Global Privacy & Cookie Policy

Last updated: October 2026

HAAS, Inc. (including its affiliates and subsidiaries, "HAAS Alert" or "We") values your privacy and is committed to protecting it by ensuring the Security, Confidentiality and Lawfulness of your Personal Data Processing Activities by our side. For the purposes of the General Data Protection Regulation (GDPR), HAAS, Inc. (DBA HAAS Alert), located at N Southport Ave, Suite 206, Chicago, IL 60614, is the Data Controller. You may contact our Data Protection Officer (DPO) at dpo@haasalert.com.

This Privacy Notice explains how we collect, use, share, and store Personal Data/ Information about you. It also outlines your rights regarding your Personal Data and how to exercise them. This Privacy Notice applies to Personal Data we collect through www.haasalert.com or other websites that HAAS Alert operates that link to this policy ("collectively Websites”), as well as through our products and related service offerings. If you have any questions or concerns about how we handle your Personal Data, please contact us using the contact information provided at the end of this document.

‍

The personal information we may collect falls into the following categories:

‍

Information You Provide Voluntarily: Certain areas of our websites may require you to provide personal information willingly, such as when you register for an account, request technical support, subscribe to marketing communications, sign up for events, access content, or submit inquiries. These identifiers typically include your name, email address, job title, and company. We will clearly inform you of the data we collect and the reasons for collecting it at the point of collection.

Information Collected Automatically: When you visit our websites, we may automatically collect certain information from your device. In some jurisdictions, including those in the European Economic Area, this information may be considered Personal Data under applicable data protection laws. This information may include your IP address, device type, unique device identifiers, browser type, broad geographic location (country or city level), and other technical data. We may also collect information about how your device interacts with our websites, such as the pages you access and links you click. Collecting this information allows us to better understand who visits our websites, where they come from, and which content they find most relevant. We use this information for internal analytics and to improve the quality and relevance of our websites for our visitors. Some of this information may be collected using cookies and similar tracking technologies.

Information Obtained from Third Parties: Occasionally, we may receive personal information about you from third-party sources, such as lead generation providers, partners, content syndication providers, third-party enrichment tools (such as professional social networks or commercial databases), or meeting maker vendors. We only collect information from third parties that have your consent or are otherwise legally permitted to share it with us. The types of information we collect from third parties include name, contact information, job title, HAAS Alert data, and internet activity. We use this information to market our services to you.

Sensitive Personal Data: We may collect sensitive Personal Data, or special category Personal Data, submitted by the Controller (our Corporate Clients), in the course of providing our services. We do not use sensitive Personal Data for any other commercial purpose, and we do not share Personal Data for online advertising. We are committed to protecting your Personal Data. We implement appropriate technical and organizational security measures to protect your Personal Data from unauthorized access, use, disclosure, alteration, destruction, or accidental loss.

‍

Who does HAAS Alert Share Your Personal Data With?

‍

We may share your personal data with the following categories of recipients:

Our group companies and third-party service providers: We may share your data with our affiliated companies and external service providers who assist us in providing our services and products, supporting our websites, or enhancing their security.
Our partners: We may share your data with our partners who collaborate with us in selling or distributing our products and services, or engaging in joint marketing activities, subject to your marketing preferences. We will not share text messaging originator opt-in data and consent with any third parties.
Law enforcement, regulatory bodies, and government agencies: We may disclose your data to competent law enforcement bodies, regulators, government agencies, courts, or other third parties when we believe disclosure is necessary to comply with applicable laws or regulations, enforce our legal rights, protect your vital interests or those of others, or investigate potential wrongdoing.

Other third parties with your consent: We may disclose your data to other third parties with your explicit consent. We may share this data with the following categories for business purposes or for commercial purposes, including sale/online advertising:

‍

Broad Categories Collected + Types of third parties we share with

‍

Identifiers - Group companies, service providers, and partners
Select Information in Customer Records - Group companies, service providers, and partners
Commercial Purchasing Information - Group companies, service providers, and partners
Internet or Network Activity - Group companies, service providers, and partners ‍

‍

Information Sharing Features

‍HAAS Alert offers two optional features that enable information sharing between Corporate Clients (Controllers), specifically “Mutual Aid” and “Relay”.

