Legal notice for the Home Connect app

Here you can find the legal notice for the provider, the Terms of Use and the Data Privacy Policy for the Home Connect app.

The company Home Connect GmbH, with its registered office at Carl-Wery-Strasse 34, 81739 Munich, Germany (hereinafter "Home Connect" or "we") is responsible for the collection, processing and use of your personal data associated with the Home Connect app (hereinafter "App").

We collect, process and use your personal data, which is either entered by you or otherwise created and processed in the course of using the App, the associated household appliances or services offered by Home Connect in accordance with the applicable data privacy laws. The following information explains how we treat such data based on the Terms of Use or on another legal basis.

1. Types of personal data

In terms of App usage, the associated household appliances or services and functions offered by Home Connect (hereinafter "Services") Home Connect collects, processes and uses the following categories of personal data.

If we are unable to collect all of the personal information listed below, we may not be able to provide our services in connection with the App in whole or part, or you may not have access to the full functionality of the App. Some of these impacts are described further in section 4 below.

a. User master data and usage data

Below we describe how we collect and use personal data when setting up a user account (registration) as well as when setting up the App. This data is stored into your account, which is personal and non-transferable.

• When registering with the SingleKey ID:

• • – Access data, i.e. identification data that serves to control access to the SingleKey ID user account and consists of the user ID (e.g. email address or mobile phone number of the user).
  • – Responsible for providing this registration service is Bosch.IO GmbH, Bosch.IO GmbH, Ullsteinstrasse 128, 12109 Berlin, Germany ("BIO").

• Additional details that you provide during the registration process including the setting up of the app or registration of a central BSH user account, (as long as they are not transmitted via the SingleKey ID), such as:

• • – first and last name,
  • – email address (will also be used as the user ID),
  • – the country in which you operate your household appliance(s),
  • – password as access protection for the App/the central BSH user account.

The details requested as part of the registration process may differ from country to country and are managed (if available) via a central BSH user account, which can also be used as Home Connect account.

• Information which we collect and store during the registration process and while using the App:

• • – language setting of your mobile device,
  • – system settings related to the app (e.g. permission to send in-app messages),
  • – consent to and recognition of the terms of use,
  • – acknowledgement of the data protection information,
  • – marketing consent and its scope,
  • – status of the user account (activated/deactivated),
  • – default app tracking setting (depending on the selection of country, see item 6 below for more information),
  • – service history (e.g. service technician assignment) of the connected household appliances as well as related orders of the user (e.g. consumables),
  • – "Detergent Scan": if this service is available for your device and you use it, we store the respective water hardness and the detergent used by you stored in the app, a "detergent history" is created in the app (and this history can be deleted by you at any time),
  • – the approximate device location derived from the zip code or shortened IP address (e.g., at the municipality level) to improve the user experience, e.g., by helping to set location-based device settings (such as water hardness in your region or local time zone).

• The content you upload to the Home Connect app (including, but not limited to, recipes, recipe images, including their labels), including the information required for you to share the content with third parties (e.g., your name as the creator of the recipe). If you, as a user, wish to share your own recipes with others, you must create a separate cooking profile for that purpose and choose a name and avatar for the profile, which will then be displayed with your shared recipe. The name and avatar do not have to relate to you as a person, so it can also be an alias.

b. Appliance master data

The data we collect and use concerning the connection between your household appliance and the user account are as follows:

• – brand of the household appliance (e.g. Bosch or Siemens),
• – serial number and, if applicable, manufacture date of the appliance (so-called E number (full model) and FD (production) number – you can also find these details on the device label),
• – the unique identifier of the network adapter installed in the household appliance (so-called MAC address),
• – additional programs (if you have purchased additional programs for your home appliance that were provided via the Home Connect app, these additional programs are linked to the home appliance and not to the user account and therefore remain in the home appliance, but not in your user account if you sell or otherwise transfer the home appliance. Additional programs are generally not transferable to other home appliances).

