OSRAM Mobile App Privacy Policy “Lightify”

Version: 31st of May 2021

This Mobile App Privacy Policy (“Policy”) governs the use of your personal data in connection with the use of the software application Lightify (“Application”) for mobile devices.

By downloading the Application to your mobile device and by using the Application, you agree to this Policy with respect to the collection, processing and use of your personal data by OSRAM GmbH (hereinafter: “we”, “us” or “our”).

1. Name and address of controller

The controller in the meaning of the General Data Protection Regulation, of Member State data protection law and other data protection provisions has been named in the terms of use, under Imprint.

2. Scope of data collection

When you download and install the Application on your mobile device, the Application automatically collects information about the type of your mobile device, the language, the country and the type and version of the mobile device operating system. This information helps us administer the Application, analyse its usage, protect the Application and its content from inappropriate use and improve the user experience.

Registration with us might be mandatory in order to be able to use the Application. Upon registration, you will be asked to provide your email address, username and password.

When you use the Application, the following information will be collected and stored:

• the IP address, channel and name of your home network
• version, status, configuration and mac address of the Zigbee devices (lamps, luminaires, plugs, sensors, switches and gateways) you use
• the scenes and groups that you have created
• your preferences (e.g. light curves, time zone)

The following (optional) permissions are required to use all functions of the “Lightify” Application:

• W-LAN: an internet connection is required to use the Application
• Notifications (optional): to receive notifications in connection with the Application services, e.g. information about updates or new functions of the Application
• Camera access (optional): to scan the QR code during installation of a “Lightify” gateway
• Camera/photographs (optional): to use the Colour Picker function. With Colour Picker you can choose colours from photographs in order to light up your lamps in the same colour. No photographs are stored or collected when using Colour Picker
• Microphone (optional): to enable voice control of the Application via Ok Google (currently only available for Android devices)
• Location (optional): to enable the sunrise & sunset function of the Application. Your location data will always be stored anonymised with only one decimal. This allows your location to be determined with an accuracy of ~11km

In the event of deactivation of the Lightify cloud servers, collected information as referenced above shall only be stored locally.

3. Legal basis for data processing

We collect and use your personal data in order to provide our contents and services in accordance with the requirements under Art. 6(1) a to f of the GDPR, provided that the GDPR or any other legal regulation permits this, or the user consented to such processing.

4. Purpose of data processing

We use your personal data to provide, maintain and improve our Application services, to communicate with you, and, if you have consented to such use, for marketing purposes.

In particular, we use your personal data for the following purposes:

• To provide, maintain and improve the Application and our services to you
• To inform you about new versions or features of the Application
• To respond to your questions and requests, including your customer service inquiries
• To send you promotional emails about products, services, offers, promotions rewards and events offered by us, our affiliates, or our business partners, provided that you gave your consent to receive such email marketing from us
• To monitor and analyse trends, usage and activities in connection with the Application
• To send you notifications or emails related to your use of the Application and the service in general (e.g. technical notices, updates, security alerts and support and administrative messages)

5. Onward transfer of data to third parties

We will share personal data only in accordance with applicable law. We will not sell or otherwise share your personal data with third parties for their own marketing purposes without your consent.

We may share your personal data with service providers that we use to provide the Application services, e.g. for the hosting of the Application. The respective service provider may only use the data only for providing the services and in accordance with contractual agreements regarding the confidentiality of the data.

We will share your personal data with law enforcement, government representatives or others where required by law. We reserve the right to use your personal data if we believe it is necessary to protect the rights, property, safety of us or to comply with a judicial proceeding, court order, or legal process, or as evidence in litigation in which we are involved.

We may share aggregated data with our business partners and customers. This data cannot be used to identify you.

6. Tracking

This Application uses technology of Google Analytics for Firebase ( https://firebase.google.com) to collect, process and store data for marketing and optimization purposes. This data can be used to create a user profile under a pseudonym. Unless you provide us with your consent, the collected data will not be used to identify you, and it will not be combined with your personal data. You can opt-out of the data collection, processing and storage at any time with effect for the future by unticking the respective checkbox in the settings of the Application.

7. Storage period

We will retain your personal data on our systems for as long as you use the Application and for as long as it is necessary to provide you with the service featured by the Application.

If you de-install the Application from your mobile device, all data stored within the Application will be deleted. If you would like to delete your account, please send an email to lightify@osram.com or contact us via the address as displayed below in the “Contact us” section.

8. Data Security

We have implemented reasonable and adequate technical and organizational safeguards to protect your personal data from accidental loss and from unauthorized access, use, or disclosure.

9. Data Storage

Please note that we store and process your personal data in systems located within Switzerland, as well as the United States of America. We have taken appropriate steps to ensure that your personal data is adequately protected, consistent with the privacy principles set forth under this Policy.

10. Children

We do not knowingly solicit data from or market to children under the age of 18. Any parent or guardian who becomes aware that their child has provided us with information without their consent should contact us at privacy@osram.com. We will delete such information from our files within a reasonable time after confirmation.

11. Changes to this Policy

WE MAY MODIFY THIS POLICY FROM TIME TO TIME. WHEN WE DO, WE WILL POST THOSE MODIFICATIONS HERE. THE MODIFIED POLICY WILL BE DISPLAYED UPON THE NEXT START OF THE APPLICATION. YOUR CONTINUED USE OF THE APPLICATION AFTER ANY SUCH MODIFICATION MEANS THAT YOU ACCEPT THE MODIFIED POLICY.

12. Your rights

If your personal data are processed, you become a data subject in the meaning of the GDPR. The controller is obliged to extend the following

• rights to you:
• right of access
• right to erasure
• right to rectification
• right to object

To exercise the rights, please contact us at the address stated under Contact.

If you have given us your consent for e-mail marketing, you may unsubscribe any time from our e-mail marketing list by deactivating the checkmark in your profile in the app, or by sending an e-mail to lightify@osram.com.

13. Contact us

You can contact us at any time by email under privacy@osram.com or by mail under:

OSRAM GmbH
CDPO
Marcel-Breuer-Str. 6
80807 Munich

Germany

14. Right to lodge a complaint with a supervisory authority

Without prejudice to any further administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement if it is your opinion that the processing of personal data relating to you infringes the GDPR.