u.warn First Responder — Legal & Support

u.warn First Responder is the mobile companion to Utimaco's Critical Event Management (CEM) platform, used by professional first-responder and security teams. Access requires an organization account issued by a CEM administrator; there is no public sign-up.

Privacy Policy

Utimaco First Responders Mobile Application

Provider / Operator: Utimaco Technologies Ltd., No. 32 Maskit Street, Herzliya, Israel, 46733

Privacy Contact: ws-support@utimaco.com

Effective Date: July 26, 2026 Version: 1.0

This Privacy Policy explains how Utimaco Technologies Ltd. (“Utimaco”, “we”, “us”) collects, uses, shares, and protects personal data when you use the Utimaco First Responders mobile application (the “App”), which is a client of the Utimaco CEM SaaS platform (together, the “Service”). It applies to the App on the Apple App Store and Google Play, published under Utimaco’s developer accounts. It is written to comply with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws in the regions where the App is used.

1. Controller / Processor Roles

The App is a white-label product deployed by organizations (“Organization”) for their personnel. In most cases:

Your Organization is the data controller for personal data processed through the App (e.g., your profile, chat, tasks, duty status, location while On Duty).
Utimaco acts as a data processor on the Organization’s behalf under a data processing agreement (Art. 28 GDPR).
For limited purposes — operating, securing, maintaining, and improving the platform and meeting Utimaco’s own legal obligations — Utimaco acts as an independent data controller.

If you are unsure who your Organization is or how to reach its administrator, contact us and we will help direct your request.

2. What Data We Collect

3. Device Permissions and Why We Need Them

The App requests the following device permissions. Each is used only for the features described. You can change permissions at any time in your device settings, though some features will not work without them.

Permission

Why We Request It

Location — Precise & Approximate (While-In-Use and Background)

Emergency SOS, real-time responder location sharing, responder tracking while On Duty, and nearby / location-based hazard alerts.

Microphone

Push-to-talk (PTT) voice communications and video calls.

Camera

Taking a profile photo and capturing images to share in chat and during video calls.

Photos / Photo Library

Attaching existing images to your profile and chat messages.

Push Notifications

Emergency alerts, incoming push-to-talk, and chat messages.

Background Location / Background Execution

Keeping responder location tracking and push-to-talk active when the App is not in the foreground, so alerts and coordination continue working in the field.

4. Location Tracking: When It Starts and Stops

◆ Background Location is central to this App’s core purpose. As a first-responder coordination tool, the App must share a responder’s location in real time — including when the phone is locked or the App is in the background — so that command and teammates can locate and coordinate responders during an emergency. Without background location, SOS and live coordination would not function.

Location collection is strictly controlled by your On Duty / Off Duty status:

When it starts: Location is collected and transmitted only when all of the following are true — you are logged in, you have granted location permission, and you have explicitly set your status to On Duty.
While On Duty: The App may continue to collect and transmit your location in the background to support emergency SOS, responder coordination, tracking, and situational-awareness features.
When it stops: As soon as you switch to Off Duty, location tracking stops and no further updates are transmitted. Location is also not transmitted when you are logged out or have not granted permission.
SOS exception: When you trigger an emergency SOS, your live location is shared with your Organization as part of the alert so responders can reach you.
Who can access it: Your location is accessible to authorized members of your Organization (e.g., command and coordinating responders) as configured by your Organization, and to Utimaco solely as processor to operate the Service. It is not sold and is not used for advertising.

5. Why We Process Your Data and Legal Bases

We (and your Organization) process your data to: authenticate you; enable communication (chat, PTT, video); deliver emergency SOS and hazard alerts; provide live location and coordination; manage tasks, duty status, and rosters; send push notifications; maintain audit and operational logs; and keep the Service secure and reliable.

Where Utimaco acts as processor, the legal basis is determined by your Organization (the controller). Where Utimaco acts as controller, our legal bases under the GDPR are: performance of a contract (Art. 6(1)(b)); legitimate interests in operating and securing the Service (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c)); and, where required, consent (Art. 6(1)(a)), which you can withdraw at any time. Some safety-related processing may also rely on protecting vital interests (Art. 6(1)(d)) or public-interest tasks assigned to your Organization (Art. 6(1)(e)).

6. Who Can Access Your Data

Your Organization and its authorized users, according to your role and its configuration.
Utimaco personnel with a need to operate, support, and secure the Service, under confidentiality obligations.
Sub-processors providing infrastructure (see Section 7).
Authorities, where required by law.

