Data Protection Information for the mojBSH App

BSH Hišni aparati d.o.o. Nazarje, located at Savinjska cesta 30, 3331 Nazarje (hereinafter "BSH" or "we"), is responsible for the collection, processing, and use of your personal data related to the mojBSH app (hereinafter "app").

We collect, process, and use your personal data that you enter or otherwise create and process while using the app in accordance with applicable data protection regulations. The following information explains how we handle such data based on the terms of use or other legal basis.

1. Types of Personal Data
   
   In connection with the use of the app, services, and features offered by mojBSH (hereinafter: services), mojBSH collects, processes, and uses the following categories of personal data.

1. Basic User Data and Usage Data
   
   Below we describe how we collect and use personal data when setting up a user account (registration) and when setting up the app. This data is stored in your account, which is personal and non-transferable.

1. • During registration:
     • personnel number (as username),
     • first 5 digits of the tax number,
     • email address,
     • password to protect access to the app.
   • Data collected and stored during the registration process and use of the app:
     • language settings of the mobile device,
     • system settings related to the app (e.g., permission to send messages in the app),
     • consent to the terms of use,
     • confirmation of data protection information,
     • status of the user account (activated/deactivated),
   • Content you upload to the mojBSH app, including information necessary for sharing content with third parties
     
     
2. App-Related Usage Data
   
   App-related usage data are data that arise from your interaction within the app, such as features you use, click behavior related to app management, dropdown menu choices, on/off settings, information from A/B tests and multivariate tests (i.e., tests on how individual users accept different versions of our app to improve user experience), error reports of the app, and interactions of your app with third-party apps (e.g., websites you open within the app). See item 6 for more information.

2. Purpose of Use
   
   The above categories of data are used for the following purposes:
   
   
   • to provide the features of the app and the services offered by the app, and to provide updates for your device,
   • to improve the user-friendliness of the app (including interaction between the app and household appliance) and to specifically or generally troubleshoot issues with the app and digital services offered.

The legal bases for processing purposes under the GDPR (REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016) are described in item 12 of this information.

3. General Retention Periods
   
   Unless otherwise specified by legal provisions, the following general retention periods apply:
   
   
   1. Basic User Data: Deletion immediately upon deletion of the local user account or central BSH account.
   2. App-Related Usage Data: If the "Enable Usage Data Tracking" feature is activated, storage in pseudonymized form and provision in personalized form is ensured for services/messages provided through the app. Deactivating the feature resets the individual ID used for tracking, so that already collected app usage data can no longer be associated with you.

4. Data Processing Management
   You can manage user accounts through the app and delete locally stored app data.

• • You can delete your user account ("Profile" → "Personal Data" → "Delete Account").
  • Deleting the app or using the "Factory Reset" function removes all locally stored user-related data, but not the accounts that were created separately.
  • To delete the central BSH user account, use the function available in the account.
  • Content you uploaded to the mojBSH app (especially photos, audio-video recordings, and texts): if you shared the content with third parties, this content will remain on the third party's device even if you delete the data locally.

5. Transfer or disclosure of your data, e.g., to third parties.
   We work with various service providers in the creation and management of the app and the provision of relevant services. As long as we have obligated these service providers to process data in accordance with strict instructions as data processors on our behalf, your consent is not required for all data processing activities carried out by these providers.
   
   Service providers authorized by us for the creation and management of the app:

• • Hosting service providers
  • Service providers for programming services
  • Service providers for telephone line services (even if carried out via chat function or similar communication channels) and other app services.

We only transfer your data to other recipients if it is necessary to fulfill a contract with you or between you and a third party, if we or the recipient have a legitimate interest in disclosing your data, or if you have given consent for such transfer. These recipients include service providers and other companies in our group of companies. In addition, data may be transferred to other recipients if we are required to do so by legal provisions or enforceable administrative or judicial orders.

Other recipients of your data are particularly service providers whose offers and services (third-party services) can be used in connection with the app or when the app allows access to such services (see item 9).

Content you have created yourself may also be transferred to other BSH companies (including internationally) as part of the technical processing and provision of content/services. Such transfer/processing is based on data protection agreements between the involved BSH companies, which also include the use of standard contractual clauses if the transfer involves a country outside the scope of the GDPR and if it is not a case under Article 3(1) of the Data Protection Regulation. 45 GDPR.

6. Data Security

We use technical and organizational measures to protect your data, for example, against manipulation, loss, and unauthorized access by third parties. These measures include the use of encryption technologies, certificates, firewalls on servers, and password protection in the mojBSH app. We continuously review and improve our security measures in line with technological advancements.

7. Scope of Data Protection Information
   
   This data protection information applies to the features and services offered by BSH through the app. If BSH or a BSH Group company offers additional features or services through the app, specific data protection information is available if special regulations or data protection information apply to their use.
   
   However, this data protection information does not apply to third-party services, even if BSH enables the use and/or access to these third-party services through the app (see also the terms of use regarding third-party services). The use of such third-party services is subject to the prevailing data protection provisions introduced by the third-party service provider and, if necessary, additional data protection information from us that describes the specific characteristics of these third-party services and is relevant only in this regard.
   
   If you are referred to another service provider, BSH will make reasonable and appropriate efforts to clarify such a referral (e.g., by embedding the service provider's content into the app using frames) if such a referral is not clear. If you click on a link in the BSH app that calls up an app or website of another service provider, this is considered a clear referral.
   
   If you are located in the area of application of the General Data Protection Regulation, please note that the use of third-party services may result in your personal data being processed in countries outside the scope of the General Data Protection Regulation. In this case, please refer to the data protection information of the respective third-party service providers.

