PRIVACY POLICY

Your privacy is important to us. This is the reason why we have developed this Privacy Policy to provide you with all the needed information about why and how we process your personal data, in order to provide you with the services available through our application.

This Privacy Policy shall apply to the processing of personal data, that is or might be performed by using the mobile Application MyKi (the “MyKi App”) and provides to the data subject the necessary information about the identity and the contact details of the controller, the contact details of the data protection officer, the purposes of the processing for which the personal data are intended as well as the legal basis for the processing, the recipients or categories of recipients of the personal data, and etc.

“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, as that term is defined under the General Data Protection Regulation (GDPR).

“Data subject” means the App User, the secondary App User/s (if applicable) and the MyKi Device User whose device is paired with the account of the App User and/ or the secondary App User/s (if applicable) in the MyKi App.

“Controller” of the personal data processed for the purposes related to the MyKi App is Shelly Europe Ltd., UIC: 202320104, having its seat and registered address in Bulgaria, 1407 Sofia, No 103 Cherni Vruh Blvd.

The Data protection officer of Shelly Europe Ltd. shall reply to all your queries concerning processing and protection of personal data and shall make the process of exercising your data subject rights easier and more comprehensible. Establishing direct contact with him/her for your convenience and ease is being facilitated via email: dpo@shelly.com

The MyKi App allows you to identify the location of а Device from the MyKi watch series (the Device/ MyKi Device) and to connect with it via a call or a chat as applicable (“the Service”).

Be aware that you may not track the location of the Device without the consent of the person who is wearing it. In the event that the Device is used by a child, the person, who has installed the MyKi App and has registered their own account in the MyKi App declares and warrants that he / she possesses parental control for the child – a parent, guardian or has been explicitly authorized by the person who has such capacity.

1. Types of personal data we process:

On a contractual basis for the provision of the Service:

1.1. Account data

• User name;
• Email address;
• IMEI (unique number of the Device), for which the account has been created;
• MSISDN (telephone numbers of the SIM cards placed in the watch and the mobile device on which the MyKi App has been installed).

1.2. Data concerning the Device (MyKi Device) and the mobile devices on which the MyKi App has been installed (Paired Devices)

• Model and number of the Device and the Paired Device;
• Name of the Device;
• IMEI (unique number of the Device);
• MSISDN (telephone numbers of the watch and mobile devices having installed application);
• Mobile carriers (MNO) or Internet provider, which provides connectivity for the purposes of the Service;
• a version of the installed MyKi App, language, time zone, IP address of the devices from which the account can be accessed;
• Identification of a mobile network cell;
• IP address.

1.3. Location data of the Device:

• Geo-location;
• Location history.

Additional personal data that is collected on the basis of your explicit consent, expressed through deliberate actions within the MyKi App for using some of its features. You can but you are not obliged to provide us with the following data:

1.4. Location data of the Paired device:

• Geo-location;

You can withdraw your consent to the processing of the abovementioned data by turning off the feature. We store data about the geo-location for the last 100 locations on our servers.

1.5. Data concerning the Device User:

• Photo;
• Gender, date of birth, weight, height;
• Behaviour history (movement, rest, sleep, if applicable for the device and information regarding other activities entered by you on your own choice).

You can withdraw your consent to the processing of your child’s photo, gender, date of birth, weight and etc. by removing the abovementioned information from the respective field in the MyKi App. The App User can stop using the activity feature at any time.

1.6. Other data (if access to such data is provided and depending on the type of MyKi Device used):

• Phone book;
• Chat services – text and voice messages (when applicable for the Device);
• Video streaming (when applicable for the Device);
• Pictures (when applicable for the Device).

Electronic messages (voice messages, text messages, pictures, emoticons) can be transferred between the MyKi Device User and the the App User. The Device and the MyKi Аpp allow their users to replay the voice message, read text messages sent or to reproduce the transferred pictures multiple times within a period of 90 days after you have sent them or until one of the following limits is reached – up to 400 chat messages or chat content (Audio files, pictures) up to 10 MB. We do not store videos or calls.

