PRIVACY NOTICE

Publication/last update date: 2023-10-30

This privacy notice (the "Privacy Notice") applies to the processing of your personal data carried out in the context of the provision of the services (the "Services") available via the Home + Guest application (the "Application") relating to the range of smart door locks and keys (the "Products").

For the purpose of this Privacy Notice, the term "Applicable Data Protection Regulation" means the European regulation no. 2016/679 of 27 April 2016 (the "General Data Protection Regulation" or "GDPR") as well as the French law no. 78-17 of 6 January 1978 and its application decree no. 2019-536 of 29 May 2019 (the "French Data Protection Legislation").

Any reference to the Applicable Data Protection Regulation shall be deemed to include any subsequent replacement of or amendment to the Applicable Data Protection Regulation (or part of the same).

IDENTITY OF THE DATA CONTROLLER

The processing of personal data described in this Privacy Notice are implemented under the responsibility of:

NETATMO SAS (or "NETATMO")
245 rue du vieux Pont de Sèvres
92100 Boulogne Billancourt (France)

COLLECTED DATA, PURPOSES OF THE PROCESSING AND LEGAL BASIS

To benefit from our Services / Products, we need to process your personal data as detailed below. Please note that your personal data is both required and necessary to provide the Services that you are requesting. If we cannot process your personal data, you will not be able to benefit from the Services / Products.

The personal data collected when you use the application, the Services and/or the Products

Type of personal data	Purposes of the processing	Legal basis
Technical personal data: mobile IP address, type of mobile device and mobile device model	Technical support	Performance of the contract based on the general terms of use of the Application*
Last name, first name, email address, request to exercise your data protection rights	Processing of your requests to exercise your rights Sending of information regarding changes made to the Privacy Notice	Compliance with our obligations resulting from the Applicable Data Protection Regulation

*The general terms of use of the Application designed for guests are available for reference in the Application

RECIPIENTS HAVING ACCESS TO THE DATA

Only the following recipients will have access to your personal data, within the limits set out below:

The internal departments of NETATMO, established in France;

The administrators of the systems that hosts all of your personal data;

The service provider named ONLINE, established in France, responsible for hosting the historic personal data relating to NETATMO Products;

The service provider named OVH, established in France, responsible for hosting NETATMO backups;

The service provider named Microsoft AZURE, responsible for hosting the LEGRAND cloud architecture and the personal data centers which are located in the Netherlands. For your information, your personal data may be transferred to Microsoft AZURE for hosting purposes in the United States of America;

You are hereby informed that the aforementioned recipients of personal data are subject to a confidentiality obligation and have undertaken to use your personal data in accordance with our contractual arrangements and the Applicable Data Protection Regulation. Where your personal data are transferred outside the European Economic Area ("EEA"), we have notably put in place security and confidentiality safeguards that are deemed appropriate in light of the GDPR. For your information, you may obtain access to these safeguards, on request, by contacting us at the address indicated in the "CONTACT US & CONTACT OUR DPO" section.

DATA RETENTION PERIODS

We process your personal data for the following purposes and durations:

Purpose of the processing	Retention duration of the Personal Data
Technical support to deliver the Services	Ninety (90) days as from the collection date.
Processing of your requests to exercise your rights Sending of information regarding changes made to the Privacy Notice	Three (3) consecutive years as from the receipt of the request regarding the exercise of your rights or the sending of information regarding changes made to the Privacy Notice

Please note that the above durations remain subject to mandatory data retention requirements that may apply to us and, where relevant for the establishment, exercise or defence of legal claims, to the applicable statutory limitation periods.

Lastly, we draw to your attention that uninstalling our Application does not automatically imply the deletion of your personal data. To do so, you must send a voluntary deletion request (see "CONTACT US & CONTACT OUR DPO" section).

DATA SECURITY

We have implemented adequate physical, electronic and administrative protection security measures in accordance with applicable regulations to protect your personal data. However, we wish to draw users' attention to the potential risks regarding confidentiality of the personal data related to internet usage. In particular, users are responsible for putting in place or ensuring the existence of means securing their personal internet network, as well as for ensuring the proper configuration of the box connected to the internet access provider, and other wireless access means (e.g., WIFI, 4G, etc.).