These data are allocated to your user account for each connected household appliance under the "Home Connect" function.

c. Appliance usage data

The data we collect and use in relation to the usage of the household appliance are as follows:

• selected basic settings, program selection and preferred program settings on the household appliance or via the App,
• appliance status data such as ambient conditions, condition of parts, changes of appliance status (e.g. different mode of operation, open or closed doors/front panel, temperature changes, fill levels) and appliance status messages (e.g. appliance is overheated, water tank is empty, etc.) as well as error messages (including the respective error report of the affected household appliance).
• individual settings/contents of the household appliance including free-text fields (e.g. internal digital map for vacuum cleaner robots, beverage name for coffee machines, downloaded or self-designed recipes)
• video and image data (e.g. vacuum cleaner robots, stoves and ovens as well as refrigerators with built-in cameras) used for various functions of the respective home appliance, such as imaging the contents of the refrigerator (Camera in the Fridge) or detecting the degree of browning (Camera in the Oven).

If you allow another user (regardless of whether via their own account or via your account) to use home appliances via the app, the appliance usage data created by the additional user will also be stored.

d. App related usage data

App related usage data are data generated by your interaction within the App, such as the features you use, click behaviour relevant to App controls, drop-down menu selections, on/off switch settings and error reports of the app as well as interactions of your app with third-party applications (e.g. web pages that you open from within the app). See item 6 for more information.

2. Purpose of use

We use the above-mentioned category of data

• to provide App features as well as the services offered via the App as well as providing updates for your device (1.a.-c.),
• for notification purposes in case of safety instructions and/or recall information in the context of product monitoring (1.a. to c.),
• for proactive maintenance purposes, including the provision of related in-app/email messages (e.g. recommendations on the use of settings and/or maintenance programs or anomalies that indicate a major malfunction of the home appliance in the near future, which may be avoided by taking appropriate precautionary measures, e.g. if vibrations in the home appliance indicate an imbalance that can damage the appliance) and reactive troubleshooting (e.g. in the context of remote diagnosis, during on-site repair or at the repair centre) of the connected household appliances (1.a. to c.),
• to improve the App's user friendliness (including the interaction of app and home appliance) and for specific or general troubleshooting of the App and the digital services offered through it (1. c. and d.),
• to improve our range of products and services (including those of affiliated companies), especially with regard to the usage of the home appliances (e.g. programs which are not used and/or which are frequently used), as well as other features of the App and household appliance (including algorithmic learning e.g. to improve the detection of the level of contents stored in refrigerators or the degree of browning in the oven) (1.c. and d.),
• for billing purposes, insofar the household appliances are connected to the App or the services offered in the App provide for usage-based billing (1.a. to c.), and
• for marketing and market research purposes including in-app/email messages (1.a. to c.) as far as a corresponding consent is given;
• Name, contact details and device master data (including customer service transaction data) are kept in a separate "Safety Action" database, e.g. to perform product recalls;
• in anonymized form for statistics on the use of connected home devices for use by HomeConnect and its affiliates for internal purposes and in the context of general communications, including social media (1.c anonymized).

The legal bases for the purposes of processing within the scope of the GDPR (REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016) are described in item 12 of this information.

Regarding other data transfers within the Bosch Group associated with the central SingleKey ID, we refer to the BIO data protection information at https://singlekey-id.com/en/data-protection-notice/.

3. General retention periods

Provided there are no statutory provisions to the contrary, the following general retention periods shall apply:

• a. SingleKey ID: Deletion with deletion of the SingleKey ID user account.
• b. User master data: Deletion as soon as the local user account or the central BSH account is deleted.
• c. Appliance master data: Removal of link to the user account upon removing the household appliance from the user account.
• d. Appliance usage data: User-specific storage for a period of thirty (30) days. Afterwards storage in pseudonymized form (in a special database using a pseudonymisation algorithm) and provision in personalized form for services and/or repair services provided via the App or by on-site / repair service (e.g. proactive or reactive maintenance/troubleshooting, if available) for the duration of the validity of the contract or (if the function can be disabled) for the duration of the activation of the function. Furthermore, in pseudonymized form based on our legitimate interest, as long as our legitimate interest prevails, afterwards, in anonymized form. Insofar as you have shared content with third parties, this is not deleted, but remains on the end devices of the third parties with whom you have shared the content.
• e. App related usage data: Storage in pseudonymised form and provision in personalized form for services/messages provided via the App to the extent that the "Enable usage-data tracking" function is activated. Deactivating the function resets the individual ID used for tracking, so that App usage data already collected can no longer be connected to you.
• f. Name, contact details and device master data (including customer service transaction data): Stored in personal form for a period of 30 years in a separate "Safety Action" database, held there solely for these purposes, e.g., to conduct product recalls.