The Device allows the MyKi Device User at his discretion to send voice messages by using the microphone on the device or to answer in chat with prelimited number of emoticons. The audio message is being recorded and sent to the Myki App and the voice message may be reproduced on the Device and the Myki Аpp.

The Device and the Myki Аpp also allow their users to take photos and send these to each other. For taking photos the cameras of the Device and the paired device are used. The pictures exchanged between the Device User and the App User are available and can be displayed on the Device and on the Myki App.

The Аpp user and the Device user may send or receive incoming and outgoing Video calls whereas the cameras of the Device and the paired device are used.

You can withdraw your consent to the processing of the data stored in the Phone book by deleting the contacts contained therein.

• Shared accounts (if applicable):

You can choose to invite another App User to determine for him/her an access level to the information about the MyKi Device and actions they are allowed to perform in the Device. You can stop providing access level to the Device at any time by using the features of the MyKi App.

• E-mail address of the App User for marketing purposes

In case you have provided your opt-in consent to receive marketing information via e-mail for our products and/or services, you may withdraw your consent at any time through the unsubscribe link at the bottom of our newsletter, as well as through the settings manual of the MyKi App.

Upon withdrawal of the consent, processing of the respective type of personal data shall be terminated for the stated purposes. Withdrawal of consent shall not prejudice the legality of processing based on consent given prior to its withdrawal.

Shelly Europe Ltd. processes data for business analysis of the sales extrapolated from de-personified anonymous data (legitimate ground):

1.7. Anonymised data:

• Statistical information concerning the total number of active watches and their geographical allocation (general dispersal).

2. Purposes of personal data processing:

2.1. Data concerning the App User account for the purposes of:

• Verification and control of the data access to the MyKi Device (each device is connected to only one account as for some Devices Main App User may provide access to Secondary User/s by providing the latter/s with different level of access to a specific Device).
• Provision of servicing and maintenance for removal of technical defects, limiting the access to the Service, etc.;
• Email or SMS verification to guarantee the security of the data access of your account and the device;
• Provision of information via email about new products and/or services upon explicit consent on your part;
• Sending messages for the purposes of direct marketing and advertisement upon explicit consent on your part.

2.2. Data concerning the Device and the Paired device for the purposes of:

• Provision of connectivity between the Device and the Paired device;
• Control of data access to the Device;
• Provision of client support and maintenance service for ensuring the correct functioning of the watch and the MyKi App;
• Improving the MyKi services;
• Provision of information about our new services and products.

2.3. Data concerning the Paired device for the purposes of:

• depiction of the location of the paired device on a map;

2.4. Data concerning location of the Device for the purposes of:

• ensuring the functioning of Device as GSM tracker;
• providing the tracking options and features of the Service;
• depiction of the active and/or historic data regarding the location of the Device on a map.

2.5. Data concerning the Device User for the purposes of:

• individualization of more than one device in the account (each device can be connected to only one account for security reasons, as for some Devices Main App User may provide access to Secondary User/s by providing the latter/s with different level of access to a specific Device, but to one account there might be added more than one device);
• provision of the functionalities of the MyKi Service such as information for the physical activity and daily habits in view of attaining a more healthy and balanced lifestyle;
• history of location for retrieving information in cases of unexpected loss of connection with the server as well as for determination and tracking in the “Security zones”.

2.6. Other data for the purposes of:

• making incoming and outgoing calls from and to the Device by a limited number of “allowed numbers” possible;
• sending and receiving of incoming and outgoing messages (including voice messages);
• transmission, dispersing or exchange of content via electronic messages (including pictures);
• video streaming (when applicable).

2.7. Anonymised data for the purposes of:

• Statistical analysis of consumption and consumer demand in various regions.
• Dyagnosting and improvement of the Service.

Identification of a concrete person from this information is impossible.

3. Third parties to which we provide your personal data:

3.1. The mobile operators, servicing the telephone number from your account and the telephone number of the MyKi watch – for the purposes of the service to the extent that their cooperation is necessary for guaranteeing the functioning of the MyKi watch and the application and for the purposes of direct marketing and advertisement to the extent that you have provided consent therefor.

3.2. Google LLC, Google Ireland ltd. and other affiliates of Google LLC for the purposes of depiction of the active and/or historic data regarding the location of the Device and the Paired devices on a map, provided by Google LLC. The privacy policy of Google LLC is accessible at the address:  Google Privacy Policy <- CLICK HERE.

3.3. Combain Mobile AB – for the purpose of determination of location coordinates of the Device. The privacy policy of Combain Mobile AB is accessible at the address: Combain Privacy Policy <-CLICK HERE;

3.4. Consultants in various fields for the purposes of maintenance and improvement the quality of the service, compliance with regulatory requirements, protection of our legitimate rights and interests in court and administrative proceedings;

3.5. State bodies and institutions in relation to survailance and control procedures performed by them in compliance with the legal requirements and restrictions.

3.6. Affiliated parties of Shelly Europe Ltd. in connectioned with usage of shared technical and human resources, transformations and others.

In regards to private individuals, we require and pay attention that the above stated third parties apply all required technical and organizational measures for protection of such data.

4. The Data is processed with regard to the following time limits:

4.1. Data processed for the purpose of providing the Service - until the account is deleted.

4.2. Location data for the Device - for a period of 90 days with no more than 300 location records per day;

4.3. Chat history –for a period of 90 days with no more than 400 records per day. Chat content in the form of audio files or pictures will be stored up to 10 MB.

4.4. Data provided on the basis of consent – until it is withdrawn, as provided, including through the settings of the MyKi App or the mobile device to which it is installed or deleted, as applicable) to the extent this data is required for the use of a certain functionality of the MyKi App.

Following expiration of the above stated time limits, the data is deleted and may not be retrieved and used any longer. The data shall not be deleted but shall continue to be processed only for the purposes of protection of our legitimate rights and interests or in compliance with our legitimate obligations, in the event that as of the date of expiration of the above stated time limit there is pending court, administrative and pre-court proceedings – until its termination.

5. Your rights as a data subject:

5.1. Right to access, including right to copy data undergoing processing:

• Under the EU General Data Protection Regulation (GDPR) the data subject, have the right of information in regards to your personal data processed by us, at any time.
• In case Shelly Europe Ltd. processes your personal data, you can have access to the following information:

- the purposes of the processing;

- the categories of personal data concerned;

- the recipients or categories of recipient to whom the personal data have been or will be disclosed;

-where possible, the envisaged period for which the personal data will be stored;

• The actions that Shelly Europe Ltd. takes during and on the occasion of exercising consumer rights are completely free of charge.
• If we are unable to provide you with access to your personal data because disclosure would violate the rights and freedoms of third parties, we will notify you of this decision.

Only a person who can be identified by Shelly Europe Ltd. has the opportunity to exercise their rights under this section. You may contact us and after filling out a written request and verifying your identity the requested information will be provided to you.

In the event that Shelly Europe Ltd. has legitimate concerns regarding the identity of the individual submitting a request, we may request the provision of additional information necessary to verify the identity of the person. Shelly Europe Ltd. reserves its right to refuse access to the required information if we are not in a position to identify the individual submitting a request.

To help us process your request quickly and efficiently, please provide as much detail as possible about the personal data you are requesting access to.

 

5.2. Right to rectification of inaccurate personal data:

• You have the right to request correction and/or supplementation of your personal data when the data is incorrect and/or incomplete. This you can accomplish via your account in the MyKi App or by contacting us, filling out a written request form and verifying your identity.

5.3. Right to erasure („The right to be forgotten“) in the following cases:

• Removal of the need to process;
• Withdrawal of consent (when the processing of the data is on the legal bases of provided consent);
• Illegal data processing;
• Legal obligation to delete.

