Privacy notice

Who we are

Access Controller is a product of 2plus1.com PC Services Limited ("2plus1", "we"), Leeds, West Yorkshire, United Kingdom. For anything to do with personal data, contact us through 2plus1.com or the contact page.

This website

The website is static and sets no cookies of its own. We do not run analytics or advertising trackers. Fonts are loaded from Google Fonts, which means your browser requests font files from Google's servers and Google receives your IP address as part of that request; see Google's privacy policy for how they handle it. If you would rather that did not happen, the site still works with fonts blocked.

Our web host keeps standard server logs (IP address, requested page, browser type, time) for security and fault-finding. These are kept for a short period and then deleted.

The contact form

When you use the contact or demo form we collect your name, email address and message, plus your company, phone number and number of doors if you give them. We use this only to reply to your enquiry and, if you become a customer, to set up your account. The legal basis is our legitimate interest in responding to enquiries and, where relevant, taking steps at your request before entering into a contract. The form is delivered to us by email; we keep enquiries for up to 12 months unless they lead to a customer relationship.

The hosted Access Controller service

If your organisation uses the hosted service, the people, photos, fob codes, phone numbers, PINs and access logs you put into it are your organisation's data. Your organisation is the data controller and 2plus1 is a data processor acting on your instructions under a written data processing agreement. We host the service on servers in the United Kingdom, hold each customer's data in its own tenant, and use it only to run the service, keep it secure and support you. We do not sell it or use it for any other purpose.

Self-hosted installations run on your own servers and 2plus1 has no access to the data in them unless you ask us to help with support.

If you are an individual whose details are held in a customer's Access Controller system (for example a gym member or a resident), the organisation that runs the door is the data controller and your rights requests should go to them. We will help them respond.

Security

The panel is served over HTTPS, passwords are stored hashed, PINs are stored hashed and never displayed, and the link between controllers and the panel is authenticated. Access to hosted systems by 2plus1 staff is limited to what is needed to run and support the service and is logged.

Your rights

Under UK GDPR you have the right to ask what personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to receive a copy in a portable form. To exercise any of these, contact us as above. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Changes

We will update this notice if how we handle data changes. The date below shows when it was last revised.

Last revised: September 2026.