Silvair Commissioning Privacy Notice

PLEASE READ THIS PRIVACY NOTICE BEFORE USING SILVAIR COMMISSIONING TOOL INCLUDING THE COMBINED WEB, THE MOBILE APP AND ALL ASSOCIATED CLOUD COMPUTING, REFERRED TO COLLECTIVELY AS THE “SILVAIR COMMISSIONING”. THIS PRIVACY NOTICE GOVERNS THE TYPES OF INFORMATION AND DATA WE COLLECT AND HOW WE USE AND SHARE THIS INFORMATION. YOUR ACCESS TO AND USE OF SILVAIR COMMISSIONING ARE AVAILABLE FOR YOUR USE ONLY ON THE CONDITION THAT YOU AGREE TO THE TERMS OF USE WHICH INCLUDE THE TERMS OF THE PRIVACY NOTICE SET FORTH BELOW.

We respect your concerns about privacy. This Privacy Notice describes the types of personal data we collect about users. This notice covers how we may use the information and with whom we may share it or use in other products and services. The notice also describes the measures we take to safeguard your personal data. In addition, we tell you how you can ask us to (i) access or change the personal data we maintain about you, (ii) withdraw consent you previously provided to us, and (iii) answer questions you may have about our privacy practices.

Our privacy practices may vary among the countries or territories in which we operate to reflect local practices and legal requirements.

1. The data controller

The controller of your personal data is:

Silvair: Silvair sp. z o.o. with its registered office in Krakow, Poland, at Jasnogórska 44, company registration number KRS: 0000395561.

2. Information we obtain

We may obtain information in connection with various activities such as (i) use of Silvair Commissioning, (ii) commissioning activities for lighting devices, including Bluetooth mesh provisioning and configuration of the devices, and (iii) questions you may ask.

The information we may obtain concerning your personal data may include:

your email and other credentials used to access our commissioning service including the web, mobile apps, software and services;
individual and business contact information (such as your name and company name);
tenant company name, tenant contact name, tenant contact email, tenant contact telephone number, tenant address, building owner company name, building owner contact name, building owner contact email, building owner contact telephone number, building address;
the IP address and geographic location of your mobile device and browser;
other personal information that may be provided to us to obtain requested products or services.

We also use and obtain other types of data which do not concern your personal data but are required to operate, analyze, enhance, and improve our commissioning service.

3. How we use the information we obtain

Upon your consent, we may use your personal data for the following purposes:

to create your account and identify users of the Silvair Commissioning (Article 6.1 (b) of the GDPR):

type of personal data: [email, name, company name],

to verify your email and that you have accepted the Terms of Use (Article 6.1 (b), (f) of the GDPR):

type of personal data: [email],

to provide technical support (i.e. diagnose technical and service problems) and respond to your requests, questions and comments (Article 6.1 (b) of the GDPR):

type of personal data: [email, name, company name],

to perform processing data concerning payments for lighting devices commissioning (Article 6.1 (f) of the GDPR):

type of personal data: [email, name, company name, company address],

to perform accounting, auditing, billing, reconciliation and collection activities (Article 6.1 (f) of the GDPR):

type of personal data: [email, name, company name, company address],

to protect against, identify and prevent fraud and other criminal activity, claims and other liabilities (Article 6.1 (a), (f) of the GDPR):

type of personal data: [email, name, company name, IP address, user geolocation, tenant company name, tenant contact name, tenant contact email, tenant contact telephone number, tenant address, building owner company name, building owner contact name, building owner contact email, building owner contact telephone number, building address];

to comply with applicable legal requirements and our policies (Article 6.1 (a), (c), (f) of the GDPR):

to supply, operate, and maintain Silvair Commissioning (in particular, to securely store Bluetooth mesh cryptographic data) (Article 6.1 (a), (f) of the GDPR):

to analyze, enhance, and improve the Silvair Commissioning and use of Silvair Commissioning (including developing new features and services) (Article 6.1 (a), (f) of the GDPR):

type of personal data: [email, name, company name, IP address, browser information and referring parameters, user geolocation, time zone, tenant company name, tenant contact name, tenant contact email, tenant contact telephone number, tenant address, building owner company name, building owner contact name, building owner contact email, building owner contact telephone number, building address];

to provide you with information concerning Silvair Commissioning (including newsletter and product information) (Article 6.1 (a), (f) of the GDPR):

to anonymize or perform aggregation of data (Article 6.1 (a), (f) of the GDPR):

