Fictional product, illustrative draft. Not legal advice.

Fernlook Scout -- Privacy Notice¶

Draft for counsel review. Not legal advice. Law as of 20 October 2026.

This notice covers the diagnostic and usage data your Fernlook Scout camera sends us, your Scout Cloud account data and photos if you subscribe, and your account and order data. It does not cover cookies on our website, which has its own cookie notice.

Who is responsible for your data¶

[Fernlook Optics B.V.], Kerkstraat 24, 1017 GB Amsterdam, Netherlands, legal@fernlook-optics.test. [Phone number, if the business primarily reaches consumers by phone -- not provided; add if applicable.]

[Where a data protection officer is appointed, add a line naming how to reach them, and omit this paragraph entirely where none is appointed -- not stated by the client; confirm with counsel.]

What we collect, why, and for how long -- short version¶

Fernlook Scout is a Wi-Fi connected camera. Whenever your camera is online, it sends us diagnostic and usage data about the camera itself: device temperature, battery health, Wi-Fi signal quality, firmware version, and crash logs. This is separate from your wildlife photos, which stay on your own storage or in Scout Cloud if you subscribe. We do not sell this diagnostic data. The full detail, including every legal basis, every recipient, and how long each category is kept, is below, together with how to exercise your rights.

What we collect, why, and for how long -- full detail¶

Diagnostic and usage data¶

What is collected: device temperature, battery health, Wi-Fi signal quality, firmware version, and crash logs, transmitted automatically whenever your camera is connected to Wi-Fi.

Where it comes from: directly from your camera.

Why: to monitor camera health, diagnose and fix defects, plan firmware updates, and provide support if you contact us about a problem.

Our legal basis: [EU] our legitimate interest in keeping the product working as intended, maintaining security, and providing support (Art. 6(1)(f) GDPR) -- the specific interest is: detecting and fixing hardware or firmware faults before they affect you, and securing the device against vulnerabilities. [Where any part of this data could instead be framed as necessary to perform the sales/support contract rather than legitimate interest, state that basis instead for that part -- see open-points.md for the classification question this needs settled per activity rather than assumed as a single blanket basis.]

Who else sees it: [name any cloud infrastructure provider, analytics vendor, or support-ticketing vendor Fernlook actually uses -- not provided by the client; placeholder for counsel/product to fill in before publication]. We do not sell this data.

Transferred outside the EEA: [state whether diagnostic data is processed outside the EEA, for example on a US cloud provider, and the adequacy decision or Art. 46 safeguard relied on -- not stated by the client; this is a required disclosure once the infrastructure is known].

How long we keep it: [state the retention period or criteria -- not provided by the client; a bare "as long as necessary" does not meet the GDPR floor and must be replaced with a period or criteria before publication].

Do you have to give us this: providing this data is a function of owning a Wi-Fi connected camera; a camera not connected to Wi-Fi does not transmit it. [State plainly in the retail packaging/setup flow that an offline-only mode, if one exists, avoids this transmission -- see implementation-requirements.md.]

Scout Cloud account and photos (subscribers only)¶

What is collected: your account details (name, email, payment details processed by our payment provider), and the wildlife photos you choose to store in Scout Cloud.

Where it comes from: directly from you.

Why: to provide the Scout Cloud storage service you subscribed to, and to bill you for it.

Our legal basis: performance of the Scout Cloud contract with you (Art. 6(1)(b) GDPR), and a legal duty we are under for billing and tax records (Art. 6(1)(c) GDPR).

Who else sees it: our payment processor, to process your payment, and our cloud storage provider, to host your photos; neither uses your photos for its own purposes. We do not sell your photos or your account data.

How long we keep it: your photos and account data for as long as your Scout Cloud subscription is active, and for [retention period after cancellation -- not provided; must be stated] after cancellation to allow you to reactivate or export, unless you ask us to delete them sooner.

