Privacy policy for the Serea smartphone app

Privacy Policy for the Serea Smart Lock App

Organization details
pewag Schneeketten GmbH
Kettenwerk 1
Brückl – 9371
Austria (AT)

This app is operated by pewag Schneeketten GmbH(“we” or “us”). This notice describes how we, as the controller, process your personal data in connection with this app.

In this privacy policy, we explain what we do with the data we collect about you via this app. We recommend that you read this document carefully. We comply with legal requirements when processing data. This means, among other things:

We clearly state the purposes for which we process personal data. This is done through this privacy policy.
We aim to limit our processing of personal data to personal data that is necessary for legitimate reasons.
We will first obtain your explicit consent if this is necessary to process your personal data.
We take appropriate security measures to protect your personal data and require the same from parties that process personal data on our behalf.
We respect your right to access, correct, or delete your personal data.

If you have any further questions or would like to know what personal data we hold about you, please contact us at support(at)serea-locks.com.

1. Purpose, data, and retention period

We process personal information for a number of purposes related to our business, including the following.

1.1 Registration and login

To use the app, you need an account. This is necessary to ensure that you can create and manage your lock. We process this data to ensure that you can operate your lock and, if you need assistance, we can provide you with the necessary information immediately.

For this purpose, we process the following data:

Email: Linked to the user, app functionality (login/user contact, user identification)
User name: Linked to the user, app functionality (display of user name)
Profile/image: Linked to the user, app functionality (display of image during unlock actions/sharing) OPTIONAL
Language and country: Linked to the user, app functionality (language of emails)
Push notification token: Linked to the user, app functionality (sending push notifications) OPTIONAL

Legal basis

Data processing is carried out because it is necessary for the performance of the service the provision of the app’s functionalities and the service offered via the app (Art. 6 (1) lit. b GDPR).

The processing of data that you voluntarily provide to us (e.g., profile picture, push notification token) is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Data recipients

Your personal data will be processed in accordance with applicable data protection regulations by our relevant departments, such as IT and customer service, which require it to fulfill the above-mentioned purpose.

We also share your personal data with external service providers who assist us in performing our activities: it is stored on a Google Cloud server in Frankfurt and is only accessible to us and our app development partner Ascent in Graz, Austria.

To find out how Ascent handles your data, click here.

Other third-party recipients: SendGrid (a service provided by Twilio Inc.).

These service providers act as processors and process the data exclusively on our instructions and in accordance with the applicable data protection regulations.

Third country transfer

No data is transferred to countries outside the EU and the EEA, either during our internal data processing or during external data processing by our processors.

However, when you register with our app, we use Twilio SendGrid to send you emails (for example, an email to confirm your registration or reset your password, etc.). These data centers are located on the mainland of the United States. However, in its adequacy decision, the European Commission found that the United States provides an adequate level of protection for personal data transferred from the European Union to US companies participating in the program. Twillio participates in this program.

Twilio has signed standard contractual clauses with external subprocessors where necessary.

Retention period

We delete or anonymize your personal data as soon as it is no longer required for the purposes for which it was collected and processed, and provided that no other legal obligations require further storage.

Most of the data used by SendGrid, our email provider, expires after a maximum of 37 days. SendGrid stores some email event data in pseudonymized form for up to one year for security, fraud detection, abuse prevention, and network protection purposes. While this data does not contain message content, it can be linked back to the recipient. For more information, please visit:

Data Retention and Deletion in Twilio Products – Twilio Help Center

Withdrawal

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent may result in the app no longer being usable or only being usable to a limited extent. Withdrawal can be made informally by email to support(at)serea-locks.com or via the support request in the app. The lawfulness of the processing carried out until the withdrawal remains unaffected.

1.2 Use of the app

When you use the app, we process certain data. This is particularly the case when you add a lock, open a lock, or share a lock. We need to store this data to ensure that you can use your lock without any problems. We also store this data in case you need assistance.

