Security / Leaglity Concerns

ComReg, DPC compliance
We have fully cleared our service with the office of the Data Protection Commissioner and ComReg.

Is there any retention of personal data?
The only data that is retained is the MAC address of the bluetooth antenna on the device. This is put to no purpose other than us identifying unique devices for content delivery compatibility. The information is stored until the campaign is finished. This data is only used for this purpose.
There is absolutely no personal data collected e.g. Phone number or Network provider.

Will there be advance warning that you are entering an area with active Bluetooth marketing?
Yes, We endeavor to publicise locally all bluetooth zones we run.

How can an individual exercise their right not to receive such marketing material?
Users are prompted as they enter the bluetooth area "would you like to receive a bluetooth message from XYZ". Depending on their answer our service can be set so they will not be asked again for a pre defined period of time for that campaign. At the moment we are setting this to "never ask again". Our "Blacklisting" feature is one of the major strengths of our system. If users would prefer never to be asked to receive a prompt from our service we can permanently blacklist them upon provision of their mobile phone MAC address.

Given that the material is being sent electronically, is it the contention that compliance with SI 535 of 2003 / SI 526 of 2008 is reached by virtue of the use accepting the “pairing” request?
Compliance is reached by way of our service prompting the user to answer yes or no to receive the campaigns. Pairing and data transmission is on a individual permission per individual transmission basis. Our system does not retain permission to send further content to the device after the initial acceptance.

Compliance is fulfilled through the below taken from SI526:

“(1) A person shall not use an electronic communications network
to store information, or to gain access to information stored in the
terminal equipment of a subscriber or user, unless—
(a) the subscriber or user is provided with clear and comprehensive
information in accordance with the Data Protection Act
1988, which—
(i) is both prominently displayed and easily accessible, and
(ii) includes, without limitation, the purpose of the processing,
and
(b) the subscriber or user is offered by the data controller the
right to refuse to consent to that use.”.