Information on the processing of personal data - GuidERA Mobile Application
INFORMATION ON THE PROCESSING OF PERSONAL DATA
*** GuidERA Mobile Application***
(the “Application”)
Through this document, we provide you with information regarding your rights related to the processing of your personal data by Smart Energy Holding a.s., ID No.: 10676406, with its registered office at U Trezorky 921/2, Jinonice, 158 00 Prague 5 (the “SEH”), and, where applicable, by entities controlled by or controlling SEH that together with SEH form a group (concern) within the meaning of Sections 71–91 of Act No. 90/2012 Coll., on Business Corporations.
We recommend that you read this information carefully. We have done our best to make it as clear as possible. Should anything remain unclear, we will be happy to explain any term or provision to you.
1. Who is the controller of your personal data?
The controller of personal data – i.e., the entity that determines the purpose and means of, and decides on the processing of your personal data and personal data of business partners/suppliers – is SEH. SEH has not appointed a data protection officer.
2. How and why is your personal data processed?
When processing personal data, we comply with applicable legal regulation, in particular Regulation (EU) 2016/679 of 27 April 2016, General Data Protection Regulation (the “GDPR”), and related legal acts. SEH receives your personal data from its partners (installation company or distributor) for the purpose of warranty authorization and operation of the Application, based on your consent granted during registration and confirmation of the handover protocol for your ERA device. For questions regarding the processing of personal data within the scope of a purchase agreement and installation, please contact your business partner directly.
3. What is the purpose and legal basis for the processing of personal data?
We process and store your personal data only for the following purposes:
operation of the Application and management of the user account;
authorization of the manufacturer's warranty provided by the manufacturer to the distributor and warranty documentation;
technical support and handling of complaints;
ensuring the security and stability of the Application;
record-keeping and statistical purposes;
protection of the legitimate interests of SEH.
The legal basis for processing is as follows:
consent to the processing of personal data pursuant to Art. 6(1)(a) GDPR — for the purposes of authorizing the warranty provided by the manufacturer to the distributor and remote access to your ERA device;
necessity of processing for the performance of a contract pursuant to Art. 6(1)(b) GDPR — for the operation of the Application based on the Application's Terms of Use;
legitimate interest of SEH pursuant to Art. 6(1)(f) GDPR — ensuring relationships with business partners, providing customer care, ensuring the security and stability of the Application, handling claims, and providing technical support.
4. What personal data do we process?
The scope of processed data depends on your role in the Application.
identification data: name, surname, academic titles (if any), e-mail address, password, country/region;
device data: serial number (SN), device model, software version;
location data: address of the property where your ERA device was installed, name of the installation site, GPS coordinates;
technical installation snapshot: operational parameters at the moment of start-up — temperatures, pressures, network configuration — used for a one-time verification of correct installation for warranty authorization purposes;
photodocumentation of installation: photographs capturing the technical connection of the device, taken by the installation partner;
electronic identifiers (via Firebase): IP address, unique identifier (UUID), operating system version, and browser version.
corporate and contact data: company name, address, technician’s name, e-mail, telephone number, professional certification;
installation documentation: photographs capturing the technical connection of the device;
contractual data: name, position, and signature of the person signing the personal data processing agreement.
Furthermore, we process data related to your written and electronic communication with SEH, including identifiers such as IP addresses, browser data, and the type of electronic device.
No automated decision-making or profiling occurs during the processing of your personal data.
SEH processes personal data both manually and automatically, directly through its employees and, where applicable, through processors (see Section 9 below). The protection of personal data is technically and organizationally secured by SEH in accordance with applicable legal regulation. Data are collected and processed for specified, explicit, and legitimate purposes. Processing is not carried out in a manner incompatible with these purposes. Only data strictly necessary for the stated purpose is collected and processed.
5. Retention period of personal data
Where you are provided with a basic quality warranty for your installed ERA device, we process your personal data for period of 3 years from the confirmation of warranty authorization. Where you are provided with an extended quality warranty for your installed ERA device, we process your personal data for a period of 11 years from the confirmation of warranty authorization, unless your consent to the processing of your personal data is withdrawn before the expiry of that period.
6. Communication with the SEH customer line – recording of telephone calls
If you communicate with us by telephone via the technical support line, our calls may be recorded. You will always be informed about the recording at the beginning of the call. Call recordings are stored in our internal information system. We record calls based on SEH's legitimate interests, consisting of maintaining records of your requests, suggestions or claims so that we can record, evaluate and properly handle them and ensure that we fulfill our contractual obligations duly and on time. This also allows us to prove the handling of your requests and compliance with our quality standards for communication and services. Please note that the technological solution does not allow for the immediate termination of call recording if it emerges during the call that there is no legal ground for recording or that consent has been withdrawn. In such cases, we will note your request and submit it for processing. If your request is justified and there is no other reason to process the recording, the call recording will be permanently deleted from all storage no later than one month from the date of the call.
7. Cookies and similar technologies
The Application operates in two environments. Each uses slightly different tracking technologies, described separately below.
7.1 Web Interface — Cookies
The web interface of the Application uses cookies — small text files stored in your browser. We use exclusively the following categories:
- Essential cookies: ensure login and authentication via Firebase Authentication. The web interface cannot operate without them. These cookies cannot be deactivated without limiting the functionality of the Application.