For this purpose, we process the following data:

1.2.1 Add lock

ID: The ID number of the lock
Hardware Lock ID: The serial number of the lock
Nick Name: The default name of the lock
Addition time: When the lock was added to the account (date and time)
Update time: When the lock was updated by the user.
Lock Key: The password of the lock

1.2.2 Share lock

Lock recipient: Link to the other registered user with whom access is shared
ID: The ID number of the lock
Addition time: The timestamp when the lock was shared
Sharing time frame: Period during which the lock is shared
Whether the recipient has accepted the sharing

1.2.3 Unlocking the lock

Opening time: The timestamp when the lock was opened
Initiator: The ID number of the person unlocking the lock
Lock ID: The ID number of the lock
GPS: The longitude and latitude coordinates OPTIONAL

Legal basis

Data processing is carried out because it is necessary for the performance of the service the provision of the app’s functionalities and the service offered via the app (Art. 6 para. 1 lit. b GDPR).

The processing of the data you voluntarily provide to us is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Data recipients

Your personal data will be processed in accordance with the applicable data protection regulations by our responsible departments, such as IT and customer service, which require it to achieve the above-mentioned purpose.

We also pass on your personal data to external service providers who support us in performing our activities: it is stored on a Google Cloud server in Frankfurt and is only accessible to us and our app development partner Ascent in Graz, Austria. These service providers act as processors and process the data exclusively in accordance with our instructions and in compliance with the applicable data protection regulations.

Third country transfer

No data is transferred to countries outside the EU and the EEA.

Retention

We delete or anonymize your personal data as soon as it is no longer needed for the purposes for which it was collected and processed, and provided that no other legal obligations require further storage.

Revocation

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent may result in the app no longer being usable or only being usable to a limited extent. Withdrawal can be made informally by email to support(at)serea-locks.com or via the support request in the app. The lawfulness of the processing carried out until the withdrawal remains unaffected.

1.3 Contact

If you use the contact function in the app to send us a support request, some data will be automatically sent to our support team. This data is required to easily identify and reconstruct errors and provide you with the support you need.

For this purpose, we process the following data:

Email: Linked to the user, app functionality (login/user contact, user identification)
User name: Linked to the user, app functionality (display of user name)
Message: The message you send us

You have the option of declining the following information, but we recommend that you leave this option enabled so that we can provide you with the right solution more easily:

osVersion
Brand
Device
Host
Manufacturer
Model
Product
Platform
App Name
Version
Build Number

Legal basis

The processing of the data you voluntarily provide to us is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Data recipients

Your personal data will be processed in accordance with the applicable data protection regulations by our responsible departments, such as IT and customer service, which require it to achieve the above-mentioned purpose.

We also share your personal data with external service providers who support us in performing our activities: it is stored on a Google Cloud server in Frankfurt and is only accessible to us and our app development partner Ascent in Graz, Austria.

Other third-party recipients: Zendesk Inc.

These service providers act as processors and process the data exclusively on our instructions and in accordance with the applicable data protection regulations.

Third country transfer

No data is transferred to countries outside the EU and the EEA, neither during our internal data processing nor during external data processing by our processors.

However, if you contact us via the app, we use Zendesk as our support system to process your request. Although Zendesk Inc. is headquartered in the US, the server we use is located in Frankfurt and no personal data is transferred outside the EU/EEA.

In the event that data must be transferred to a third country, Zendesk can rely on its approved “Binding Corporate Rules.” Further relevant information can be found here: Security, Privacy and Legal | Zendesk Trust Center

Retention

We delete or anonymize your personal data as soon as it is no longer required for the purposes for which it was collected and processed, and provided that no other legal obligations require further storage.

Customer support tickets remain in our system for a maximum of one year and are then deleted.

Revocation

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent may result in the app no longer being usable or only being usable to a limited extent. Withdrawal can be made informally by email to support(at)serea-locks.com or via the support request in the app. The lawfulness of the processing carried out until the withdrawal remains unaffected.

1.4 Google Analytics for Firebase and Firebase Crashlytics

We use Google Analytics for Firebase and Firebase Crashlytics to improve our services and for statistical purposes. Data about the frequency and type of use, including a device ID, is collected. Data is transmitted in pseudonymized form for this purpose, which excludes any direct reference to individuals.