8. Changes to Data Protection Information

As the app and the services provided through the app continue to evolve - including the implementation of new technologies or the introduction of new services - it may be necessary to appropriately adjust this data protection information. BSH reserves the right to change or supplement this information as needed. BSH will always update the data protection information in the app, so you can familiarize yourself with the latest version at any time.

9. Rights and Contact Information

If your personal data is stored incorrectly despite our efforts to store only correct and up-to-date data, we will correct it at your request. After you have given us consent to collect, process, and use your personal data, you can revoke this consent at any time with effect for the future. You can generally revoke consent using the appropriate setting in the app or otherwise through the contact information provided in the app.

Your personal data will be deleted if you revoke your consent for the storage of your data, if your personal data is no longer necessary for the purposes pursued with the storage, or if storage is inadmissible for other legal reasons. Please note that due to technical or organizational reasons, there may be an overlap between your revocation of consent and the use of your data, e.g., in the case of a newsletter already sent. This does not affect data that is necessary for billing and accounting purposes or for which there is a legal obligation to retain documentation.

If you have any questions about data protection or if you wish to exercise your rights to revoke consent or to be informed, correct, delete, or temporarily suspend, please contact us using the contact information provided in the app.

10. Additional Information in accordance with GDPR

1. Legal Bases for Intended Uses of Data

The following uses of data are based on:

1. • performance of a contract in accordance with Article 6(1b) GDPR:
     • Providing the features of the app and the services offered through the app by processing the categories of data listed in item 1.a.
     • Transfer of the categories of data from item 1.a. to third-party service providers that may be used in connection with the app (see item 9).
     • Troubleshooting by processing the categories of data listed in item 1.d.
     • Processing content you upload through the mojBSH app, including information necessary for sharing content with third parties.
       
       
   • legitimate interests in accordance with Article 6(1f) GDPR:
     • Improving the user-friendliness of the app by processing the categories of data listed in item 1.d. (Applies to jurisdictions that allow the collection of app usage data based on legitimate interests. In this case, the "Allow Usage Data Tracking" feature is active by default.)
     • Improving our product and service offerings, especially regarding programs that are not used and/or frequently used, in addition to other app and household appliance features by (also algorithmically) processing the categories of data from item 1.d.
       
       
   • your consent in accordance with Article 6(1a) GDPR:
     • for direct marketing purposes by processing the categories of data listed in item 1.a.
     • Improving the user-friendliness of the app by processing the categories of data listed in item 1.d. (Applies to jurisdictions that allow the collection of app usage data only based on consent. In this case, the "Allow Usage Data Tracking" feature is activated only with user consent.)
       
       
2. Your Rights
   
   Your additional rights regarding item 11 are described below. If you wish to exercise your rights, please use the contact information provided at the end of this data protection information.Your right to information about your data: Upon request, we will provide you with information about the data we hold about you.
   
   
   • Right to rectification and completion of data: Right to completion and rectification of data: we will correct inaccurate data about you if you inform us of this. We will complete incomplete data if you appropriately inform us of this, if this data is necessary for the intended purpose of processing your data.
   • Your right to data deletion: Upon request, we will delete the data we hold about you. However, some data will only be deleted considering a specific retention period, for example, because we are legally required to retain it in some cases or because we need it to fulfill our contractual obligations to you.
     See also item 11.
   • Your right to data blocking: In some legally defined cases, we will block your data if you wish. Blocked data is further processed only to a very limited extent.
   • Your right to withdraw consent: Right to withdraw consent for the processing of your data with effect for the future: you can withdraw your given consent for the processing of your data at any time with effect for the future. This does not affect the legality of processing your data up to the point of withdrawal.
     See also item 11.
   • Right to object to the processing of your data: If we process your data based on one of the legal justifications from Article 6(1e) or (1f) of the General Data Protection Regulation, you can object to the processing of your data at any time with effect for the future. In the event of an objection, we will stop processing your data if there are no compelling and legitimate reasons for further processing. Processing your data for direct marketing purposes never constitutes compelling and legitimate reasons for us.
   • Your right to data portability: Upon your request, we can provide you with certain data in a structured, commonly used, and machine-readable format.
   • Your right to lodge a complaint with a regulatory authority: Right to lodge a data protection complaint with a data protection authority. For this purpose, contact the data protection authority responsible for your place of residence or the data protection authority responsible for us (listed below).
     Information Commissioner RS, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
     
     
3. Transfer to Recipients Outside the EEA
   If necessary to provide the features of the app and the services offered by the app, we also transfer personal data to recipients outside the EEA, in so-called third countries. In this case, before exchanging data, we ensure that the recipient maintains an adequate level of data protection (e.g., based on an adequacy decision adopted by the EU Commission for the respective country, or an agreement on EU standard contractual clauses between the European Union and the recipient) or that you have given consent for the said exchange.
   
   We are happy to provide you with an overview of recipients in third countries and a copy of the specific provisions agreed to ensure an adequate level of data protection. If you wish to request this, please use the contact information provided at the end of this data protection information.
   
   For the transfer of personal data using third-party services, see item 9.
   
   
4. Contact Information of the Data Protection Officer
   
   If you have questions regarding data protection or exercising your rights, you can use the following contact information to contact our data protection officer directly:
   
   If you reside in an EU country (except the United Kingdom):
   
   BSH Hišni aparati d.o.o. Nazarje
   Data Protection Officer
   Savinjska cesta 30, 3331 Nazarje
   
   Data-Protection-SI@bshg.com

Issue date: September 2024