General information about data handling

Definitions

To read this policy in context, the following definitions clarify the terms used in examples and scenarios throughout the document. Each definition is linked to practical cases where that term is relevant.

Why we process personal data

For each purpose we give a concrete example or scenario showing the minimal data required and the expected outcome. We separate operational needs from optional analytics and from legal compliance.

• Service delivery: configuring and operating climate timing profiles. Example: using device telemetry and schedule preferences to adapt start times for morning preheat.
• Diagnostics and technical support: resolving faults reported by users. Example: an installer shares serial numbers and error logs to identify a hardware issue during commissioning.
• On-site visits and commissioning: arranging appointments and recording as-installed parameters needed to replicate cases for future reference.
• Billing and administration for paid services, where applicable, such as a custom scheduling project tied to a client engagement.
• Product improvement and research: analysing anonymised performance data across real-case scenarios to refine timing algorithms.
• Security and fraud prevention: using connection logs and device identifiers to detect and block abusive access patterns to remote control interfaces.
• Legal compliance: retaining limited records to meet regulatory obligations or to respond to lawful requests from authorities when justified.
• Communications: sending appointment confirmations, technical advisories and relevant case updates based on the communication preferences you set.

Legal bases for processing

We rely on different legal bases depending on the processing purpose. For operational tasks we most commonly rely on necessity for contract performance or on legitimate interests balanced against individual rights. Consent is sought for marketing and optional case participation.

• Performance of a contract: processing required to set up and operate the service you have requested, e.g. commissioning a timing profile during a site visit.
• Legitimate interests: for security, fraud prevention and internal product improvement when such interests are proportionate and documented.
• Consent: for optional activities like inclusion in anonymised case studies or marketing communications where explicit consent is obtained.
• Legal obligation: where retention or disclosure is required by law or by a court order in Switzerland or other competent jurisdiction.

EU GDPR and related rights

Where the GDPR applies, KlimaTopZeit implements the rights and safeguards it prescribes. The examples below show how a user can exercise rights in common service scenarios such as exporting a personal copy of a timing profile or requesting erasure before selling a home.

• Right of access: you can request a copy of your personal data and an explanation of how it was used during a commissioning scenario.
• Right to rectification: correct inaccurate contact or installation details recorded during onboarding.
• Right to erasure: request deletion of personal contact data when a service relationship ends, subject to retention obligations for records linked to billing or legal compliance.
• Right to restriction: ask for limited processing of certain data, for example retaining device logs for diagnostics but not analytics.
• Right to data portability: obtain a structured export of your timing profiles and associated settings for migration to another provider or local archive.
• Right to object: object to processing based on legitimate interests, for instance if you do not want anonymised data included in product improvement datasets.

Cookies and similar technologies

We use cookies only as needed to maintain session state, remember consent and gather anonymised analytics for case study materials. Choices about cookies are respected and can be changed at any time.

Types include essential cookies for login and session integrity, preference cookies for remembering consent, and analytics cookies used to collect aggregated usage measures supporting scenario research.

Categories: essential, preferences and analytics. Essential cookies cannot be turned off without affecting service functionality; preferences and analytics can be managed by the user.

You can manage cookies via your browser settings or through the cookie management interface on KlimaTopZeit.pro. We document common scenarios so users understand consequences of disabling certain cookie categories.

Detailed cookie policy and management options are available at KlimaTopZeit.pro/cookie-policy

Sharing personal data

We share personal data only as necessary for the purposes described and with partners bound by contractual and technical safeguards. Each sharing scenario is listed below with the typical categories of data involved.

• Service partners and installers: share installation data and diagnostics to coordinate on-site commissioning and troubleshooting.
• Cloud service providers: host telemetry and configuration data under processor agreements that require appropriate security measures.
• Legal and regulatory bodies: disclose minimal data when required by law or to respond to lawful requests.
• Analytics providers: share anonymised and aggregated usage statistics for product improvement if you have not opted out of such analysis.
• Acquirers or advisors: in the event of a business reorganisation or sale, limited records may be shared under confidentiality terms as part of due diligence.
• Emergency responders: limited contact and location details may be disclosed if necessary to prevent or respond to safety incidents.

