Legal notice

Privacy policy

Privacy Policy for the use of Homematic IP
(Version: 29/06/2020)

Thank you for your interest in our Homematic IP smart home system. We take our responsibility to protect the personal information that is collected, processed and used during the application of Homematic IP seriously.

Below is an explanation of what data is collected during your use of Homematic IP and how it is used. These notes on privacy policy only apply to the use of Homematic IP as well as the connection of Homematic IP with the IoT platform Conrad Connect.

The Privacy Policy is valid in addition to the General Terms and Conditions as well as other directives of eQ-3 AG (http://www.eq-3.com/legal-notice/t-cs.html).

I. Contact Details and your Rights

1. Controller’s name and address

The controller, as defined in the General Data Protection Regulation and other national data protection laws within the member states and other provisions of data protection legislation, is:

eQ-3 AG
Maiburger Straße 29
26789 Leer
Deutschland/Germany

Email: datenschutz@eq-3.de
Internet: https://www.homematic-ip.com/start.html

2. Data Protection Officer's name and address

Heiko Janssen, lawyer
Janssen & Enninga, notary and lawyers
Julianenburger Str. 19
26603 Aurich / Germany
Phone: Tel.: +49 4941/97440
Email: datenschutz@eq-3.de

3. Your rights

As a data subject, you are entitled to assert your rights against us at any time. Where the statutory requirements are met, your rights will include the following:

3.1. Right to access pursuant to Art. 15 of the GDPR

You have the right to information, free of charge and at any time, about the data we hold about you. You also have the right to have the data you have provided us with transferred to yourself or a third party at any time.

You are entitled to request information about whether or not your personal data will be transferred to a third country or an international organisation. In this respect, you may ask to be informed about appropriate safeguards pursuant to Art. 46 of the General Data Protection Regulation (GDPR) in connection with the transfer.

To request information, please write to datenschutz@eq-3.de.

Please note that we can only transfer data collected on the basis of consent or a contract.

3.2. Right to rectification of inaccurate data or to have incomplete data completed pursuant to Art. 16 of the GDPR

We will correct the data we hold about you upon your request in the absence of any legal stipulations to the contrary (for example, retention obligations from the German Commercial Code).

If you wish to rectify your data, please write to datenschutz@eq-3.de

3.3. Right to erasure pursuant to Art. 17 of the GDPR

We will erase the data we hold about you upon your request in the absence of any legal stipulations to the contrary (for example, retention obligations from the German Commercial Code).

If you wish to have your data erased, please write to datenschutz@eq-3.de.

3.4. Right to restrict the processing pursuant to Art. 18 of the GDPR

You may ask to restrict the processing of your personal data under the following conditions:

a) Where you contest the accuracy of your personal data, for a period enabling the controller to verify the accuracy of the personal data

b) The processing is unlawful and you are opposed to having your personal data erased and request the restriction of its use instead

c) The controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims; or

d) Where you have objected to processing pursuant to Art. 21(1) of the GDPR pending verification of whether the controller's legitimate grounds override yours.

If the processing of your personal data has been restricted, said data may only be processed – apart from its storage – with your consent or for the purposes of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for the sake of an important public interest of the Union or of a Member State.

3.5. Right to data portability pursuant to Art. 20 of the GDPR

You have the right to have the data you have provided us with transferred to a third party at any time.

To request information, please write to datenschutz@eq-3.de.

Please note that we can only transfer data collected on the basis of consent or a contract.

3.6. Right to lodge a complaint with a supervisory authority pursuant to Art. 13(2)(d) of the GDPR

Without prejudice to any other administrative or judicial remedy, you are entitled to lodge a complaint with a supervisory authority, in particular in the member state where you reside or work, or where the alleged infringement took place, if you believe that the processing of your personal data violates the GDPR.

The supervisory authority with which the complaint is lodged will inform the complainant about the status and outcome of the complaint, including the possibility of a judicial remedy in accordance with Art. 78 of the GDPR.

II. General information regarding data processing

1. Personal data

Personal data include information such as name, address or e-mail address which can be associated directly to you personally.

2. Data collection and storage

a) The Homematic IP range includes various products for climate control, security applications as well as light and shutter control. Therefore, single components like radiator thermostats, dimming actuators etc. are connected to the Homematic IP Access Point. You can then use the Homematic IP app to control each component individually. Single devices are configured by the Homematic IP cloud service, which is run exclusively on servers of eQ-3 AG located in Germany and therefore complies with European and German data protection guidelines.