We do not sell your personal data and do not use it for third-party advertising.

7. Sub-Processors and Infrastructure

The Service runs on third-party cloud and messaging infrastructure. Our principal sub-processors are:

Sub Processor

Address

Purpose

Amazon Web Services (AWS)

Kleyerstraße 88-90, 60326 Frankfurt am Main, Germany

The mobile application is a client of Utimaco’s CEM (Critical Event Management) platform, a SaaS solution hosted on AWS in Frankfurt.

Google (Firebase)

hosted in the Europe (Frankfurt) region.

Authentication, Realtime Database, Cloud Functions, Storage, and Cloud Messaging (FCM)

Google (FCM)

Delivery of push notifications on Android and cross-platform messaging.

Apple (APNs)

Delivery of push notifications on iOS devices.

LiveKit

Open-source real-time SFU for WebRTC audio and video (self-hosted on AWS infrastructure)

Jitsi

Open-source video conferencing platform (self-hosted on AWS infrastructure)

These providers process data on our behalf under data processing agreements with appropriate safeguards. A current list of sub-processors is available on request.

8. Where Your Data Is Stored and International Transfers

User and operational data are hosted within Google Firebase infrastructure in the Europe (Frankfurt) region. Push notification delivery via Google (FCM) and Apple (APNs) may involve limited routing data processed outside the EU/EEA. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards under the GDPR, such as the European Commission’s Standard Contractual Clauses and, where applicable, adequacy decisions. You can request more information about these safeguards using the contact details in Section 17.

9. Retention Periods

We keep personal data only as long as necessary for the purposes above, according to your Organization’s retention settings and applicable law. As general guidance:

Account & profile data: retained for as long as your account is active; deleted or anonymized after account deletion.
Chat messages and shared images: retained per your Organization’s configuration; removed on account deletion where applicable.
Location data: retained only as needed for coordination, incident review, and safety, per your Organization’s settings.
Operational and audit logs: retained for security, accountability, and legal compliance for a limited period defined by your Organization and applicable law.

Some metadata, aggregated statistics, and backup copies may persist for a limited time until overwritten and may no longer identify you.

10. Operational and Audit Logging

To keep responders safe and the Service accountable, the platform maintains operational and audit logs relating to alerts, tasks, acknowledgements, communications, user activity, duty status, and location events. These logs are used for emergency coordination, incident review, security, and legal compliance, and are accessible to authorized Organization users and to Utimaco as processor.

11. Your Rights

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase your data; restrict or object to processing; and data portability. Where processing relies on consent, you may withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority.

Because your Organization is usually the controller, please direct requests to your Organization in the first instance. You may also contact Utimaco using the details in Section 17, and we will assist or forward your request to the relevant controller. We aim to respond within one month.

12. Account and Data Deletion

◆ In-App Deletion Available. You can delete your account and data from within the App. Go to the account / settings area and select the account-and-data deletion option. This initiates deletion of your account and associated personal data, subject to limited retention required by law or your Organization (e.g., certain audit logs and backups until overwritten).

You can also request deletion by contacting us at the address in Section 17. Some data may be retained where we have a legal obligation or overriding legitimate interest, for the minimum period required.

13. Security

We apply appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, authentication, and restricted, role-based access on a need-to-know basis. No method of transmission or storage is completely secure, but we work to protect your data and respond promptly to any incident.

14. Children

The App is intended for authorized personnel of licensing organizations and is not directed to children. You must be at least 18 years old (or the higher minimum age required by your Organization or applicable law) to use it. We do not knowingly collect data from children below the applicable age.

15. Languages

The App currently supports English, French, Spanish, German, Danish, and Hebrew, with more languages planned. If there is any conflict between translated versions of this policy, the English version prevails to the extent permitted by law.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where appropriate, notify you through the App. Please review it periodically.

17. Contact

Utimaco Technologies Ltd., No. 32 Maskit Street, Herzliya, Israel, 46733.

Contact: ws-support@utimaco.com

Terms of Service

Provider: Utimaco Technologies Ltd., No. 32 Maskit Street, Herzliya, Israel, 46733

Contact: ws-support@utimaco.com Version: 1.0

Effective Date: July 26, 2026

◆ Important Safety Notice. The Utimaco First Responders application is a coordination and communication tool. It is not a substitute for official emergency services. In a life-threatening emergency, always contact your local emergency number (e.g., 112 in the EU, 911 in the US, or the number applicable in your region) first. We do not guarantee message delivery, alert delivery, service availability, responder availability, or response times. See section 8.