Your personal data will be stored:

for as long as the relevant consent is not withdrawn – in case of processing based on your consent (Article 6.1 (a) of the GDPR);
until the expiration of claims resulting from the Silvair Commissioning service – in case of processing for the purpose of establishing, exercising and defending claims (Article 6.1 (f) of the GDPR);
until receiving your objection or fulfillment of the processing purpose – in case of any other processing based on our legal interest (Article 6.1 (f) of the GDPR);
until we stop providing you services – in case of processing for the purpose of performance of the agreement (Article 6.1 (b) of the GDPR);
until the legal obligation expires – in case of any processing based on our obligations resulting from the provisions of law (Article 6.1 (c) of the GDPR).

4. Information we share

We may share your personal data with:

persons or entities providing particular services to us (accounting, legal, IT, marketing and advertising services) – to the extent required to provide these services;
our affiliates, employees and contractors – to the extent required to supply, operate and maintain Silvair Commissioning;
our business partners who provide you Silvair Commissioning with their brand – to the extent required to supply, operate, administrate and maintain such Silvair Commissioning by Silvair to these partners and by these partners to you;
any entity or authority required by the law, or when it is necessary or appropriate to prevent physical harm or financial loss.

We do not sell or otherwise share your personal data, except as described in this Privacy Notice.

5. Your options

You may contact us as specified in the “How to contact us” section below, and we will honor your request. In addition, as required by law, you may object at any time on legitimate grounds and free of charge to the processing of your personal information, and we will apply your preferences going forward.

You are entitled to delete your account in the Silvair Commissioning at any time, by using the “Delete the account” function in the My Account section of the Silvair Commissioning. By deleting the account, you terminate the use of the Silvair Commissioning and you may not be able to restore access to your Account.

If you are a State of California, USA resident, you may ask us to refrain from sharing your personal data with certain of our affiliates and other third parties for their marketing purposes. Please tell us your preference by contacting us as specified below.

6. Rights of the data subject

Subject to applicable law, you have the right:

to access to your personal data by requesting sharing and/or sending a copy of all your personal data processed by us;
to request rectification of inaccurate personal data by indicating the data requiring rectification;
to request erasure of your personal data; we have the right to refuse to erase the personal data in specific circumstances provided by law;
to request restriction of processing of your personal data by indicating the data which should be restricted;
to object to processing your personal data conducted due to Silvair’s legitimate interest in case the objection is based on grounds relating to your particular situation;
to withdraw the consent to process your personal data at any time. Withdrawal of the consent is possible solely in the scope of processing made based on consent. We are authorized to process your personal data after withdrawal of your consent if we have the legal basis for such processing, for the purposes defined by that legal basis. Withdrawal does not affect the lawfulness of processing based on consent and performed before it has been withdrawn;
to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes GDPR.

The rights mentioned in (a) to (g) above may be executed by contacting us as indicated in the “How to contact us” section of this Privacy Notice. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information. In addition, if you believe that personal information we maintain about you is inaccurate, subject to applicable law you may have the right to request that we correct or amend the information by contacting us as indicated below.

7. Data transfers

We may transfer the personal data we collect about you to the following countries other than the country in which the information originally was collected:

United States of America.

Those countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your information to other countries, we will protect that information as described in this Privacy Notice and in accordance with applicable law. We use contractual protections for the transfer of personal information among various jurisdictions (the European Commission’s standard contractual clauses referred to in Article 46.2 (c) of the GDPR).

8. How we protect personal data

We use appropriate administrative, technical and physical safeguards to protect the personal information you provide against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use, e.g. we maintain backup copies and only authorized personnel may access the data.

9. Updates to our privacy notice

This Privacy Notice may be updated periodically and without prior notice to you to reflect changes in our personal information practices. Silvair will notify You about any changes made in the content of these Privacy Notice by the notification in the Silvair Commissioning or by email. By downloading, installing, accessing or using any portion of the Silvair Commissioning, you will be deemed to have accepted such amendments.

