Concept Pro Connect Privacy Policy

Last updated: May 13, 2026

This Privacy Policy describes how CP Surveillance ("we," "us," or "our") collects, uses, and discloses your personal information. This policy is designed to comply with the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 (UK GDPR). Where required by law, we will request your explicit consent before collecting or using your personal data. You may withdraw your consent at any time via your App settings or by contacting us.

  1. Legal Basis for Processing

We process your personal data under the following legal bases:

  • Performance of a contract (to provide app services)
  • Legitimate interests (including maintaining service security, preventing unauthorized access, and improving App performance)
  • Consent (push notifications and optional App permissions)
  1. Data Controller Identity
  • Registered Company Name: CP Surveillance Ltd.
  • Address: 54 Thomas Street, Lees, Oldham, OL4 5BT, United Kingdom
  • Contact Email: info@concept-pro.co.uk
  1. Information We Collect
    • Data Processed on Our Servers

If you choose to register for a Concept Pro cloud account—required for features such as cloud-synchronised device lists, P2P device registration and connection, and event mobile push notifications, the following information is collected and stored on our servers:

  • User Identity: User ID, Email Address, and Password (stored via one-way cryptographic hashing).
  • Device Metadata: NVR MAC address, IPv4/IPv6/DDNS address, HTTP(S) and RTSP(S) port numbers, device identifiers and connection information for P2P connection
  • Communication: Mobile Push Token for event notifications
  • Crash Reports: may include device model, OS version, and app usage diagnostics.
    • Data Stored Locally on Your Device

Whether the Concept Pro Connect mobile app is used with a Concept Pro cloud account or if it is used without an account, registering an NVR requires inputting a valid NVR user ID and password. This information is stored locally on your mobile device only. The password credentials are encrypted on the device but are not uploaded to or stored on our cloud servers. If you delete the App or lose your device, these specific credentials must be re-entered manually. Data stored locally on your device remains under your control and is not accessible to us unless transmitted through the App.

When using the App without a Concept Pro cloud account, then the following information is also saved to your mobile device.

  • Device Metadata: NVR MAC address, IPv4/IPv6/DDNS address, HTTP(S) and RTSP(S) port numbers.

When using the App with a Concept Pro cloud account, then the following information is also saved to your mobile device.

  • User Identity: User ID and Password (stored via one-way cryptographic hashing).
  • Device Metadata: NVR MAC address, IPv4/IPv6/DDNS address, HTTP(S) and RTSP(S) port numbers, and device identifiers and connection information for P2P connection.
  • Communication: Mobile Push Token for event notifications
  1. App Permissions

To provide specific features, the App requires the following permissions on your mobile device. Permission can be revoked anytime through the mobile device operating system Settings.

  • Local Network Access: Required to discover, configure, and connect to NVR devices within your local area network (LAN).
  • Camera: Required to scan NVR device QR code when choosing to register via QR code.
  • Microphone: Required to perform two-way audio broadcasts to a connected NVR and/or IP camera audio output.
  • Notifications: Required to deliver real-time event notifications.
  • Photo Gallery: Required to save snapshots to your mobile device.
  1. Purpose of Processing

We process your data to provide the following features:

  • Device Registration: adding devices using port forwarding or P2P cloud connection methods, either by manually inputting device connection information, scanning QR code, or scanning the currently connected network for devices.
  • P2P Cloud Service: allowing for convenient remote connections to NVR devices without manual port forwarding and enabling transmission of event push notifications.
  • Device List Sync: allowing for user to log-in to the App on another device and automatically synchronise their registered devices.
  • Device Operation: enabling live video viewing, audio communication, device control, playback of recordings, event management, and snapshot capture.
  • Stability: using Firebase Crash Reports to diagnose software errors.
  • Recovery: allowing for password recovery/reset for the account if the password is forgotten.
  1. International Data Transfers

We primarily store your data within the United Kingdom and European Economic Area (EEA). However, some of our service providers may process limited data outside these regions. A full list of these providers is available in section 7 below.