If you sell the home appliance, please note that you must reset your home appliance to its factory settings before deleting the SingleKey ID or the app. If you have allowed the use of a home appliance together with another app user who does not use his own account, the deletion of your account also triggers the deletion of the other user. If you have allowed the use of a home device together with another app user who uses his own account, please note that the deletion of your account does not trigger the deletion of the additional user at the same time. If you do not want the other user to be able to continue using the home appliance via the app, please also arrange for the deletion of the other user. If such deletion does not take place, the previously collected device master data and device usage data will remain available for the additional user.

4. Data processing management

a. Connectivity of your household appliance

You can use the App to manage the connectivity of your household appliance:

• If required and if your household appliance provides for this function, you can set up the connection to the Home Connect server in such a way that each household appliance is connected separately (menu item Appliances → Settings). After doing this:

• • – the appliance usage data (1.c.) will no longer be transmitted to the Home Connect server; if your home appliance is equipped with buffer memory, the appliance usage data will be transmitted to the Home Connect Server in the event that the Wi-Fi connection of your household appliance to the Home Connect Server is restored;
  • – certain App features will no longer be available; in particular the household appliance can then not be operated, even if an internet data link is set up.

• If required, you can switch off the Wi-Fi connection for an individual household appliance (menu item Appliances → Settings). After doing this:

• • – the appliance usage data (1.c.) will no longer be transmitted to the Home Connect server; if your household appliance is equipped with a buffer memory, the appliance usage data will be transmitted to the Home Connect Server, in the event that the Wi-Fi connection of your household appliance is restored.
  • – the household appliance may only be operated from the appliance itself, not via the App.

b. User accounts and local App data

You can manage your user accounts via the App and delete locally stored App data.

• You can delete your user account ("Profile" → "Personal Data" → "Delete account"). After doing this:

• • – the connection between your household appliance and your user account will be deleted,
  • – your household appliance will no longer send any appliance usage data to the Home Connect server provided no other user accounts are linked to the household appliance (see item 1.a. above).

• By deleting the App or using the “Full reset”-function, all locally stored user-related data will be removed, but not the accounts which were created separately.
• If you use the SingleKey ID, the SingleKey ID account will be deleted via the SingleKey ID functions, whereby in addition to the SingleKey ID itself, individual linked applications can also be deleted. If the SingleKey ID is the only access mechanism to the app/to the central BSH user account, the deletion of the SingleKey ID may make access to the linked services impossible. Therefore, before deleting the SingleKey ID, please check if you still have linked applications/user accounts.
• To delete the central BSH user account, please use the function provided in the account.
• Some features of the App do not store user-related data locally. You can have such data deleted by reaching out to the Home Connect Service Hotline or (possibly at a later date) by using the corresponding function in the App.
• The content you uploaded to the Home Connect app (in particular recipes, recipe images). If you have shared content with third parties, this content will remain on the third party's device even if you delete the data locally.

c. The household appliance's factory settings

You can reset your household appliance to its factory settings. After doing this:

• the household appliance will lose its connection to the Home Connect server due to the network settings being reset,
• the household appliance will no longer be linked to any previously associated user account (requires the household appliance to be connected to the Internet) and it will not be displayed in the App
• and all contents stored on the household appliance will be deleted.

Please read your household appliance's user manual before restoring the factory settings.

5. Transmission or disclosure of your data e.g. to third parties

We work together with various service providers to create and run the App and provide the respective services. To the extent that we have bound these service providers to process data in line with strict instructions in their capacity as data processors on our behalf, any data processing activities undertaken by such providers shall not require your consent.

The service providers we have commissioned to create and run the App:

• Service providers for hosting services
• Service providers for programming services
• Service providers for hotline services (also if performed via a chat-function or similar communication channels) and other App services

We only transmit your data to other recipients where necessary to fulfil a contract with you or between you and the third party, where we or the recipient has a legitimate interest in the disclosure of your data, or where you have given your consent to that transmission. These recipients include service providers and other companies within our corporate group globally, including our head office in Germany and others principally located in Australia, Singapore, India, China, United States of America and European Economic Area countries. Furthermore, data may be transmitted to other recipients in the event that we are obliged to do so due to legal provisions or enforceable administrative or court orders.

Other recipients of your data are especially such service providers whose offers and services (third-party services) can be used in connection with the App or where the App enables access to such services (see item 9).

Content, especially recipes, which you have created yourself, may also be transmitted to other BSH companies (also internationally) within the scope of technical processing and provision of the content/services. We base such transmission/processing on data protection agreements between the BSH companies involved, which also include the application of standard contractual clauses, insofar as the transmission includes a country outside the scope of the GDPR and if it’s not a case of Art. 45 GDPR.

6. Recording of App usage

Data on App related usage can be recorded by the App (see item 1.d. above) where, depending on your country of residence and operating system, your consent is obtained accordingly or you have the option to change consent once it has been activated, as described below. For the recording of App related usage data, the following Analytics services are used, which is offered by

• Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland (hereinafter "Adobe")
• Thunderhead Analytics by Thunderhead Ltd., 5th Floor, Ingeni Building, 17 Broadwick Street, Soho, London W1F 0DJ (hereinafter “Thunderhead”)..

If the "Enable usage-data tracking" function is activated, App related usage data will be sent to and stored on servers of providers located in the European Union. The App related usage data enable you to analyse how you use the App and provide messages (inApp or email) to you for services provided via the App (see item 1.d. above). IP anonymisation is activated for this App, which means that the IP address you use is truncated before being sent to the server. The analytics providers will use this information on behalf of Home Connect to evaluate how you use the App, generate error reports and to prepare reports on App activity for Home Connect. This serves as a basis for us to improve the app itself, to better understand and improve app usage and the connection of home devices, but also to provide contextual content in the app and on websites you use. In order to provide contextual content, we build typical usage profiles (so-called "audiences") that enable us to provide such content in a way that is appropriate for you.

IP addresses transmitted from your mobile device and other personal data within the context of the aforementioned analytics activities will not be merged with other data held by analytics providers or Home Connect without your consent given separately.

You can control whether or not App related usage data (incl. your IP address) is recorded and processed by one of the abovementioned providers by activating or deactivating this in the personal settings within the app or in the corresponding system menu of your mobile device. Depending on the legal situation in your country, the analytics and/or tracking function may be activated by default, but you may change these settings to your personal preferences.

In addition, error reports from the app can be sent to us so that we can take concrete measures to eliminate such errors. These fault reports are used on a personalized basis to analyze and correct the error in the event of a specific error report from you. Without direct personal reference, error reports are used to eliminate errors in general for all users of the app and to avoid future errors as far as possible.

If covered by a separately declared consent (e.g. a marketing consent given by you via the website), we may also use the app-related usage data within the scope of this consent to personalize the corresponding (marketing) communication to you and your interests. In the context of such consent, we also inform you in each case about such possible use.

7. Error reports

We use tools (e.g. Visual Studio App Center https://appcenter.ms) to collect and send anonymous error reports if the App performs as intended and/or behaves in an unexpected way, especially if the App crashes. Our service providers and Home Connect shall receive error reports only with your explicit consent. We shall ask for your consent each time we wish to transmit such information.

8. Data security

We deploy technical and organisational measures to protect your data, for example, from manipulation, loss and unauthorised third-party access. These measures include the use of encoding technologies, certificates, firewalls on the Home Connect servers and password protection in the Home Connect App. The data security level of the Home Connect App has been tested and certified by TÜV Trust IT. We are constantly reviewing and improving our security measures in accordance with technological advancement.

9. Scope of application of the data protection information

This data protection information shall apply for the functions and services offered by Home Connect via the App. Insofar as additional functions or services are offered within the App by Home Connect or a BSH Group company, special information on data protection is provided, insofar as their use is subject to special data protection regulations or information.

However this data protection information shall not apply for third-party services, even if Home Connect facilitates the use of and/or access to such third-party services in the App (please also see the terms of use with regard to third-party services). The use of such third-party services is governed by the prevailing data protection provisions put in place by the third-party service provider and, if applicable, additional data protection information on our part which outline the distinctive features of these third-party services and shall only be relevant in this regard.

If you are referred to another service provider, Home Connect shall make reasonable and appropriate efforts to elucidate such referral (e.g. by embedding the service provider's content within the App using inline frames) if such referral is not clear. If you click on a link in the Home Connect App which calls up an app or website of another service provider, this is considered to be a clear referral.

If you, the user, are located within the scope of application of the GDPR, please note that the use of third-party services may result in your personal data being processed in countries outside the scope of application of the General Data Protection Regulation. Please then refer to the data protection information of the respective third-party service providers.

10. Changes to the data protection information

As the App and the services provided via the App continues to undergo development – among other things, through the implementation of new technologies or the introduction of new services – this data protection information may need to be adjusted accordingly. Home Connect shall reserve the right to amend or supplement this information as required. Home Connect will always update the data protection information in the App; you can therefore familiarise yourself with the latest version at any time.

11. Rights and contact information

If, despite our efforts to only store data which is correct and up-to-date, your personal details are stored incorrectly, we shall correct such information upon your request. After giving us your consent for the collection, processing and use of your personal data, you may withdraw such consent at any time with effect for the future. Consent may generally be withdrawn using the respective App setting or otherwise through the contact information referred to in the App.

Your personal data will be deleted if you withdraw your consent to your data being stored, if your personal data is no longer needed to serve the purpose pursued by such storage or if such storage is inadmissible for other legal reasons. Please bear in mind that, for technical or organisational reasons, there may be an overlap between you withdrawing your consent and your data being used, e.g. in the case of a newsletter which has already been sent out. Data required for billing and accountancy purposes or which are subject to the legal duty to preserve records are not affected by this.

Should you have any questions on the topic of data protection or should you wish to exercise your rights to withdraw consent or to information, rectification, deletion or suspension, please contact us using the contact information provided in the App.

12. Additional information pursuant to the GDPR

a. Legal bases for intended data uses

We base the following data uses on

• the performance of a contract according article 6(1b) GDPR:

• • –Provision of App features as well as the services offered via the App by processing the data categories listed in the items 1.a.-c.
  • – Transfer of data categories listed in the items 1.a.-c. to service providers of third-party services which can be used in connection with the App (see item 9).
  • – Bug fixing by processing the data categories listed in the items 1.b.-d.
  • – Processing of the content uploaded by you through the Home Connect App, including the information required for the sharing of the content by you with third parties.

• legitimate interests according article 6(1f) GDPR:

• • – The improvement of App's user friendliness by processing the data categories listed in the item 1.d. (Applies to jurisdictions that allow the collection of App usage data based on legitimate interests. In this case, the "Allow tracking of user data" function is active in the default setting.)
  • – The Improvement of our range of products and services, especially with regard to programs that are not used and/or that are frequently used, besides other App and household appliance features by (also algorithmic) processing the data categories listed in the items 1.c. and d

.

• your consent according article 6(1a) GDPR:

• • – Direct marketing purposes by processing the data categories listed in the items 1.a.-c.
  • – Improving the user friendliness of the App by processing the data categories listed in the item 1.d. (Applies to jurisdictions that only allow the collection of App usage data based on consent. In this case, the "Allow tracking of user data" function is only activated with the user's consent.)

• a legal permission according to Art. 6 para. 1 lit. c and d GDPR:

• • – Storage of data categories 1.a. and c in the "Safety Action" database.
  • – Notification in case of safety instructions and/or recall information in the context of product monitoring by processing data categories 1.a.-c.

b. Your rights

Your additional rights to item 11 are outlined below. To exercise your rights, please use the contact information provided at the end of this data protection information.

• Your right to information about your data: We will provide you with information about the data we hold about you on request.
• Your right to correct and complete your data: We will correct inaccurate information about you if you notify us accordingly. We will complete incomplete data if you notify us accordingly, provided this data is necessary for the intended purpose of processing your data.
• Your right to delete your data: We will delete the information we hold about you on request. However, some data will only be deleted subject to a defined period of retention, for example because we are required to retain the data by law in some cases, or because we require the data to fulfil our contractual obligations to you.
  
  Please see also item 11.
• Your right to have your data blocked: In certain legally determined cases, we will block your data if you would like us to do so. Blocked data is only further processed to a very limited extent.
• Your right to withdraw consent: You can withdraw consent given for your data to be processed with effect for the future at any time. The legality of processing your data remains unaffected by this up to the point at which your consent is withdrawn.
  
  Please see also item 11.
• Your right to object to the processing of your data: You can object to the processing of your data with effect for the future at any time, if we are processing your data on the basis of one of the legal justifications set out in article 6(1e or 1f) GDPR. In the event that you object we will cease processing your data, provided that there are no compelling and legitimate grounds for further processing. The processing of your data for the purposes of direct marketing never constitutes compelling and legitimate grounds for us.
• Your right to data portability: At your request, we can make certain information available to you in a structured, commonly used and machine-readable format.
• Your right to appeal to a regulatory authority: You can lodge an appeal pertaining to data protection with a data protection authority. To do so, contact the data protection authority responsible for your place of residence or the data protection authority under whose jurisdiction we fall (named below).

Bavarian Data Protection Authority (BayLDA), www.baylda.de.

c. Transmission to recipients outside the EEA

If necessary, for the provision of App features as well as the services offered via the App, we also transmit personal data to recipients based outside of the EEA, in so-called third countries. In this case, we ensure ‒ before any data is shared ‒ that either an appropriate level of data protection is maintained by the recipient (e.g. on the basis of an adequacy decision made by the EU Commission for the respective country or the agreement of standard EU contractual clauses between the European Union and the recipient) or that you have given your consent to said sharing.

We are happy to provide you with an overview of the recipients in third countries and a copy of the specific provisions agreed to ensure an appropriate level of data protection. To request this, please use the contact information provided at the end of this data protection information.

Please see item 9 for transmission of personal data by usage of third-party services.

d. Contact details of the data protection officer

If you have any questions relating to data protection or exercising your rights, you can use the following contact information to get in touch with our data protection officer directly:

BSH Hausgeräte GmbH

Data Protection Officer

Carl-Wery-Str. 34

81739 Munich, Germany

Data-Protection-de@bshg.com

13. Additional information for customers in New Zealand

Our privacy policy, which is available at https://www.bosch-home.co.nz/metapages/privacy or by emailing privacy.nz@bshg.com, includes our New Zealand contact details, explains more about how you can seek access to, and correction of, your personal information, how to make a privacy complaint and how we deal with these complaints.

Home Connect GmbH, with its registered office at Carl-Wery-Straße 34, 81739 Munich, Germany (hereinafter referred to as "Home Connect" or "We"), is the controller responsible for the collection, processing and use of your personal data in connection with the Home Connect App (hereinafter referred to as "App"). In addition, Home Connect provides you with the synchronized user account of the Home Connect Family (hereinafter referred to as the "Synced Home Appliance Account") free of charge for your personal use for the digital service(s) provided via the Synced Home Appliance Account.

We collect, process and use personal data that is either entered by you or otherwise generated and processed in connection with the registration of the Synced Home Appliance Account, the use of the App, the associated home appliances or services offered by Home Connect, in accordance with the applicable data protection laws and inform you below about the data processing carried out by us on the basis of the existing user agreement with you or another legal basis.

There are various laws governing data protection depending on the country in which you are located. In our case, the European General Data Protection Regulation ("GDPR") sets out the basic principles for how We process and protect your personal data when providing our websites and services. We process your personal data in accordance with the following principles:

a. Lawfulness

We only use personal data if such use is lawful, which is only the case if and to the extent that at least one of the following elements applies:

• You have given your consent.
• The use of personal data is necessary for the performance of a contract to which you are party.
• The use of personal data is necessary to comply with a legal obligation, e.g. in cases of product safety measures where We are obliged to inform all our customers.
• The use of personal data is necessary to protect the vital interests of the data subject.
• The use of personal data is based on a legitimate interest in the use of personal data, and our use does not adversely affect your data protection rights.

For all personal data processing operations described here, We will also indicate the legal basis on which the processing is based.

b. Fairness and transparency

• We will inform you in a fair and transparent manner about the personal data We collect and the reason for collecting it. This information is included in the Data Protection Information We provide to you directly or via a link when you register and/or at every touchpoint where you interact with us.
• Users under the age of 16 should only provide us with personal data with the consent of their parents or legal representative. The data protection law applicable in your country may result in different age limits in this regard.

c. Purpose limitation and data minimization, deletion

• We only use personal data that We really need and only for the purpose for which you have provided us with the personal data. If We can achieve the purpose with less personal data, We will only use the minimum data required. Nevertheless, you are free to provide additional personal data at any time if this would improve your experience with the services provided.
• We have taken organizational and technical security measures to protect all our websites and apps against the potential risks associated with the processing of personal data. Our affiliated companies and external partners who assist us in providing the services must also comply with these provisions.
• We will delete your personal data (including automatically) when the data is no longer needed, the statutory retention period has expired, or you send us a notification to have the personal data deleted in whole or in part.

