personal Data
Depending on where you reside, you may have the following legal rights:
- Access and Portability. You may ask us to provide you with a copy of the Personal Data we maintain about you, including a machine-readable copy of the Personal Data that you have provided to us, and request information about its processing.
- Rectification and Deletion. You may ask us to update and correct inaccuracies in your Personal Data, or to have the information anonymized or deleted, as appropriate.
- Restriction and Objection. You may ask us to restrict the processing of your Personal Data, or object to such processing.
- Consent Withdrawal. You may withdraw any consent you previously provided to us regarding the processing of your Personal Data, at any time and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdraw your consent.
- Complaint. You may lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place. We would, however, appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us in the first instance.
Data Storage and Retention
Retention of data that is owned by an Administering Authority (Controller) is managed by that Administering Authority. We will retain personal data we process on behalf of our customers for as long as needed to provide services to our customers, or for as long as is reasonably necessary to meet and comply with our legal obligations, resolve disputes, prevent fraud and abuse and enforce our terms and conditions. Retention of data laws and regulations vary from jurisdiction to jurisdiction, and it is incumbent upon the controller to ensure that its contracted or approved processors such as SCRAM Systems delete personal information according to contract or explicit request. Any request from a data subject to delete personal information owned by the respective controller shall be redirected to the Controller. SCRAM Systems shall delete personal information solely collected and used for marketing purposes upon the data subject’s request and in accordance with local data privacy laws. To make this request, contact the Data Protection Officer at dpo@scramsystems.com.
SMS Text Opt In/Out Service Information
Monitoring clients have the option to sign up for automated SMS Text reminders as part of their monitoring service. When an individual opts into the service, we will send an SMS message to confirm registration.
Monitoring clients can cancel the SMS Text service at any time. Text “STOP”. After you send the SMS message “STOP” to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time, and we will start sending SMS messages to you again.
If at any time you forget what keywords are supported, just text “HELP”. After you send the SMS message “HELP” to us, we will respond with instructions on how to use our service as well as how to unsubscribe.
We are able to deliver messages to the following mobile phone carriers:
Major carriers: AT&T, Verizon Wireless, Sprint, T-Mobile, MetroPCS, U.S. Cellular, Alltel, Boost Mobile, Nextel, and Virgin Mobile.
Minor carriers: Alaska Communications Systems (ACS), Appalachian Wireless (EKN), Bluegrass Cellular, Cellular One of East Central IL (ECIT), Cellular One of Northeast Pennsylvania, Cincinnati Bell Wireless, Cricket, Coral Wireless (Mobi PCS), COX, Cross, Element Mobile (Flat Wireless), Epic Touch (Elkhart Telephone), GCI, Golden State, Hawkeye (Chat Mobility), Hawkeye (NW Missouri), Illinois Valley Cellular, Inland Cellular, iWireless (Iowa Wireless), Keystone Wireless (Immix Wireless/PC Man), Mosaic (Consolidated or CTC Telecom), Nex-Tech Wireless, NTelos, Panhandle Communications, Pioneer, Plateau (Texas RSA 3 Ltd), Revol, RINA, Simmetry (TMP Corporation), Thumb Cellular, Union Wireless, United Wireless, Viaero Wireless, and West Central (WCC or 5 Star Wireless).
Please note: Carriers are not liable for delayed or undelivered messages.
As always, message and data rates may apply for any messages sent to you from us and to us from you. You will receive messages as agreed to in the Participant Agreement. If you have any questions about your text plan or data plan, it is best to contact your wireless provider. For all questions about the services provided by this short code, you can send an email to info@scramsystems.com.
Backups
AMS Data Backups are retained for 30 days unless contractual agreements specify otherwise.
Incident and Breach Notification
48 hour policy unless contractual agreements specify otherwise.
Other Agreements That May Apply
Upon receipt of any SCRAM Systems product or services, such as remote breath device, continuous alcohol monitoring device, GPS tracking device, or other hardware, the data subject shall be presented with a copy of this Privacy Notice and additional agreements for the usage of these devices and services, and consent to collect and process personal information.
Children’s Privacy
We do not knowingly collect, maintain, or use Personal Data from children under 16 years of age, and no part of our Services are directed to children. If you learn that a child has provided us with Personal Data in violation of this Policy, then you may alert us by contacting us using the contact details at the top of this Policy.
Third Party Websites
Our sites may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy policies. When you leave our sites, we recommend that you read the privacy policy of every website you visit and every plug-in or application you use.
Changes to this Policy
We may update this Policy occasionally to reflect changes in our privacy practices. If we modify this Policy, we will indicate the date of the latest revision at the top of this Policy.