International transfers

Some processors we use may operate servers outside Switzerland. Where personal data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses or transfers to jurisdictions with adequate protections. Each case study that involves a transfer is documented so users can see the destination and safeguard applied.

Typical safeguards include processor agreements containing data protection clauses, encryption, and restricting transferred datasets to the minimum necessary information for the task (for example anonymised telemetry rather than identifiable contact details).

Retention of personal data

Retention periods depend on the type of data and the scenarios in which it is used. We aim for the minimum necessary retention and provide examples for common categories below.

Account and onboarding data: retained while the account is active and for a reasonable period afterward to allow reactivation and to meet administrative obligations (typically not longer than necessary for the business purpose).

Support messages and diagnostic platform: retained for a limited period to resolve ongoing cases and for a short archive to help with recurrent issues (examples and retention windows are provided during onboarding).

Connection and diagnostic logs: retained for a defined operational period to support troubleshooting and security contribute, then reduced to aggregated summaries for long-term analytics.

Upon request for deletion we remove contact details and disassociate telemetry from identifiable accounts except where retention is required to meet a legal obligation or defend legal claims. Deletion cases are described with procedural steps for verification.

Security measures

We implement technical and organisational measures proportionate to the risks associated with our services. Security practices are described with practical scenarios, for example how encrypted remote sessions are used during a commissioning visit and how access logs are reviewed after a firmware update.

• Encryption of data in transit using TLS for web and remote connections, and encryption at rest for sensitive backups used in scenario reconstructions.
• Access controls and role-based permissions for staff and partners involved in installation and support, combined with multi-factor authentication for administrative interfaces.
• Regular audits and logging of access to systems holding personal data, with incident response procedures aligned to minimise impacts on affected users and to document lessons learned for future cases.

Your rights and how to exercise them

This section explains in practical terms how to exercise your rights and what to expect in common situations such as exporting timing profiles before transferring a home to a new owner or requesting limited access while an contribute is underway.

• To exercise rights such as access, rectification, erasure, restriction or portability, contact [email protected] or write to KlimaTopZeit, Quadratscha 25, 7503 Samedan, Switzerland. Include sufficient information to identify the account and the specific request.
• We will respond to verifiable requests as required by applicable law and will document decisions with clear explanations. Where requests are complex (for example exporting full historical telemetry for a multi-zone installation), we will engage with you to clarify scope and timelines.
• Right of access — You can request a copy of the personal data we hold about you. Practical example: a homeowner asks for the last 12 months of automated scheduling logs to review how indoor climate timing adjusted to occupancy patterns.
• Right to rectification — If information is inaccurate or incomplete (for instance, an incorrect home address used for site visits), submit a correction request and we will update records used by KlimaTopZeit systems and linked service partners.
• Right to erasure — In scenarios such as closing an account, you may request removal of personal data that is not required for contractual or legal retention. Case example: after uninstalling KlimaTopZeit hardware, a user requests deletion of location-based scheduling history.
• Right to restriction of processing — You may ask us to pause certain processing activities while a dispute is being resolved. Practical scenario: if you dispute accuracy of occupancy detection data, we can limit use of that dataset for automated schedule changes until clarified.
• Right to data portability — For profiles created through KlimaTopZeit.pro, you can request a machine-readable copy of personal data such as preferences, device identifiers and scheduling rules to transfer to another compatible smart-home service.
• Right to object to processing — If you prefer KlimaTopZeit not to process personal data for direct marketing or profiling-based schedule suggestions, you may object and we will stop those specific processing activities while keeping necessary service functions active.

How to exercise your privacy rights

To exercise any of the rights listed above, send a written request to our privacy team via the contact form at KlimaTopZeit.pro/contact or by postal mail to Quadratscha 25, 7503 Samedan, Switzerland. Include your full name, Business ID (if applicable), a description of the right you wish to exercise, and supporting details (for example dates or specific devices). Where helpful, describe a real scenario — e.g. "I want the last six months of thermostat schedules for apartment A" — so we can locate records efficiently.

[email protected]

We aim to respond to straightforward requests within 30 days of receipt. For complex requests that require coordination with device manufacturers or third-party providers, a response may take longer; in that case we will notify you of any reasonable extension and the expected timeline.