Legal basis

The processing of the data you voluntarily provide to us is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Data recipients

Your personal data will be processed in accordance with the applicable data protection regulations by our responsible departments, such as product management, marketing, and customer support, which require this data to achieve the above-mentioned purpose.

We also pass on your pseudonymized data to external service providers who support us in performing our activities, e.g., our app development partner Ascent in Graz, Austria. These service providers act as processors and process the data exclusively in accordance with our instructions and in compliance with the applicable data protection regulations.

In addition, your pseudonymized data is also processed by Google LLC (“Google”) with its registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The IP address of this data is shortened, i.e., the last octet of IPv4 addresses is replaced by zeros and, in the IPv6 variant, the last 80 bits are replaced by zeros. This means that your exact location is not sent to Google. The information sent to Google is used to analyze the Serea app. In addition to us, Google may also access this data and possibly pass it on to third parties.

This option is 100% optional and by giving your consent, you also accept that Google may use this data in the manner described. You can revoke your consent at any time in the app settings.

Third country transfer

No data is transferred to countries outside the EU and the EEA, either during our internal data processing or during external data processing by our processors.

On the other hand, when using Google Analytics for Firebase and Firebase Crashlytics, data is usually transferred to a Google server in the US and stored there. To ensure an adequate level of data protection here as well, the following protective measures are applied:

The European Commission adopted its adequacy decision for the US on July 10, 2023. Google LLC is certified under the EU-US Privacy Framework.
Since Google servers are distributed worldwide and transfer to third countries (e.g., Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider.

Retention

Device identifiers are stored for a period of 14 months and then deleted.

Revocation

You have the right to revoke your consent to the processing of your personal data at any time. The revocation can be made easily in the settings of the Serea app by deactivating the “App Analytics” switch. The legality of the processing carried out until the revocation remains unaffected.

1.5 Google Firebase Cloud Messaging

In order to send you push notifications, we use Google Firebase Cloud Messaging as a third-party provider. If you accept this service, Firebase uses an “installation ID” to determine which device the push notification should be sent to.

For this purpose, we process the following data:

Installation ID: these tokens, which help to identify the device

Legal basis

The processing of the data you voluntarily provide to us is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.

Data recipients

Your personal data will be processed in accordance with applicable data protection regulations by our relevant departments, such as product management, marketing, and customer support, which require it to fulfill the above-mentioned purpose.

We also share your pseudonymized data with external service providers who support us in performing our activities, e.g., our app development partner Ascent in Graz, Austria. These service providers act as processors and process the data exclusively on our instructions and in accordance with the applicable data protection regulations.

In addition, your pseudonymized data will be processed by Google LLC (“Google”) with its registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Third country transfer

No data is transferred to countries outside the EU and the EEA, either during our internal data processing or during external data processing by our processors.

On the other hand, when using Google Analytics for Firebase and Firebase Crashlytics, data is usually transferred to a Google server in the US and stored there. To ensure an adequate level of data protection here as well, the following protective measures are applied:

The European Commission adopted its adequacy decision for the US on July 10, 2023. Google LLC is certified under the EU-US Privacy Framework.
Since Google servers are distributed worldwide and transfer to third countries (e.g., Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider.

Retention

Google Firebase stores Firebase installation IDs until the Firebase customer makes an API call to delete the ID. After the call, the data is removed from the live and backup systems within 180 days.

Revocation

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent may result in the app no longer being usable or only being usable to a limited extent. Withdrawal can be made informally by email to support(at)serea-locks.com or via the support request in the app. The lawfulness of the processing carried out until the withdrawal remains unaffected.

2. Data processing and storage

We take all possible measures to ensure that your data is stored securely and that unauthorized access to the data is not possible. All information collected is stored on our own servers or on those of partners who are committed to the same reasonable level of data protection.

3. Your rights regarding data processing

You have the right to access, correct, delete, restrict processing, transfer data, withdraw consent, and object.

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can file a complaint with the relevant national supervisory authority.

The list of the respective national supervisory authorities can be found at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.
In Austria, this is the Austrian Data Protection Authority (https://www.dsb.gv.at/kontakt).

You can reach us at the following contact details: