Privacy Notice

This is the Privacy Notice of Seluxit, founded on the basis of the General Data Protection Regulation (GDPR), with the purpose of informing you about, but not limited to, the type, scope and purpose of the collection, processing and use of personal data on our websites and through our products either by Seluxit or Seluxit stakeholders. Managing, securely protecting, and enabling the secure sharing of data is a cornerstone feature in the products Seluxit offers by their design.

Products offered

Seluxit offers an IoT end to end platform called Wappsto. Wappsto is a powerful, intelligent application which easily can be set up to automatically draw data from various sources. It has an integrated standard dashboard for monitoring and analysing your data. Wappsto also offers tools that allow developers to create IoT applications as web apps with integrations and automations. Integrated in Wappsto there is also a marketplace, where developers and users can share their Apps.

In addition to Wappsto, Seluxit has performed and will continue to perform other project-based work for customers, especially with regards to embedded systems development, where privacy concerns may also be relevant. In these instances, the handling of data will be generally consistent with the policy outlined in this document. In addition, Seluxit offers a range of products, which can be purchased from the Seluxit webshop. A description of Seluxit’s processing of personal data in relation to the purchase of products from the webshop can be found here. Additional considerations may be handled independently in contractual arrangements between Seluxit, our clients, and project stakeholders.

Any commercial usage of Seluxit products will require a set of contractual arrangements.

Seluxit Products and their Stakeholders

Seluxit products have multiple stakeholders that may influence the handling of data. The overall categories of stakeholder can be defined as follows: (1) Seluxit, as the producer and custodian of the Seluxit products, (2) developers (enterprises or individuals) using Seluxit products and potentially other products to create an application for others to use (i.e., end-users) (3) third-parties utilized by these developers towards these ends, and (4) end-users.

The Seluxit IoT Platform

The Seluxit IoT Platform is a backend software system that enables end-users to control connected devices based on applications constructed by developers and third-parties. This activity is usually to provide customers (i.e., end-users) of connected product manufacturers (i.e., developers) the ability to access to control these products. Several third-party vendors may use the Seluxit IoT Platform to help provide developers with this service to the end-users, including for example data analysts and app developers.

Wappsto

Wappsto is a data market with an integrated app store. Data generated by end-users’ connected devices and digital services can be shared and combined to create meaningful applications. Developers create web apps (called ‘wapps’ in Wappsto) which work with diverse third-parties devices and digital services (i.e., third-parties). Wapps can then be shared or sold on the Wappsto store. End-users then configure these wapps to use their own accounts to the corresponding third-party devices and services and have the option to share or sell the configuration and/or data generated by the use of these wapps.

What is personal data?

According to the GDPR personal data refers to “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;”

In this document we may refer to the data subject as “you”.

Non-personal data and statistical data is anonymized. This makes the connection to the data subject possible only at a significant effort in time, cost and workload.

What, when, and why is personal data collected

Data Collected by Seluxit

Seluxit collects personal data insofar as it is required for the operation and support of Seluxit products. Seluxit sometimes collects personal data, as an offer to, and at the request of, visitors to Seluxit product websites, which is used for the purpose of sending informative email newsletter communication. Seluxit also collects data in order to process order from the Seluxit webshop. For more information about the data collected in relation to the Webshop please see Webshop Privacy Notice.

Email address (username) and password

Accounts for Seluxit’s aforementioned products (Seluxit products) are created by providing a working email address as well as assigning a password upon registration. This is all the personal data that Seluxit needs from users of Seluxit products (i.e., developers, end-users and third-parties) to provide in order to operate securely in authenticating the user of Seluxit products. Though this information is always required, and no other personal data needs to be provided by the user, other personal data may be collected either automatically (IP addresses) or manually (additional optional personal details). Refer to the sections below.

It should be noted that the email address need only be functional and does not necessarily have to be overtly indicative of the individual’s identity. For example, an email could itself come from a service allowing for an anonymous email without direct reference to a natural person.

Additional optional personal details

Additionally, it is an option to enter a limited amount of personal information, including name, phone number or address. This information can be provided in the event that the user wishes to allow themselves to be found as users on the Seluxit products.

IP Addresses and Cookies

IP addresses are usually considered personal data, even though it is not in all cases easy to ascertain the identity of an individual from an IP address. Seluxit treats IP addresses as personal data and Seluxit collects the IP addresses of the users of Seluxit products. IP addresses are also registered for the operation of Seluxit’s websites. Seluxit uses Google Analytics to analyze the behavior of visitors to Seluxit’s websites in order to improve Seluxit’s websites. Note that this means that using our website and agreeing to the use of cookies means that the personal data of your behavior on our site will be stored on servers in the United States. It is possible to opt out of the collection of your personal data to Google by downloading a browser add-on provided by Google (Google Analytics Opt-out).