 

For example:

  • We use Google Firebase for crash reporting and push notifications, which may involve processing data (such as push tokens and diagnostic information) on servers located in the United States.
  • Authorised support and development personnel located in South Korea may access data where necessary to maintain and support the service. Backups of data may also be saved in South Korea by these authorised personnel to ensure continuity of service.

 

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including:

  • Adequacy decisions approved by the UK Government or European Commission
  • Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA)
  • Participation in recognised frameworks such as the EU-U.S. Data Privacy Framework (and UK Extension), where applicable

These safeguards ensure your personal data is protected to a standard equivalent to that within the UK and EEA.

You may request further information about these safeguards by contacting us at info@concept-pro.co.uk.

 

  1. Sharing Information

We use third party service providers to facilitate some services, including, but not limited to, sending emails, hosting servers, storing data and collected information, facilitating P2P cloud device registration and connection, transmitting push notifications, and managing the services or products we provide. These providers act as data processors and are contractually bound to process data only on our behalf. We only share the minimum data necessary for these services. Third party providers include:

  • Google Firebase (crash reporting, analytics)
  • Apple Crash Report (crash reporting; user opt-in)
  • Amazon Web Services (server hosting, database storage)
  • Nabto WebRTC (P2P networking)
  • Apple Push Notification Service (APNs)
  • Firebase Cloud Messaging
  • SendGrid (password recovery)

 

We do not sell your personal data to third parties.

 

We will not share information we collect with other third parties, except in the following circumstances:

  • With your explicit consent
  • To comply with applicable laws and regulations
  • To protect our rights and property
  • In the event of merges, acquisitions, or asset transfers, we may transfer your information to third parties involved in the transaction.
  1. Data Retention

We retain account data for the duration of the account only, and users can delete their account upon request. Device data is retained only while it is linked to an active account. All data linked to the account will be deleted from our active systems promptly. Complete deletion, including backups, may take up to 90 days.

 

  1. Deleting User Account and Data

You can easily delete your data and Concept Pro account at any time by following the steps below:

  1. Open the App and login using your account login.
  2. Tap Menu icon and select Settings.
  3. Select ‘Delete account’ option.
  4. Enter your password, indicate you have read and understand the notice, and proceed. This will delete your account.
  5. Delete the App from your device.

All data linked to the account will be deleted from our active systems promptly. Complete deletion, including backups, may take up to 90 days.

Additionally, a specific registered NVR device can be easily deleted by tapping the options icon under the device in the Device List and selecting Delete Device.

  1. Information Security

We implement reasonable security measures to protect the information we collect, including encryption in transit (HTTPS/TLS), encryption at rest for sensitive data, and access controls. Some device connections (such as RTSP/HTTP) may not use encrypted protocols, depending on device configuration. However, no security system is completely impenetrable, and we cannot guarantee the absolute security of your data. We do not use your personal data for automated decision-making or profiling.

  1. Data Subject Rights

You have the following rights under data protection law:

  • Right of access – obtain a copy of your data
  • Right to rectification – correct inaccurate data
  • Right to erasure – request deletion of your data
  • Right to restriction – limit processing
  • Right to data portability – receive your data in a structured format
  • Right to object – object to processing based on legitimate interests
  • Right to withdraw consent – at any time where processing is based on consent
  • Right to lodge a complaint – with the UK Information Commissioner’s Office (ICO) or your local EU supervisory authority. You can contact the UK Information Commissioner’s Office (ICO) at https://ico.org.uk or via their helpline.

To exercise any of these rights, contact us at info@concept-pro.co.uk. We will respond to all legitimate requests within one month.

  1. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time. Changes will be effective immediately upon posting on the Concept Pro site. We encourage you to periodically review this policy for any changes.

  1. Contact

If you have any questions or concerns about this Privacy Policy, please contact us via the contact information provided on the concept-pro.co.uk site or at info@concept-pro.co.uk.