‍Mutual Aid is an opt-in feature available on the Safety Cloud dashboard that allows two or more emergency services agencies to view each other's real-time emergency vehicle locations and incidents. It is a view-only feature, and no data feed is generated or transferred (in the sense of moved) between parties. The feature is activated only upon written agreement from all participating agencies, and any party may discontinue the access to its information at any time.

‍Relay is a licensed data streaming feature that allows an agency to have its own real-time vehicle locations and incidents forwarded to other agencies, for integration into their own internal applications.

In both cases, the data shared consists exclusively of vehicle session data, such as real-time vehicle location and incident information. This data does not include any information that would allow HAAS Alert, or any receiving party, to directly identify third party natural persons such as vehicle drivers or occupants. As such, HAAS Alert does not consider this data to constitute Personal Data at the level of its own processing activities.

HAAS Alert acknowledges, however, that a receiving agency may, by cross-referencing vehicle data with its own internal systems and information repositories, be in a position to identify 3^rdparty natural persons. In such cases, that identification occurs exclusively within the receiving agency's own environment, and that agency bears full responsibility, as an independent Data Controller, for ensuring compliance with applicable data protection law. This outcome is not a result of any processing activity undertaken by HAAS Alert.

‍

The Sale of Personal Data/ Information:

HAAS Alert does NOT share Personal Data unter Processing with any 3^rd party other than the respective Controller and those Processors that are part of our Processing Activities; furthermore, HAAS Alert does NOT sell Personal Data/ Information under any circumstances.

‍

Legal Basis for Processing Personal Data

The foundation upon which we collect and utilize the personal information described above is contingent on the specific data type and the context in which it is obtained. Typically, we will gather your personal information only if:

We need the data to fulfill our obligations under a contract we have with you. (In accordance with Art. 6(1)(b) GDPR, this applies to: managing your account, providing technical support, and delivering our products and related service offerings).

Our legitimate interests dictate it: Processing Personal Data is essential to operate our platform and communicate with you as needed. For instance, when responding to your inquiries, analyzing platform usage, improving our services, marketing to existing customers within legal limits, and identifying or preventing illegal activities. (In accordance with Art. 6(1)(f) GDPR, this applies to: internal analytics to improve our websites, ensuring network and information security, and B2B marketing based on professional enrichment tools).

You consent: You have granted us explicit authorisation to process your Personal Data. (In accordance with Art. 6(1)(a) GDPR, this applies to: your subscription to marketing communications, the use of non-essential cookies, and participation in specific events or webinars).

‍

‍

In certain situations, we may also be legally obligated to collect your personal information (Art. 6(1)(c) GDPR) or require it to safeguard your or someone else's vital interests (Art. 6(1)(d) GDPR). If we request your personal information to comply with a legal obligation or fulfill a contract, we will clearly inform you at the appropriate time and advise you whether providing your personal information is necessary or not (along with the possible consequences of not providing such data).

If we collect and utilize your personal information based on our legitimate interests (or those of any third party), it will typically be to operate our platform and communicate with you as required. For example, responding to your inquiries, analyzing platform usage and improving our services, undertaking marketing activities for existing customers within legal limits, and detecting or preventing illegal activities. We may have other legitimate interests, and we will inform you at the relevant time what those interests are. We rely on these legal bases to process data for the following purposes: to assist in providing services (e.g., customer support and usage data) and to market our services to you within legal limits.