1. Categories of personal data

In connection with the registration of the Synced Home Appliance Account, the use of the App and the associated home appliances or services and functions offered by Home Connect (hereinafter referred to as "Services"), Home Connect collects, processes and uses the following categories of personal data:

a. User master data and usage data

Below, We describe the data We collect and use in connection with creating a user account, registering and setting up the App. This data is stored in your account, which is personal and non-transferable.

• When registering via SingleKey ID:
  - Access data, i.e. identification data used to control access to the SingleKey ID user account, consisting of the user ID (e.g. the user's email address or mobile phone number). Robert Bosch GmbH, Robert-Bosch-Platz 1, 70839 Gerlingen-Schillerhöhe, Germany ("RB") is responsible for providing this registration service.

• Further information that you provide when setting up the App or the Synced Home Appliance Account, insofar as this is not transmitted via SingleKey ID, such as:
  – First and last name
  – Title
  – Email address (also used as user ID)
  – The country in which you operate your home appliance(s)
  – Language setting
  – Password as access protection for the App/Synced Home Appliance Account
  – Information within existing My Accounts (e.g. your master data, existing orders or service requests), if you migrate this information to the Synced Home Appliance Account.

The information requested during registration may vary from country to country and is managed (where available) via the Synced Home Appliance Account, which can also be used as a Home Connect Account.

Note: If the operator in the country where you register only offers the Home Connect Account and not Synced Home Appliance Accounts, you can only use the Home Connect Account and not the Synced Home Appliance Account. The Synced Home Appliance Account can only be used with websites and/or apps or other touchpoints for which the Synced Home Appliance Account has been activated. The Synced Home Appliance Account does not work with other touchpoints, even if the SingleKey ID would work on such touchpoints (e.g. on a website).

• Information We collect and store in connection with the registration and ongoing use of the App and the Synced Home Appliance Account:
  – Language setting of your mobile device
  – System settings related to the App (e.g. permission to send in-App messages)
  – Agreement to the terms of use
  – Confirmation/acknowledgement of the information on data protection
  – Marketing consent(s) and their scope
  – Status of the user account (activated/deactivated)
  – Status as main user or additional user (see section 5 of the General Terms and Conditions)
  – App tracking default setting (depends on country selection, see6 below)
  – Additional user master data, if and to the extent that this is provided via the Home Connect Family touchpoints (e.g. delivery address, telephone number)
  – Contract data, if and to the extent that this is provided via the Home Connect Family touchpoints (e.g. order number(s), date of purchase, warranty extensions)
  – Service history (e.g. service orders, service technician visits) of the connected or registered home appliances and associated orders placed by the user (e.g. consumables)
  – "Detergent” or “dish-care-detergent” scan: if such a service is available for your home appliance and you use it, We store the respective water hardness and the detergent or dish-care-detergent (brand and type e.g. tabs) you use, as stored by you in the App, whereby a "detergent history" is created in the App (you can delete this history at any time);
  – The approximate location of the appliance (e.g. at municipal level) derived from the postcode or abbreviated IP address to improve the user experience, e.g. by helping with location-based appliance settings (such as water hardness in your region or local time zone).

• The content you upload to the Home Connect App (in particular: recipes, recipe images, including their names), as well as the information required for you to share the content with third parties (e.g. your name as the creator of the recipe). If you, as a user, would like to share your own recipes with others, you must create a separate cooking profile and choose a name and avatar for the profile, which will then be displayed with your shared recipe. The name and avatar do not have to be related to you as a person, so they can also be pseudonyms.

b. Appliance master data

Data that We collect and use in connection with the registration/pairing of your home appliance with your user account includes:

– Brand of the home appliance (e.g. Bosch or Siemens)

– Serial number and, if applicable, date of manufacture of the home appliance (known as the E number and FD number; this information can also be found on the type-label of the home appliance)

– The unique identifier of the network adapter used in the home appliance (known as the MAC address).

– Specific (service) features for home appliances for which you have registered or which you have selected (e.g. proactive maintenance).

– Data that you provide during the purchase/registration of your home appliance.

– Pairing status of a home appliance with Home Connect Connectivity.

– Additional programs (if you have purchased additional programs for your home appliance that were provided via the Home Connect App, these additional programs are linked to the home appliance and not to the user account and therefore remain in the home appliance, but not in your user account if you sell or pass on the home appliance. Additional programs are generally not transferable to other home appliances).