USERS' RIGHTS

Pursuant to the Applicable Data Protection Regulation, you benefit from the following rights in relation to the processing of your personal data:

Right of access: you can ask to obtain a copy of your personal data from us, as well as to receive information regarding the processing of your personal data (such as the categories of personal data that are processed, the purposes of the processing, the categories of recipients to whom the personal data is communicated, the retention period of the personal data);

Right to rectification: you can ask us to correct, complete, update your personal data if it is inaccurate, incomplete, ambiguous and/or expired;

Right to erasure: you can ask us to delete your personal data under certain conditions (for example, if your personal data is no longer necessary for the purposes for which they were collected or are processed; or if you have withdrawn your consent for processing your personal data, as long as the prior consent was the legal basis for their collection and processing and there is no longer any other legal basis justifying the latter). For more information on the conditions to exercise this right, please refer to Article 17 of the GDPR;

Right to restriction: you can ask us to limit the processing of your personal data under certain conditions (for example, when you contest the accuracy of the personal data, the time needed for us to verify this point). For more information on the conditions to exercise this right, please refer to Article 18 of the GDPR;

Right not to be subject to certain specific processing: you can ask us, under certain conditions, not to subject you to a decision based exclusively on automated processing, including profiling, producing legal effects concerning you or significantly affecting you in a similar manner. For more information on the conditions to exercise this right, please refer to Article 22 of the GDPR;

Right to object: you may object, under certain conditions, to the processing of your personal data for a reason relating to your specific situation. For more information on the conditions to exercise this right, please refer to Article 21 of the GDPR;

Right to portability: you can ask to receive your personal data – when they are processed on the legal basis of your consent or if necessary, for the performance of a contract – in a structured, commonly used and machine-readable format, and request that we transmit them to another data controller (for example, another service provider);

Right to withdraw consent: you can withdraw your consent at any time, without providing a reason, for all of the processing activities for which the legal basis for processing is your consent (if any);

Right in case of death: you can, under certain conditions, define guidelines relating to the preservation, erasure and communication of your personal data by NETATMO after your death. These guidelines may be general or specific. The general guidelines relate to all of your personal data and can be recorded with a trusted digital third party certified by the French supervisory authority. The specific guidelines relate to the processing of your personal data described in this Privacy Notice and can be recorded with us. For more information on the conditions to exercise this right, please refer to Article 85 of the French Data Protection Legislation.

To exercise any of these rights, you may send your request at any time, using the contact information provided in the "CONTACT US & CONTACT OUR DPO" section of this Privacy Notice. Requests will be processed as long as you can validly prove your identity and the subject of your request is clearly identified. Requests will be processed promptly, and in any case within no more than one (1) month from receipt of the request. If needed, this period may be extended by two (2) months, depending on the complexity of the request and number of requests. In this case, we will inform you of the reasons for this extension. No payment will be required to exercise your rights, except in case of clearly unfounded or excessive request. In this case, we also reserve the right not to grant your request.

In addition to the rights described above, you may lodge a complaint at any time with a competent supervisory authority. For instance, under the GDPR, you may lodge such a complaint in the country in which you reside or work (if relevant) or where the alleged breach has occurred, if you feel that our processing of your personal data breaches the Applicable Data Protection Regulation. In France, the supervisory authority is the Commission Nationale de l'Informatique et des Libertés (the "CNIL").

COOKIES AND SIMILAR TECHNOLOGIES

When you use the Application, we place cookies and similar technologies on your mobile phone for various reasons. Our practices in this respect are outlined in our Cookies and Similar Technologies Policy.

MINORS

In offering its information services (that is to say, the Application), LEGRAND does not target users that have not reached the legal age of majority applicable in their country.

The Application does not intentionally collect or use personal information regarding minors. If information has been collected on a minor by LEGRAND, the legal representative of the minor may contact the Data Protection Officer at LEGRAND (using the contact information provided in the "CONTACT US & CONTACT OUR DPO" section) in order to, where relevant, correct, modify or delete this information or object to the processing of this information (refer to "USER'S RIGHTS" section).

MODIFICATION OF THE PRIVACY NOTICE

You can see the date of the last update to the Privacy Notice by referring to the "Last update" note at the top of the Privacy Notice.

When we are considering making substantial changes to this Privacy Notice (for example, a change to the processing purposes of the personal data, the identity of one or several data controllers, or the manner in which you can exercise your rights), we will inform you before these changes become effective, via the Application. This information is accompanied by an "I understand" button, which we ask you to click on in order to confirm that you have understood the changes.

You are hereby informed that you can consult this Privacy Notice at any time on the information section of your Application.

CONTACT US & CONTACT OUR DPO

By email:
Via the online form on the website
https://www.legrand.com/ “Contact us” section.

By mail:
Service Consommateurs Legrand
128, avenue du Maréchal de Lattre de Tassigny
87045 Limoges Cedex - France

Our DPO:

Data Protection Officer – Julie Celma
128, avenue du Maréchal de Lattre de Tassigny
87045 Limoges Cedex – France
fr-sm-data-protection-officer@legrand.com