Email Newsletters

Seluxit product websites may include forms with offers to sign up for receiving one-time emails or to receive periodic email newsletters. The information collected will include email addresses, as well as the names of the subscribers and may include fields with optional additional information that can be given to help our marketing department understand the needs and concerns of our potential investors and customers. These will always be clearly marked and visitors who give their emails for this purpose can see if it is a one-time or periodic newsletter. If a visitor receives a periodic newsletter, it will always be possible for the recipient to unsubscribe to the newsletter, at which point their information will be deleted from Seluxits records as well as, if applicable, email newsletter services. The personal data may be mediated by email newsletter services or may be handled directly from internal systems. We currently use Mail Chimp as an example of the former. Please refer to the Mail Chimp privacy policy for more information.

Payment information

Whenever a customer pays for products, we collect, and process contact and payment data to process the payment. For more information about the data collected in relation to payment through the Webshop please see Webshop Privacy Notice.

Email correspondence

Seluxit product stakeholders and other interested parties may send emails to Seluxit that contain personal data including the sender’s email address, name and home or office address.

Sales

Usually, every time a customer engages with one of Seluxit’s sales representatives, including forms and the chat function on our website, we collect the customer’s name and contact data, along with information about the customer’s organization, to support that engagement. We may also get your personal information from your website or other places where your information is publicly available, or from fairs and conferences. For the sales and development purpose, we collect only information related to potential customers or partners, which we directly contact. Therefore, the data subject is made aware of our processing of their personal data.

Job applications

Whether you apply directly related to a job announcement or you send us an unsolicited application we only process your personal data internally at Seluxit A/S with the purpose of recruitment. Your personal data will be shared only with the necessary people involved in the recruitment process and will not be shared with other people. When you send us an application, you will get an email containing more details about our recruitment process and your rights as a data subject.

Data Collected by Seluxit Products Stakeholders

Personal data may be collected from applications, devices or third-party APIs in conjunction with Seluxit products. The categories of data collected are dependent on the application, device or third-party API from which they originate and may, as the case may be, include special types of personal data.

Special types of personal data

Special types of personal data are information on a person’s racial or ethnic origin, political opinions, religious or philosophical convictions, union membership, health or sex life. Additionally, there are special considerations for handling of children’s personal data for individuals under the age of 16. The handling of these data is subject to specific legal restrictions. In this context, you may be asked by the Seluxit product’s stakeholders to provide your consent to the processing of these data, and their handling of this data will require your consent, consistent with GDPR regulations.

Seluxit Products Stakeholders Responsibilities

With regards to Seluxit products stakeholders, it is the responsibility of Seluxit product stakeholders to adhere to the relevant GDPR laws regarding the handling and processing of this data.

Though the responsibility lies in Seluxit product stakeholders, Seluxit will take certain measures to ensure their compliance. These measures will be in the form of terms-and-conditions documents which legally stipulate the legal requirements and obligations. In the case of Wappsto, Seluxit will also undertake audits of the Wappsto web apps (wapps) to ensure that no malicious wapps are distributed, including the improper handling of personal data.

Do we share the data?

Data Collected by Seluxit

Personal data is only shared at the behest of Seluxit products stakeholders. Seluxit will never use your personal data for marketing purposes, but reserves the right to use non-personal data content and statistics for marketing purposes.

Email address (username) and password

This information will never be shared with any other parties than the data subject.

IP Addresses and Cookies

IP addresses of users of Seluxit products will not be shared by Seluxit, though it is possible that Seluxit product stakeholders do. In these instances, users will be explicitly sharing their own personal data, or explicitly consenting to have their personal data shared.

Email correspondence

Seluxit will never share personal information obtained through email correspondence between Seluxit and Seluxit product stakeholders. In the event that outside consultants could be interested in aspects of the email correspondence that has occurred between Seluxit and Seluxit products stakeholders, only non-personal, anonymized data will be used. This could include excerpts from the text of the mail, insofar as it does not reveal the identity of the data subject. This could be for various purposes including, but not restricted to supporting the Seluxit products stakeholder with issues they have in the use of Seluxit products. The purpose of sharing of anonymized data could also be for promotional purposes.

Data Collected by Seluxit Products Stakeholders

Seluxit products stakeholders may, as an aspect of the usage of Seluxit products, share the personal data they collect. Stakeholders that use Seluxit products which collect and potentially share personal data will be obliged to make the terms of the sharing of data explicit for the data subjects, consistent with GDPR regulations.

Right to export your personal data

IP addresses can easily be ascertained by other means (e.g., Whats my ip), and there is thus no need to export this data.