10. How to contact us

If you have any questions or comments about this Privacy Notice, or if you would like us to update information we have about you or your preferences, please contact us by email: odo@silvair.com.

You can also write to us at:

Silvair sp. z o.o.

ul. Jasnogorska 44

31-358 Krakow, Poland

Privacy Notice Addendum

-------------------------

Addendum to Privacy Notice for Canada

Personal information maintained and processed by our Silvair affiliates and third-party service providers in the U.S. and other foreign jurisdictions may be subject to disclosure pursuant to a lawful access request by U.S. or foreign courts or government authorities. We will not provide your information to third parties for marketing purposes without your prior consent.

For more information about our privacy practices; to access, update or correct inaccuracies in your personal information; or if you have a question or complaint about the manner in which we or our service providers treat your personal information, please contact the Global Privacy Manager located in the U.S., whose address is indicated above.

-------------------------

Addendum to Privacy Notice for Mexico

To the extent Mexican privacy laws or regulations apply, the following additional Mexico-specific provisions apply and shall prevail over conflicting provisions in the Privacy Notice.

How we use the information we obtain

In addition, we may use your personal information for the other purposes listed in the “How we use the information we obtain” section of the Privacy Notice, which may be considered secondary purposes under Mexican law.

We do not use or share personal payment or financial information except in connection with the processing of payments or where there is another legal basis.

You may withdraw your consent to our processing of your personal information by contacting us as indicated in the “How to contact us” section of the Privacy Notice. If you withdraw your consent for us to process your personal information for one of the primary purposes indicated above, then in some situations we may not be able to provide the service, though we may still engage in certain processing authorized by law.

Silvair may also use Lighting Device data and related data analysis in other Silvair products and services.

Information we share

We may share your personal information as provided in the Privacy Notice, but, to the extent permitted by law, you may withdraw your consent to this sharing by contacting us as indicated in the “How to contact us” section of the Privacy Notice.

We also share the Lighting Device and related information we obtain with our customers, partners, affiliates, and joint marketing partners. These entities, which collectively are referred to here as the “Silvair Business Partners”, may use the information for the purposes described in this Privacy Notice.

We may also share the commissioning date, physical location and performance of Lighting Devices with the Silvair Business Partners and other third parties for warranty, troubleshooting or maintenance purposes, or for improving the design and performance of their products and services.

Requests for access, correction, cancellation, objection or consent withdrawal

In addition to any rights granted in the Privacy Notice, you can ask us to cancel your personal information to the extent permitted by law by contacting us as indicated in the “How to contact us” section of the Privacy Notice. Following a valid cancellation request, we may hold the personal data for the duration and purposes permitted by law before deleting it.

We will answer your requests to access, correct or cancel your personal information or to object or withdraw your consent to our processing of your personal information within 20 business days from the date we receive your complete request or as provided by law. To be considered complete, your request must include your full name and contact address, a copy of your ID, and a clear and detailed description of your request.

-------------------------

Addendum to Privacy Notice for Japan

Silvair complies with Japanese laws and regulations, including the Act on the Protection of Personal Information. Silvair is primarily responsible for the management of the personal information that is jointly used with our affiliates or third parties. We will not provide your information to third parties for marketing purposes without your prior consent.

-------------------------

Addendum to Privacy Notice for Republic of Korea

Except as otherwise required by law, consumer personal information is securely disposed of without delay when (i) the consumer revokes his or her consent for our use of the information, (ii) the purpose of our collection and use of the personal information has been accomplished or (iii) the legal retention period has expired. If applicable law requires the preservation of personal information that otherwise would be disposed of, the personal information is transferred to a separate database and then disposed of after the period determined by the applicable law. Personal information is disposed of using a method that is reasonably likely to prevent the personal information from being restored or reused.

We will not provide your personal information to third parties in violation of law (such as without your consent, where consent is required). For the purposes stated in the Privacy Notice, Silvair or our affiliates are responsible for the handling of personal data with respect to services provided in Korea.

Ver 1/2023.10.25