The right to be forgotten is not an absolute right and might not be respected in cases provided for by the law and because of a lack of reliable verification of your identity.

You may exercise your right to erasure your data according to the procedure prescribed below or by contacting us, filling out a written request form and verifying your identity. Deleted data cannot be recovered by Shelly Europe Ltd.

 

ACCOUNT DELETION:

You may request the deletion of Your account:

• via your account in the Myki Аpp through the settings. Deleted account and personal data therein cannot be recovered by Shelly Europe Ltd.
• by clicking on the web link below Delete Myki App Account <- CLICK HERE

Follow our instructions during the process of deletion of your account. Once we have verified your personal identity, we shall proceed further with your request, and shall provide you with the relevant instructions for successful completion of the process for account deletion if the requirements imposed by law are met.

Upon successful completion of the procedure for account deletion, your account data, as well as any other data associated with your account shall be IRREVERSIBLY DELETED.

 

MANAGE DATA FOR THE DEVICE:

In case You do not want to delete your account entirely, by using the features of MyKi App through the settings You may choose to:

• reset the settings of the Device, locate the Device, lock the Device, restart, or shutdown the Device, choose Myki Device face & Display, Language or
• remove the information for the Device from your account in the MyKi App.

Upon successful completion of the selected procedure the collected data will be IRREVERSIBLY DELETED.

5.4. Right to restriction of processing when:

• The autheinticy of data is disputed, for the period for which their autheinticy should be checked; or
• Processing of data is without legal ground, but instead of deletion on our part, you want their restricted processing; or
• Need for data concerning establishment, exercise or protection of your legal claims; or
• Objection has been submitted as regards data processing pending check as to the legality of the grounds of the administrator.

In case of rectification or erasure or restriction of processing, we will notify every recipient to whom personal data has been disclosed unless this is impossible or requires disproportionately huge efforts.

5.5. Right of portability of the data, where:

• the processing is based on consent or on a contract; and
• the processing is carried out by automated means.
• The portability shall be commenced at your request and if technically feasable;
• at your request and technical possibility, the data is provided to another administrator of your choice.

That right shall not apply:

• to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• where this right would affect adversely the rights and freedoms of others.

 

5.6. Right to object to the processing when its based on legitimate interest or in the public interest:

• You have the right to object to the processing of your personal data when the processing is based on legitimate interest of the Controller or in the public interest. The processing your data will be ceased, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

5.7. Right to object to the processing for the purposes of direct marketing:

• You have the right to object to receiving messages for the purposes of direct marketing, including to the profiling concerning the direct marketing, at any time.

 

5.8. Right to file a complaint with the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

• Without prejudice to your right of complaint to the supervisory authority at any time, please contact us in advance and we promise to make everything possible to settle any disputes amicably.
• Users have the right to submit complaints or signals to the Commission for Personal Data Protection (CPDP), in case they believe the processing of their personal data violates the legislation on personal data protection. Instructions for filing complaints are published on the website of the CPDP: https://www.cpdp.bg
• Users may also file complaints with other supervisory authorities in the territory of the European Union, as provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

6. Used automated individual decision-making, including profiling (automated algorithms)

We do not use any automated algorithms and/or profiling.

You may exercise the aforementioned data subject rights after filling out a written predefined request form which you may receive from the business address of the Controller or via electronic means after contacting the Data Protection Officer and filling out the electronic form which you will receive in response.

Only a person who can be identified by Shelly Europe Ltd. as App User may exercise their rights under section 5. In the event that we have legitimate concerns regarding the identity of the individual submitting a request, we may request the provision of additional information necessary to verify the identity of the person.

Response of our request will be delivered in within one month of receiving your written request form.

7. Privacy Policy Updates

We may update this Privacy Policy from time to time due to changes of the MyKi App, the applicable laws etc.

Any changes will become effective upon posting of the last version in the MyKi App.

8. Further information:

If you have any additional question, please do not hesitate to contact us at: dpo@shelly.com