With regards to Seluxit products stakeholders, applications created that collect personal data will be obliged to enable the export of personal data insofar as the GDPR regulation stipulates.

How do we protect the data?

Transference of data

Transference of data from devices into the Seluxit IoT Platform requires the existence of Seluxit issued (self-signed) SSL certificates that the server recognizes as legitimate using a private and public key pairing. Note that Seluxit cannot prevent hacking into the hardware to obtain the certificate on the device. In this case, however, the scope of the breach is still limited to the individual product.

Transference of data from a front-end user interface involves trust from Seluxit’s side, which is established based on the encrypted transference of the user’s username and password. The client trusts Seluxit based on SSL certificates issued by the service “Let’s Encrypt” which mediates the authentication. As with the connection with devices into Seluxit products, the scope of potential security breaches is limited to the individual user in this case.

Storing of data

A consideration of the securing of stored data can be considered in three layers: getting into the system, accessing the data in the system, and reading the data in the system.

Data is stored on Seluxit’s hosting partner’s equipment, Hetzner and OVH. Security of the data on the servers that Seluxit uses is state-of-the-art. Seluxit may use additional server partners in the futures that also meet the high standards of security that Hetzner and OVH offers.

The most sensitive data that is stored in our databases (username and password) is encrypted. Based on the functionality of Seluxit products and with an eye to the anonymization of data, data is stored in such a manner that universally unique IDs (UUIDs) are assigned to every architectural layer and piece of data stored. This means in the event of a data breach, that reconstructing the raw data would be extremely difficult. Moreover, data of different types is stored on different partitions in the server area, again making reconstruction extremely difficult.

For how long will we retain your personal data?

Data Collected by Seluxit

Email address (username) and password

This information is kept indefinitely until you actively delete your account. Upon deletion of your account, the information is deleted immediately.

Additional optional personal details

This information is kept indefinitely until you actively delete it or until you delete your account. Upon deletion of your account, the information is deleted immediately.

IP Addresses and Cookies

IP addresses, which are saved in logs, are rotated regularly. The duration is linked to the traffic generated on our servers and thus can vary significantly.

Cookies are only stored locally on the user’s browser, and they remain on the user’s computer until they expire as stipulated by the issuer of that cookie, or until the user deletes cookies from their browser.

There are special considerations with regards to backups, which has already surfaced as a point of contention of the GDPR. The issue is that if a user requests the deletion of their data, it can have an implication for the ability to backup and restore data for a much larger scope of people. Backups are compressed in binary format, so restoring is a resource-intensive process. Therefore, Seluxit reserves the right to keep backups of data, which we feel is responsible regarding the relatively non-sensitive nature of the personal data we hold.

Social media plugins

Email Newsletters

Data collected for email newsletters is only kept internally by Seluxit and/or with our email newsletter services partners for the purposes of operating the email newsletter. No external party not involved with these operations will be given access to this data.

Email correspondence

This information is kept indefinitely and deleted at the discretion of Seluxit. Upon request, we can delete emails, as long as the purpose Seluxit had with the mail (for example support that may affect other users) is no longer present. Mails may also be kept in the context of settling potential disputes between Seluxit and Seluxit’s stakeholders that may arise.

Data Collected by Seluxit Products Stakeholders

This is at the discretion of Seluxit products stakeholders, and Seluxit products stakeholders will be required, as per the GDPR regulations, to make clear their handling of the data.

Your rights

In accordance with the GDPR, we highlight here that you have the right to:

Access

Request for information on your stored data and the purpose of such data storage – also in relation to the origin and recipients of the data.

Correction

Request correction of your personal data where the data is incorrect. In Seluxit products, you may simply log into your account and correct the data.

Delete user data

Request to have your data deleted by sending an email to info@seluxit.com. Deletion of your account is also enabled in the user interface of Seluxit products. Note that personal information may persist in backups.

Portability

Request a transfer of your personal data. Refer to the note on the export of your personal data above in this document.

Further rights and information

You have more rights regarding the processing of your personal data. Refer to the GDPR for more information (EU GDPR Information).

Contact

Please do not hesitate to contact us if you think there may be a problem with the privacy of your personal data, for any clarification on the protection of your privacy or for any request to use your rights as a data subject, at info@seluxit.com.
Seluxit A/S
Sofiendalsvej 74
9200 Aalborg SV
Denmark

Changes in the Privacy Notice

This privacy notice has been last updated on the 17th of June, 2021.

Seluxit retains the right, in its sole discretion, to change this Privacy Notice at any time. You may access and print this Privacy Notice at any time via www.seluxit.com/privacy. As a change of legislation, as well as changes in our internal procedures, may affect the adoption of this Privacy Notice, we kindly ask you to check this Privacy Notice on a regular basis.