During the configuration and operation of the Homematic IP system, the following data is collected and stored:

  • Serial number as well as features necessary for operation like firmware version of the Homematic IP Access Point
  • Serial number, name, model name, firmware version as well as the device configuration made by the user
  • Room descriptions as well as allocations of devices to rooms
  • Device model and operating system version of the smartphones used
  • First and last connecting time of a smartphone
  • Configuration of the function modules (light & shade, climate control, security control, automation)

For the “acquisition of measured data” function it is required to save the status values of a device (e.g. current power of a pluggable switch and meter) over a longer period. Via the smartphone app, the user defines for which devices the “measured data” is saved. As long as the user has not selected anything, no data will be saved.

For the use and operation of the Homematic IP system without connection to the IoT platform Conrad Connect, these data is used only on servers of eQ-3 AG in Germany for the technical implementation of the Homematic IP system. The information will not be disclosed to third parties. If you have connected Homematic IP to other services (such as Amazon Alexa or Google Assistant), a transfer is made to these services. Your data is not personalised.

b) In addition, you can connect your Homematic IP smart home system to the IoT platform Conrad Connect.

For connecting Homematic IP to the IoT platform Conrad Connect, a temporary activation key (i.e. limited in time) is required and can be generated in the Homematic IP app. After successful activation, an individual authentication key is generated. Hereby, certain data for executing the control commands used by you can be requested by Conrad when using the IoT platform Conrad Connect. The following data will be forwarded to Conrad:

  • Serial number of the Homematic IP Access Point
  • Serial number / room description of all devices connected to Homematic IP
  • Description of the corresponding room
  • Manufacturers name of the corresponding device
  • Model description of the corresponding device
  • Version number of the corresponding device
  • Control commands and status values supported by the devices
  • Status information of the corresponding device (e.g. setpoint temperature of the radiator thermostat / room)
  • Current availability status of the devices

The data is transferred to Conrad by eQ-3 AG on a non-personally identifiable basis. It may be possible, however, that Conrad collects data via the connection between the IoT platform Conrad Connect and Homematic IP that is included in both services, in accordance with the Privacy Policy of Conrad ( https://conradconnect.de/de/privacy ).

c) If a connection to Conrad Connect (according to 1b) is established, the Homematic IP system supports the proactive transmission of device states to Conrad Connect for the use of Homematic IP devices in Conrad Connect. For this it is necessary that the relevant status values of a device are transmitted to Conrad whenever the status of the device changes. Status values include, for example:

  • the switching status of switch actuators
  • brightness values of dimming actuators
  • setpoint and actual temperature of heating groups or rooms
  • availability status of the devices

For allocation of data transferred to Conrad, a key that belongs to your connected Conrad Connect account is stored on the Homematic IP servers. This key is only used for data transmission for the purpose of this paragraph 1c. The data is transferred to Conrad by eQ-3 AG on a non-personally identifiable basis. It may be possible, however, that Conrad collects data via the connection between the IoT platform Conrad Connect and Homematic IP that is included in both services, in accordance with the Privacy Policy of Conrad (https://conradconnect.de/de/privacy).

The user himself defines in the smartphone app whether additional status data is transmitted. This function can be deactivated in the settings for the Conrad Connect in the Homematic IP app. If the function is deactivated, no data will be transferred proactively.

3. Processing and use of personal and other information

The data stated in sec. II.2a is collected on a non-personally identifiable basis for the operation of Homematic IP.

The data stated in sec. II.2b and 2c is transferred on a non-personally identifiable basis by eQ-3 AG to Conrad for the implementation of the control commands used by you during operation of the iOT platform Conrad Connect. eQ-3 AG does not receive any analysis by Conrad about data collected by Conrad.

4. Contradiction / right to information

If you do not want your data to be transferred to Conrad in accordance with sec. II.2b, you have to revoke access to Homematic IP in the Conrad Connect web interface. In this case, the authentication key expires and Conrad would no longer be able to request any data according to sec. II.2b. Please note, that in this case you will no longer be able to use Conrad Connect for controlling Homematic IP.

You may request information about what data of yours we have stored, why we stored it and where we got it from. According to the relevant legal provisions, you also have the right to have your personal information corrected, blocked or deleted. You may request/seek to have your personal information corrected, blocked or deleted via datenschutz@eq-3.de.