1. Who We Are and What These Terms Cover

These Terms of Service (“Terms”) form a binding agreement between you (“you”, “User”) and Utimaco Technologies Ltd. (“Utimaco”, “we”, “us”, “our”), the provider and operator of the Utimaco CEM SaaS platform and the Utimaco First Responders mobile application (the “App”, together with the platform, the “Service”).

By downloading, accessing, or using the App, you agree to these Terms. If you do not agree, do not use the App. If you use the App on behalf of an organization, you confirm that you are authorized to accept these Terms for that organization.

2. The Service and White-Label Deployments

The App is a client of the Utimaco CEM SaaS platform. It provides emergency-response coordination and communication features, including push-to-talk (PTT) voice, one-to-one video calls, text and image chat, emergency SOS, location-based alerts, live location sharing, task and duty-status management, and responder coordination.

The App is offered as a white-label, customizable product. An organization that licenses the Service (your “Organization”) may configure branding, features, content, and operational settings. The exact features, appearance, and content available to you depend on your organization’s configuration.

3. Eligibility and Accounts

The App is intended for use by authorized members of licensing organizations and is not directed to children. You must be at least 18 years of age (or the higher minimum age required by your organization or by applicable law in your region) to use the App. Access requires authentication; you may only use credentials issued to or created by you.

You are responsible for keeping your credentials confidential and for all activity under your account. Notify your organization’s administrator or Utimaco promptly of any unauthorized use.

4. Your Organization’s Role

The App is typically deployed by an organization for its personnel. Your organization determines who may use the App, which features are enabled, and how the Service is used operationally. For most personal data processed through the App, your organization acts as the data controller and Utimaco acts as a data processor on its behalf under a data processing agreement (Art. 28 GDPR). See also Section 11 and the Privacy Policy.

5. Acceptable Use

You agree not to:

use the App for any unlawful purpose or in violation of your organization’s policies;
send false alarms, fraudulent SOS alerts, or knowingly misleading location or status information;
upload, share, or transmit content that is unlawful, harassing, defamatory, or infringes the rights of others;
attempt to disrupt, reverse-engineer, decompile, or gain unauthorized access to the Service or its infrastructure;
use the App to track individuals outside its intended operational purpose or without a lawful basis;
interfere with emergency or safety functions relied upon by other users.

6. User-Generated Content

The App allows you to exchange chat messages and images and to set a profile image (“User Content”). You retain any rights you hold in your User Content. You grant Utimaco and your Organization a limited license to host, store, transmit, and display User Content solely to operate the Service and deliver it to intended recipients.

You are solely responsible for your User Content and confirm you have the rights necessary to share it. Because the App is built for real-time operational communication, Utimaco does not pre-screen or actively moderate User Content, and content moderation capabilities are limited. Your organization is responsible for governing appropriate use among its personnel. Utimaco may remove content or restrict access where required by law or to protect the Service or its users.

7. Emergency and Safety Features

The App includes safety features such as emergency SOS, real-time hazard alerts, push-to-talk, video calls, live location sharing, and responder coordination. Location tracking is controlled through an On Duty / Off Duty status you set. Location is transmitted to the platform only while you are authenticated, have granted the required permissions, and have set your status to On Duty. When you switch to Off Duty, location tracking stops and location updates are no longer transmitted. While On Duty, the App may continue to collect and transmit location in the background to support SOS, responder coordination, and situational awareness. The Privacy Policy explains this in full.

8. Disclaimers and No Guarantee of Availability

The Service is provided on an “as is” and “as available” basis. To the fullest extent permitted by law, Utimaco does not warrant that:

messages, PTT transmissions, video calls, SOS alerts, or hazard alerts will be delivered, delivered on time, or received;
the Service, any feature, or any specific responder will be available, online, or able to respond at any given time;
response times, location accuracy, or coverage will meet any particular standard;
the Service will be uninterrupted, secure, or error-free.

Availability and delivery depend on factors outside Utimaco’s control, including device settings, operating-system behavior, network and mobile-carrier conditions, third-party push services, battery and power state, and your permission choices. You should not rely on the App as your sole means of raising or responding to an emergency.

9. Limitation of Liability

Nothing in these Terms limits liability that cannot be excluded by law, including liability for death or personal injury caused by negligence, for intent or gross negligence, for the absence of a guaranteed characteristic, or under mandatory product-liability or data-protection law.