Species-suggestion feature¶

What is collected: nothing beyond the photo itself, which is processed on your device by the App to generate a suggested species label. This processing happens on your device, not on our servers, unless you choose to store the photo in Scout Cloud.

Why: to show you a convenience label on your photos.

Our legal basis: [this on-device processing does not transmit data to Fernlook and does not constitute a separate collection of your personal data by Fernlook beyond the photo itself, which is handled under the Scout Cloud or local-storage entries above as applicable -- confirm with counsel that no telemetry from this feature reaches Fernlook's servers; see open-points.md, OP-3].

Automated decisions: this feature does not make any decision about a person and does not produce a legal or similarly significant effect; it is a labelling convenience only.

Order and account data¶

What is collected: your name, delivery address, email, and order history, for both direct web-store purchases and purchases through our retailer partners where the order is placed with us directly.

Where it comes from: directly from you (or, where applicable, from the retailer marketplace where you placed your order -- see open-points.md, OP-5, on which marketplace structure applies).

Why: to fulfil your order, process returns and warranty claims, and comply with our own legal and tax obligations.

Our legal basis: performance of the sales contract with you (Art. 6(1)(b) GDPR), and a legal duty we are under for tax and commercial records (Art. 6(1)(c) GDPR).

Who else sees it: our delivery carrier, to deliver your order, and our payment processor, to process payment. We do not sell this data.

How long we keep it: for as long as required by Dutch commercial and tax record-keeping law, typically [period -- confirm with counsel], after which it is deleted or anonymised.

Your rights (EU and Germany)¶

You can ask us to:

confirm whether we process your data and give you access to it (Art. 15 GDPR);
correct inaccurate data (Art. 16 GDPR);
Right to erasure ('right to be forgotten') -- ask us to erase your data in the situations the law sets out (Art. 17 GDPR);
restrict processing in specific situations (Art. 18 GDPR);
receive the data you gave us in a portable format, where the processing rests on your consent or on a contract and happens by automated means (Art. 20 GDPR);
object to processing that rests on our legitimate interest, including the diagnostic-data processing described above (Art. 21(1) GDPR).

Direct marketing: you can object to marketing at any time, free of charge, with no need to justify the objection, and we stop using your data for that purpose once you do (Art. 21(2), (3) GDPR). [We do not currently send marketing communications based on the facts given; if Fernlook plans to, this section needs its own consent/opt-out mechanics -- see references/clauses/marketing-communications.md, not drafted here as out of scope of the documents requested.]

Complaints: our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can lodge a complaint with it, bring a judicial remedy against it, or bring a separate judicial remedy directly against us; these are three separate routes, and you do not need to use one before another (Art. 77, 78, 79 GDPR).

How to reach us: legal@fernlook-optics.test. We answer within one month, extendable by two further months for complex or numerous requests, and we will tell you within the first month if we need the extension and why (Art. 12(3) GDPR). If we will not act on your request, we tell you within one month, with reasons, and tell you about your right to complain to the supervisory authority and to seek a judicial remedy (Art. 12(4) GDPR). This channel is free; we only charge a fee or refuse where your request is manifestly unfounded or excessive, and the burden of showing that is on us (Art. 12(5) GDPR). We only ask you to verify your identity where we have reasonable doubt about it (Art. 12(6) GDPR).

Your rights (United States)¶

[Confirm with counsel which state thresholds apply before publishing this section in full -- see open-points.md, OP-1 and OP-14. Drafted below so the CCPA module is ready if it turns out to apply; the CalOPPA module applies regardless of threshold.]

California (CCPA/CPRA) and CalOPPA¶

Whether or not the rights below apply to you, as an operator of a commercial online service, we tell California residents: we do not currently respond to browser do-not-track signals [confirm with product]; no other party collects personal information about your activity across other sites through this product to our knowledge; you can ask us to review and request changes to your own collected information by contacting legal@fernlook-optics.test; we notify you of a material change to this policy by [posting an update here and, where the change is material, emailing registered account holders]; this policy's effective date is [date] (Cal. Bus. and Prof. Code § 22575(b)(1) to (7)).

