Privacy policy.

Just Arrived is operated by ReadyLive Technologies, CVR 35622594, Sundholmsvej 31, 4. tv, 2300 København S, Denmark (“ReadyLive”, “we”).

Visitor data registered on a customer's kiosk belongs to that customer. The organization you are visiting is the data controller and decides what is collected and for how long. ReadyLive is the data processor and only acts on that customer's documented instructions.

Account data — administrators, employees added by the customer, and billing contacts — is processed by ReadyLive as data controller in order to provide, secure and bill the service.

Depending on the office's check-in flow: name, and optionally company, email address, phone number, vehicle license plate — and, if the office has enabled those steps, a photo taken at the kiosk and a signed agreement. We also record the host being visited and the check-in and check-out timestamps.

The purposes are reception and visitor management, notifying the host of an arrival, and evacuation safety. The last one is why an email address or phone number may be required — during an emergency roll call it is the only way to reach a visitor and let them confirm they are safe.

If the organization you are visiting has turned on the photo step, the kiosk takes a single photograph of you with the tablet's front camera during check-in. It is a plain photograph: we do not perform facial recognition, face detection or any other biometric processing, and no biometric identifiers such as faceprints are ever created. The photo is used solely so that reception staff and your host can recognize you when they come to pick you up.

The photo is stored privately in our EU (Frankfurt) hosting, is served only through short-lived signed links, and is never shared with third parties or used for any other purpose. It is stored with your visit record and lives no longer than it: when the visit passes the office's retention window (90 days by default), the automated nightly purge deletes the photo file together with the visit's other personal data. It is also deleted immediately if the organization erases your visit on request.

If the office requires signing an agreement, your typed name and drawn signature are stored with the exact version of the agreement you signed, in the same private storage and under the same retention and erasure rules.

Each office sets its own retention window. When a visit record passes that window it is automatically anonymized: name, company, email, phone and license plate are removed and only non-identifying statistics remain. This runs as an automated nightly purge — no manual step is required.

When a customer connects Slack, Microsoft Teams, Discord or Google Chat, arrival notices containing the visitor name, company, host and office are delivered through those services. That delivery happens under the customer's own agreements with those providers, on the customer's own workspace or server.

Google Chat. When a Google Workspace user adds Just Arrived in Google Chat or messages it, Google sends us that user’s email address, display name and the identifier of the chat space. We use the email address only to match the user to an employee record their organisation has created, and the space identifier only to deliver arrival messages and receive their replies. We do not read other messages, contacts or files, and we do not share this information with anyone or use it for advertising. Just Arrived’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small set of subprocessors for hosting, database, email, billing and — only when you connect them — chat notifications. The canonical, always-current list with purposes, data processed and locations lives on the subprocessor page. Material changes are announced by email with at least 30 days notice.

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection.

If you checked in as a visitor, contact the organization you visited — they are the controller for that record. We assist our customers in responding to such requests without undue delay.

You may also lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

You can have the personal data from a visit deleted at any time — you do not need an account to ask.

1. Contact the organization you visited (they control the visit data and can erase it directly), or
2. Email support@justarrived.io with the office you visited and the approximate date and time of your visit, and
3. We verify the request and erase the visit.

Erasure removes your name, company, contact details, photo, signature and agreement acceptance from the visit. What is kept: an anonymized record that a visit took place (no personal data), and any information we are legally required to retain. Independently of requests, visit data is deleted automatically when it passes the office's retention window — 90 days by default.

Our Cookie Policy explains every cookie and browser-storage technology we use, why we use it, and how long it remains. You can review or change your advertising-cookie choice there or through Cookie settings in the footer at any time.

Questions about this policy: privacy@justarrived.io.