Privacy

HqO is committed to protecting personal data and complies with applicable data protection laws in the regions where its customers operate, including the GDPR in the EU, EEA, and UK, the CCPA in California, and PIPEDA in Canada. This page explains what personal data HqO processes, how it is handled, and the rights available to individuals.

For security controls and certifications, see the Security page.

Last updated: August 2026

Data Protection Roles

HqO's customers are the Data Controllers and determine the purposes and means of processing personal data. HqO acts as the Data Processor, processing personal data on its customers' behalf and only in accordance with their instructions and the Data Processing Addendum (DPA).

Personal Data We Collect

HqO collects a limited set of personal data: users' names, work email addresses, and, in a limited manner, main work location. Optional profile details, such as an avatar, may also be provided. Location data is collected only for customer-enabled integrations, such as workspace analytics or building access, where it is required. In line with the principle of data minimization, HqO collects only the data needed to deliver the service.

Your Privacy Rights

Individuals have the right to access, correct, and delete their personal data. HqO supports its customers in responding to data subject requests in line with the GDPR, CCPA, and PIPEDA. HqO also conducts Data Protection Impact Assessments (DPIAs) on a regular basis to evaluate and reduce privacy risk.

Data Anonymization for Analytics

Personally identifiable information is removed during anonymization, and data is aggregated into group insights. For example, workspace occupancy shows trends rather than individual behavior. All analytics surface anonymized, aggregated data only, never person-level data. By default, users cannot see other users in the mobile app. This approach complies with the GDPR and CCPA.

International Data Transfers

Where personal data is transferred internationally, HqO relies on Standard Contractual Clauses (SCCs) as the transfer mechanism, in line with the requirements of the GDPR.

Data Residency

Customer data is hosted in specified AWS regions. Data for EU customers is hosted in Frankfurt (EU Central) to meet GDPR residency requirements, and data for other customers is hosted in Northern Virginia (US East).

Data Retention

HqO retains personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting obligations. By default, user data is purged after contract termination, and retaining data beyond termination requires written authorization.

Data Deletion

HqO supports user data deletion requests under the GDPR and CCPA. Submit a deletion request at hqo.com/request-your-data.

User Preferences and Location Services

Users manage passwords, avatars, and notification preferences from the Settings screen in the app. Individual notification types can be enabled, disabled, or unsubscribed at any time.

Newsletter Subscription

During onboarding, the app may prompt you to subscribe to the building newsletter. Tapping Subscribe is a one-time action. Once you opt in, the subscription prompt no longer appears in onboarding or in Privacy settings, and it cannot be toggled off from within the app. To unsubscribe, use the Unsubscribe link at the bottom of any newsletter email.

Location Services

Location Services are required for Mobile Access features. Depending on the access provider, HID recommends setting Location Services to Always so the app can communicate with readers in the background.

Sub-processors

HqO uses a limited number of sub-processors to deliver its services, such as Amazon Web Services for hosting and Braze for push notifications. The current and authoritative list of sub-processors is maintained in the Data Processing Addendum on the Legal Hub.

Contact

For questions about HqO's privacy practices, email privacy@hqo.co.

The complete privacy policy is available at hqo.com/privacy.

Security — security controls and certifications