‍

HAAS Alert's Corporate Adequacy Process

HAAS Alert has finalized its Corporate Adequacy Process towards complying with Personal Data Protection legislation requirements based on the highest standard year to date which is the EEA/ EU and UK General Data Protection Regulation. HAAS Alert's compliance program also addresses the requirements of the Swiss Federal Act on Data Protection (FADP) and HAAS Alert's self-certifications under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. This process consists of performing the Corporate Data Protection Impact Assessment and having in place a Registry of Processing Activities plus adequate Technological, Operational and Legal measures and mechanisms/ tools that enable a compliant mode of operation while ensuring the Security and Confidentiality of Personal Data under Processing, plus the observance of legal Rights and Freedoms by those natural persons to whom the data pertains to. For any questions please contact dpo@haasalert.com

‍

HAAS Alert's Use of Cookies and Similar Tracking Technology

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Website owners can utilize cookies for various purposes, including enabling their websites to operate effectively, providing personalized content and advertising, and generating website analytics. Our website utilizes first-party and third-party cookies for various purposes. Essential cookies are crucial for operating our site, while additional cookies enhance user experience by providing personalized content and advertising. In accordance with the ePrivacy Directive, essential cookies are used based on our legitimate interests, while analytical and advertising cookies are only used with your prior consent.

First-party cookies gather standard information like browser type, language, access times, and the previous website visited. They also collect IP address, clickstream behavior, and product information. Third-party advertising networks, contracted by HAAS Alert, collect non-personal and Personal Data through our website, emails, and third-party websites. These networks track online activities to deliver tailored ads about products and services across the web. This process also aids in monitoring marketing effectiveness. The website may incorporate third-party social media features and widgets. These components may collect IP addresses, visited pages, and set cookies for proper functioning. Interaction with these elements is governed by the respective provider's privacy policy. For detailed information on the specific cookies we use and their expiration periods, please refer to our cookie settings page. ‍

‍

Cookie Control

Users have the choice to accept or reject cookies. Cookie preferences can be managed in the cookie settings page. Our cookie consent tool automatically honors Google Consent. Web browser controls can be configured to accept or reject cookies. While rejecting cookies may restrict site functionality, it's still possible to access the website. Refer to browser help menus for specific instructions. Targeted advertising opt-out options are available through most advertising networks. Visit http://www.aboutads.info/choices/, http://www.youronlinechoices.com, or http://www.youronlinechoices.eu

‍

Data Security

HAAS Alert employs appropriate technical and organizational measures to safeguard Personal Data collected and processed. These measures aim to provide a security level commensurate with the risk associated with handling Personal Data.

HAAS Alert resides on leading cloud service providers (linked on our security page) utilizing industry-standard security protocols to protect Personal Data. Personal Data is stored on private servers within a secure security group. End-user to server connections are encrypted using SSL, and server software is updated regularly with the latest security patches.

In addition to these measures, our organizational and technical security framework includes:

Access Control: We implement strict Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) to ensure that only authorized personnel with a legitimate "need-to-know" can access Personal Data.
Data Minimization: We apply technical filters to ensure we only collect and process the minimum amount of data necessary for each specific purpose.
Pseudonymization and Encryption: Beyond SSL for data in transit, we utilize industry-standard encryption protocols (such as AES-256) for data at rest within our databases.
Physical Security: Our cloud providers maintain world-class physical security standards, including 24/7 surveillance and biometric access controls at data centers.
Continuous Monitoring: We perform regular vulnerability scans, penetration testing, and 24/7 system monitoring to detect and respond to potential threats in real-time.
Staff Training: All employees undergo mandatory periodic privacy and security awareness training to ensure the confidentiality and integrity of the data we handle.

HAAS Alert has completed System and Organization Controls (SOC) 2 Type 1 and Type 2 audits, a security compliance framework developed by the American Institute of Certified Public Accountants (AICPA), and is certified to ISO/IEC 27001, the international standard for information security management systems, and ISO 9001, the international standard for quality management systems, both published by the International Organization for Standardization (ISO). These achievements underscore HAAS Alert's continual commitment to delivering a secure experience.

‍

Data Transfers

Your Personal Data may be transferred to, and processed in, countries other than your country of residence, including the United States. These countries may have data protection laws that are different from the laws of your country. However, we have taken appropriate safeguards to ensure that your Personal Data will remain protected in accordance with this Privacy Notice. These safeguards include reliance on the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), and the implementation of the European Commission's Standard Contractual Clauses (SCCs) for the transfer of Personal Data to third countries, having performed a Transfer Impact Assessment (TIA) within the Corporate Adequacy Process. HAAS Alert complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom (and Gibraltar), and Switzerland to the United States.