Subject to the foregoing, and to the extent permitted by applicable law: Utimaco is liable without limitation for intent and gross negligence. For slight negligence, Utimaco is liable only for breach of a material contractual obligation (an obligation whose fulfillment is essential to the proper performance of the contract and on which you may reasonably rely), and in that case liability is limited to the foreseeable damage typical for this type of agreement. Utimaco is not liable for indirect or consequential damages, loss of data, or lost profits to the extent permitted by law, nor for outcomes arising from your reliance on the App as a substitute for official emergency services or from circumstances described in Section 8.

Where your use is governed by your organization’s commercial agreement with Utimaco, the liability provisions of that agreement govern the relationship between Utimaco and your Organization.

10. Third-Party Services and Infrastructure

The Service relies on third-party cloud and messaging infrastructure, including Google Firebase services (authentication, real-time database, cloud functions, storage, and cloud messaging), Firebase Cloud Messaging (FCM), LiveKit, Jitsi and the Apple Push Notification service (APNs). Your use of these components may also be subject to the relevant provider’s terms. Utimaco is not responsible for third-party services except as set out in these Terms and the Privacy Policy.

11. Data Protection

Utimaco processes personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws, as described in the Privacy Policy, which forms part of these Terms. Depending on the deployment, Utimaco acts as a data processor on behalf of your organization (the controller) or, for limited purposes such as operating and securing the platform, as an independent controller. Where Utimaco acts as a processor, processing is governed by a data processing agreement between Utimaco and your Organization.

12. Intellectual Property

The App, the Utimaco CEM platform, and all related software, content, and trademarks are owned by Utimaco or its licensors. Except for the limited right to use the App as intended, no rights are granted to you. Customer branding and content configured by an organization remain the property of that Organization.

13. Suspension and Termination

Your access is tied to your organization’s license and your authorized account. Utimaco or your Organization may suspend or terminate access if you breach these Terms, if required by law, or if the underlying license ends. You may stop using the App at any time and may delete your account and associated data using the in-app account and data deletion functionality (see the Privacy Policy).

14. Changes to the Service and These Terms

We may update the Service and these Terms from time to time, for example to reflect new features, legal requirements, or security improvements. We will post the updated Terms with a new effective date and, where appropriate, provide notice through the App. Continued use after changes take effect constitutes acceptance.

15. App Store Terms

The App is distributed through the Apple App Store and Google Play under Utimaco’s developer accounts. Your download and use are also subject to the applicable app store’s terms. Apple and Google are not parties to these Terms and are not responsible for the App or its content. Where required, Apple is a third-party beneficiary of these Terms and may enforce them against you.

16. Governing Law and Disputes

These Terms are governed by the laws of the State of Israel, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods. Mandatory consumer-protection rights available to you in your country of residence remain unaffected. To the extent permitted by law, the competent courts of Tel Aviv, Israel have jurisdiction.

17. Contact

Utimaco Technologies Ltd., No. 32 Maskit Street, Herzliya, Israel, 46733 — ws-support@utimaco.com

Account & Data Deletion

u.warn is used by organizations that license Utimaco's Critical Event Management (CEM) platform. Your account is provided to you by your organization. You can delete your account and its associated data in either of the following ways.

Option 1 — Delete in the app (fastest)

Open u.warn and sign in.
Go to Settings (the gear icon).
Tap Delete account.
Confirm. Your account and associated data are permanently removed.

This performs a full deletion of your account and its data from our systems and from the device.

Option 2 — Request deletion by email

If you can no longer sign in, email ws-support@utimaco.com from the address associated with your account, with the subject line "u.warn account deletion". Include your organization name and the username or email on the account so we can verify and process the request. We will confirm once the deletion is complete.

What is deleted

When your account is deleted, we remove the personal data associated with it, including:

Your profile (name, email, phone number, avatar)
Your account credentials and authentication records
Your location data and live-presence records
Your messages, push-to-talk, call, task, and alert activity tied to your account
Device identifiers and push notification tokens

What may be retained

Records we are legally required to keep, and security or audit logs, may be retained for a limited period of up to 12 months and then deleted, as described in our Privacy Policy.
Content shared into shared team channels may persist for other members, with your personal identifiers removed, where required for the organization's operational records.

How long it takes

Deletion requests are completed within 30 days of verification.

Questions

Contact ws-support@utimaco.com.

Support

u.warn First Responder is a business tool provided to members of organizations that use Utimaco CEM. If you need help with the app, contact your organization's CEM administrator first for account and access questions.

For product support, contact us:

Email: ws-support@utimaco.com

Please include your organization name and a description of the issue. Do not include passwords. We aim to respond during normal business hours.