- Analytical cookies (Firebase Performance): Used to measure the performance of the web interface (e.g., response time, stability) and for its optimization. Data is processed in an aggregated form and is not used to directly identify the user. Analytical cookies are used only if you grant your consent.
You can manage cookies in your browser settings. Please note that blocking essential cookies may prevent logging into the web interface. Information on cookie management for individual browsers can be found on the respective providers' websites
7.2 Mobile Application — Tracking Technologies
The mobile application does not use browser cookies but utilizes other technologies for its operation and improvement:
Firebase Authentication (session tokens): used to verify login and maintain session status. Necessary for secure operation; cannot be disabled.
Firebase Crashlytics: collects pseudonymized technical information about application crashes (e.g., device type, application version, technical error log). The purpose is to ensure stability and fix errors. Retention: 90 days.
Firebase Performance Monitoring: collects aggregated data on application performance (e.g., loading speed, response time).
7.3 Shared Database and Unified Account
The web interface and the mobile application share a common database (Firebase Firestore) and a user account. Data entered in one environment is available in the other. Account management is unified for both environments. Deleting an account in one environment deletes the account in both.
7.4 Legal Basis
The purposes described (see Section 7.1) use Article 6(1)(f) GDPR as the legal basis for processing personal data via cookies. If you provide consent to use cookies based on a notice (the “Cookie Bar”) on our website, the lawfulness is further regulated under Article 6(1)(a) GDPR. You may withdraw or change your consent at any time through the cookie settings.
8. How do we protect your personal data?
You can be fully assured that we handle your personal data with due care and in accordance with valid legal regulations. We secure your personal data to the maximum extent possible, corresponding to the technical level of available means. SEH implements the following technical and organizational measures:
protection against unauthorized access to SEH premises is secured by locking entrance doors;
protection of hard-copy documents against unauthorized copying and use is secured by storage in locked cabinets and offices accessible only to selected SEH employees;
encryption of data transmission (HTTPS/TLS) and data stored on servers (encryption at rest), access control, and infrastructure certification;
protection of electronic documents and protection against unauthorized network access is secured by access passwords, data is encrypted, and access to SEH networks is protected by a firewall;
in the event of transferring your personal data outside SEH, we contractually ensure an appropriate level of data protection and security in accordance with relevant legal regulations.
9. To whom else do we transfer your personal data and why?
As a matter of principle, we do not transfer your personal data outside SEH, except in cases where:
we have your consent;
the recipient is a member of the SEH group (specifically: PHOTOMATE s.r.o., Photomate Logistic s.r.o., Photomate Energy s.r.o., Prokišova s.r.o., PHOTOMATE Polska Sp. z o.o., Poland, PHOTOMATE Hungary Kft. Hungary, LLC PHOTOMATE, Ukraine, PHOTOMATE BULGARIA EOOD, Bulgaria, PHOTOMATE Scandinavia ApS, Denmark, PHOTOMATE Green Energy Romania Srl., Romania, PHOTOMATE Eurasia LLC, Georgia, Photomate Scandinavia AB, Sweden, organizational branches of PHOTOMATE s.r.o. in Estonia and Lithuania, Photomate Kazakhstan, PHOTOMATE CA LLC, Uzbekistan);
third parties provide technical and organizational services to us as personal data processors — specifically:
Firebase (Google LLC): hosting, authentication, database (Firestore), cloud functions, messaging (FCM), and security monitoring. Data is stored exclusively in the EU — Warsaw (europe-central2) and Belgium (europe-west1) regions. Data protection policy: firebase.google.com/support/privacy.
SEH Partners:
Installation Partner: has access to their customers' data for service and warranty management purposes, within the scope set by the personal data processing agreement;
Distributor: limited access to aggregated statistics; accesses personal data exclusively during technical escalation or an authorized service intervention;
Third parties provide technical and organizational services for us in accordance with our instructions as the controller (personal data processors), including software operation and data storage, and persons providing accounting, tax, or legal advisory services for the controller;
In cases arising from generally binding legal regulations, we are obliged to transfer personal data to tax authorities, law enforcement agencies, or other competent authorities.
With the exception of the cases stated above, we do not transfer and do not intend to transfer your personal data to countries outside the EU or to international organizations.
10. What Rights May You Exercise in Connection with the Protection of Personal Data?
In relation to your personal data that we process, you have the following rights, which you may exercise against us as the controller:
the right to obtain confirmation of the scope of the processing of your personal data and the right of access to it;
the right to rectification or completion of your personal data if it is inaccurate or incomplete;
the right to erasure or restriction of the processing of your personal data, provided that the conditions set by legal regulations are met;
the right to object to the processing of personal data concerning you;
the right to portability of your personal data to another controller.
In the event that we process any of your personal data based on your consent, you have the right to withdraw your consent to the processing of such personal data at any time.
You may exercise all your rights through a written submission delivered to the controller at the address of SEH's registered office or to the e-mail address info@photomate.eu.
If you believe that the processing of your personal data is in violation of legal regulations, you have the right to lodge a complaint with the competent supervisory authority of a European Union member state.