‍

Data Retention

We retain your Personal Data as long as we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with legal requirements). To comply with the principle of storage limitation under GDPR, we apply the following criteria:

Customer account data is retained for the duration of the contract and for up to 5 years thereafter for legal and tax purposes.
Marketing data is retained until you withdraw your consent or after 2 years of inactivity.
Security logs are retained for 6 months unless needed for investigation.
Cookies are session based, hence retention is limited to each browser session; note that some non-essential/ optional 3rd party cookies may transfer gathered data to such manufacturer servers, hence retention is not defined by us.
User support tickets will be maintained for 6 years.

When we no longer have a legitimate business need to process your Personal Data, we will either delete or anonymize it, or if this is not possible, securely store it and isolate it from any further processing. ‍

‍

Your Data Protection Rights

You have the following data protection rights:

Access your Personal Data: Request a copy of the Personal Data we hold about you and check that we are lawfully processing it.
Correct or update your Personal Data: Request the correction of incomplete or inaccurate data.
Request deletion of your Personal Data: "Right to be Forgotten"
Object to the processing of your Personal Data: Object to processing where we are relying on a Legitimate Interest (or those of a third party) or for direct marketing purposes.
Restrict the processing of your Personal Data: Request the suspension of processing your data (e.g., while you contest its accuracy).
Request portability of your Personal Data: Request the transfer of your data to you or a third party in a structured, commonly used, machine-readable format.
Right to object to automated decision-making / profiling: besides Processing inherent to the use of non-essential Cookies, that may comprehend automated Processing Activities, we do not proceed with enrichment data + analytics produce any profiling (scoring leads, targeting), out of our Processing and by automated means. You can disable non-essential cookies via the Cookie Management Tool.
Opt out of marketing communications
Withdraw your consent (if you have given it): Where processing is based on consent, you may withdraw it at any time.
Opt out of the sale of your Personal Data
Right to Lodge a Complaint: You have the right to make a complaint at any time to your relevant Supervisory Authority.

‍

You can exercise these rights by contacting us using the contact details provided under the "How to contact us" heading at the bottom of this notice. We will respond to all requests within 30 days, as per the timeframe required by the GDPR.

‍

Sensitive Personal Data

We do not knowingly undertake the Processing of Personal Data pertaining to minors (natural persons under the age of 18). If we realize such data has been entered into our systems, we will contact the Controller for clarification where we are not acting as Controller or promptly erase it where we are.

‍

Non-discrimination

We will not discriminate against you for exercising your data protection rights.

‍

Authorized Agent

You can authorize another person to make a data privacy request on your behalf. To do this, you will need to provide us with a written authorization that includes the specific data protection request you want the authorized agent to make.

‍

Appealing Our Decision

If you are not satisfied with our response to your data privacy request, you have the right to appeal our decision. To do this, please contact us using the contact details provided under the "How to contact us" heading at the bottom of this notice. If you are not satisfied with the result of the appeal, you have the right to contact your respective attorney general depending on where you reside.

‍

Verifying Data Protection Requests

We verify data protection requests to ensure that they are legitimate and to prevent unauthorized access to your Personal Data. Our verification process is based on matching Personal Data provided by the requestor with Personal Data that we have on file with the requestor. The Personal Data points matched vary based on what HAAS Alert has on the requestor, but HAAS Alert uses multiple Personal Data points for verification. During the verification process, HAAS Alert aims to avoid collecting additional Personal Data from the requestor that has not been previously collected by HAAS Alert.

‍

Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

‍

Data Protection Authority

You have the right to complain to a data protection authority about our collection and use of your Personal Data. In the European Union, you may contact your local national data protection authority or if not certain of which the Central Supervisory Authority in the EU or UK (dependent of you residency), respectively the European Data Protection Authority (EDPB) at https://www.edpb.europa.eu or the Information Commissioner Office (ICO) https://ico.org.uk/. In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, HAAS Alert commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints should first contact HAAS Alert at dpo@haasalert.com. HAAS Alert has further committed to refer unresolved DPF Principles-related complaints to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction,please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you. Under certain conditions, you may invoke binding arbitration as described in Annex I of the DPF Principles. HAAS Alert is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). HAAS Alert remains liable under the DPF Principles if its third-party agents process DPF-covered personal data in a manner inconsistent with the Principles, unless HAAS Alert proves that it is not responsible for the event giving rise to the damage.