Whether the CCPA's own thresholds apply to Fernlook is undetermined and depends on Fernlook's answer on two points (see open-points.md, OP-1): whether its California revenue crosses the statutory figure, and whether it sells or shares personal information with any third party. The client's unit-sales figure for California does not by itself answer either question, since the CCPA's volume threshold counts consumers or households whose data is bought, sold or shared, not units sold. The module below is drafted in full so it is ready to publish once the answer is confirmed; it is not a statement that the CCPA currently applies.

If the CCPA's thresholds apply to Fernlook, you can ask us to:

tell you the categories of personal information we have collected or processed about you, and the purpose for each;
correct inaccurate personal information;
delete personal information we hold about you, subject to the exceptions the law allows;
receive a portable copy of the personal information you gave us;
opt out of the sale or sharing of your personal information, and of its use for targeted advertising. [We state here that we do not sell or share your personal information, as defined by the CCPA, as of the date of this notice; this statement must be kept accurate as the business's actual data practices are confirmed.]

How to reach us: at least two methods -- legal@fernlook-optics.test and [a toll-free number or webform -- not yet provided; required for California]. No new account is required to use these rights. We respond within 45 calendar days after a 10-business-day acknowledgement, extendable once by 45 more days with notice. If we decline your request, we explain why, with appeal instructions, within the same window.

Opting out: [because Fernlook states it does not sell or share personal information, the "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links are not posted; this must be revisited if that changes, or once the CCPA threshold question above is resolved -- see PW-US-CA-3, PW-US-CA-4 in references/prescribed-wording.md].

No discrimination: we do not charge a different price, or give different service or quality, because you exercised a right above.

No private right of action: nothing in this section gives you a right to sue us directly under California law; enforcement is reserved to the California Attorney General and the California Privacy Protection Agency.

Virginia, Colorado, Connecticut, Texas¶

[Include this module only if the applicable state's threshold is confirmed crossed -- see open-points.md, OP-1, OP-14. Drafted here as a placeholder structure, not yet confirmed to apply.]

If [state]'s consumer privacy law applies to Fernlook, you can ask us to: confirm and access, correct, delete, and receive a portable copy of your personal data, and opt out of the sale of your personal data, targeted advertising, and profiling that produces a legal or similarly significant effect. Reach us at legal@fernlook-optics.test; no new account is required. We respond within 45 days, extendable once by 45 more days with notice; a declined request is explained, with appeal instructions, within the same window. Appeals are decided within 60 days with written reasons, and, on a denied appeal, you may contact the [state] Attorney General.

[If applicable: post a clear and conspicuous opt-out link for targeted advertising and sale, using one of the PW-US-CO-1 examples for Colorado.]

No private right of action: nothing in this section gives you a right to sue us directly under [state] law; enforcement is reserved to the state Attorney General.

New York¶

New York has no comprehensive consumer privacy statute covered by this notice's references; see open-points.md, OP-13. [This is flagged as an open point, not drafted as a settled right.]

We do not knowingly collect racial or ethnic origin, religious belief, health data, sexual orientation, genetic or biometric identification data, or precise geolocation data of individuals as part of the Fernlook Scout product. [The camera's own location is set by the user during installation and is not transmitted as the user's own precise geolocation in the sense these laws address; confirm this framing with counsel once the product's actual location-handling behaviour is specified -- not detailed in the client's message.]

Keeping this notice current¶

A change to our processing purpose, our identity, or how you exercise your rights is treated as a material change; we will send you an active notification well before the change takes effect, separate from any marketing content, rather than asking you to check back periodically. We review and, if needed, update this notice's stated date at least every 12 months.

Law-as-of date and reminder¶

This notice is drafted against the law as of 20 October 2026. A qualified lawyer must review this notice before it is published or relied on.