‍

How to contact us

If you have any questions or concerns about our use of your Personal Data, please contact us here:

HAAS, Inc. DBA HAAS Alert

2071 N Southport Ave, Suite 206, Chicago, IL 60614

+1 (833) 433-4227

brock@haasalert.com

dpo@haasalert.com

‍

Glossary of Terminology and Frameworks

1.1 "controller", "processor", "data subject", "Personal Data" and "processing" (and "process") will have the meanings given in EU/UK Data Protection Law;

1.2 "Applicable Data Protection Law" means all worldwide data protection and privacy laws and regulations applicable to the Personal Data in question, including, where applicable, EU/UK Data Protection Law, US Data Protection Law, Serbian Data Protection Law, Canadian Data Protection Law, and the Swiss DPA;

1.3 “Breach” means an accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access that is in violation of HAAS Alert’s security obligations under this Agreement by HAAS Alert or its agents of which HAAS Alert becomes aware. Breach will not include an unsuccessful Breach, which is one that results in no unauthorized access to Personal Data or to any HAAS Alert equipment or facilities storing the Personal Data, and could include (without limitation) pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents;

1.4 "Canadian Data Protection Law" means: (i) the Personal Information Protection and Electronic Documents Act S.C. 2000, c. 5; (ii) applicable provincial law; (iii) any and all applicable data protection laws made under, pursuant to or that apply in conjunction with any of (i) or (ii); in each case as may be amended or superseded from time to time;

1.5 “Data Privacy Framework” means the EU-US Data Privacy Framework, the UK extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework self-certification program operated by the US Department of Commerce;

1.6 “Data Privacy Principles” means the Data Privacy Framework principles (as supplemented by the Supplemental Principles);

1.7 "EU/UK Data Protection Law" means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii) or (iii); in each case as may be amended or superseded from time to time;

1.8 "US Data Protection Law '' means: (i) the California Consumer Privacy Act of 2018, including as amended by the California Privacy Rights Act of 2020, codified at Cal. Civ. Code §1798.100 et seq., upon the CPRA’s enforcement date of July 1, 2023 (together with its implementing regulations) (“CPRA”); (ii) the Virginia Consumer Data Protection Act; (iii) the Colorado Privacy Act; (iv) the Connecticut Personal Data Privacy and Online Monitoring Act; (v) the Utah Consumer Privacy Act; (vi) the Iowa Consumer Data Protection Act; (vii) the Indiana Consumer Data Protection Act; (viii) the Tennessee Information Protection Act; (ix) the Montana Consumer Data Privacy Act; (x) the Texas Data Privacy and Security Act; (xi) the Oregon Consumer Privacy Act; (xii) the Delaware Personal Data Privacy Act; and (xiii) any and all applicable comprehensive state data protection laws and regulations that are or are not yet in effect as of the Effective Date; in each case as may be amended or superseded from time to time;

1.9 "Serbian Data Protection Law" means: Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti; Official Gazette of the Republic of Serbia, no 87/2018). In the case of a transfer of Personal Data to a Non-Adequate Country, by entering into this DPA, the Customer is entering into the Serbian Standard Contractual Clauses (“Serbian SCCs”) as adopted by the "Serbian Commissioner for Information of Public Importance and Personal Data Protection", to provide an adequate level of protection. References to the Standard Contractual Clauses in this DPA will include the Serbian SCCs.

1.10 “Supplemental Principles” will have the meaning given in the Data Privacy Framework;

1.11 "Standard Contractual Clauses" means: (i) where the EU GDPR or Swiss DPA applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs"); and (iii) where Serbian Data Protection Law applies, the Serbian SCCs; and

1.12 "Swiss DPA" means the revised Swiss Federal Act on Data Protection enacted on September 25, 2020, and effective on September 1, 2023, as may be amended or superseded from time to time.