This data is assigned to your user account for each connected home appliance as part of the "connect home appliance" (i.e. pairing) function.

c. Appliance usage data

Data that We collect and use in connection with the use of the home appliance includes:

• Pairing status (as a pairing log) including the corresponding parameters in the App (e.g. OS version), the connection status (e.g. Wi-Fi quality) and the pairing status of the home appliance;
• Basic settings, program selection and program settings made on the home appliance or via the App;
• Individual settings/content on the home appliance, in particular in free text fields (e.g. internal digital map for robot vacuum cleaners, drink name for coffee machines, downloaded or self-created recipes).
• Appliance status data such as environmental conditions, component statuses, status changes on the home appliance (e.g. change of operating mode, opening or closing of the door/front panel, temperature changes, fill levels) and status messages from the home appliance (e.g. appliance is overheated, water tank is empty, etc.) as well as error messages (including the respective error report of the affected home appliance).
• Appliance usage data, including program selection and program progress (individual usage statistics) as a basis for, e.g., statistics on actual or calculated energy consumption or similar displays for optimizing appliance usage by the user and in-App notifications based on this (if activated by you).
• Video and image data (e.g. for robot vacuum cleaners, cookers and ovens, and refrigerators with camera functionality) used for various functions of the respective home appliance, such as displaying the contents of the refrigerator (camera in the fridge) or detecting the degree of browning (camera in the oven). Image data is created and transmitted in the home appliance both in relation to actions (e.g. opening the refrigerator door, starting a baking program) and by the home appliance itself to document the appliance status (e.g. for appliance maintenance such as lens contamination in the oven).
• Comments and feedback on appliance-related functions (e.g. recipes).

If you allow another user (regardless of whether via their own account or via your account) to use home appliances via the App, the appliance usage data generated by the other user will also be stored. You can object to the use of appliance usage data that is not directly used to control the respective home appliance at any time in the App; in this case, however, the information/notifications based on this data will no longer be provided. Information on appliance control is processed regardless of any objection and notifications are provided in the App on this basis (provided you have activated in-App notifications), as this information is used for direct appliance control, which cannot otherwise be provided.

d. App-related usage data

App-related usage data is data from your interaction within the App, such as App features used, click behavior in relation to App controls, selections in drop-down menus, settings of on/off switches, information from A/B and multivariate tests (i.e. tests of how different versions of our App are accepted by the respective user in order to improve user-friendliness) and App malfunction reports, as well as interactions between your App and third-party applications (e.g. websites that you open from within the App). See also section 6 below.

e. Data on HomeConnect Family Touchpoints

The data We collect and use in connection with your use of Home Connect Family Touchpoints is as follows:

• Personal information and other content that you provide via contact forms or during a service call,
• Information about gift/cashback/warranty processes and similar product-related information,
• customer satisfaction data when you participate in a survey,
• website-related information, e.g. information about your shopping basket (if you have accepted the specific cookies on the relevant website), content you have provided via web forms or similar interactions with our website(s),
• Anonymized data provided by you via Home Connect Family touchpoints for statistical use.

f. Permissions and permission-related data

The data We collect and use in connection with the permissions you have granted to us and/or a Home Connect Family unit is as follows, whereby your profile information will not be used for marketing purposes without your permission:

• Data relating to a (separate) marketing authorization granted by you (e.g. identifier for the marketing authorization, usually your e-mail address, timestamp and touchpoint of your granted permission, scope of your permission),
• If you revoke your marketing authorization, We will store the data necessary to process and verify the execution of your revocation by the relevant Home Connect Family company (e.g. identifier, timestamp and touchpoint of your revocation),
• Settings for Home Connect Family brands and communication preferences specified in your preference center,
• Aggregation of your interactions with Home Connect Family touchpoints to better understand your interests (within the scope of a marketing authorization granted),
• (Personal) data provided via marketing tools that you have consented to send data,
• To the extent permitted by a separately collected, specific permission, We may also combine the information you provide with other online or offline collected data and use or share it for the (marketing) purposes described herein.

2. Purposes of use

We use these data categories,

• to provide the functionalities and information of the Synced Home Appliance Account (or the Home Connect Account if the Synced Home Appliance Account is not available in your country) and the data from the connected Home Connect Family Touchpoints (1.a.- d, e - f.),
• to provide the functionalities of the App and the services offered via the App, as well as to provide updates for your home appliance (1.a.- c.),
• to provide a personalized invitation link (e.g. using your first name) to invite other users to share the App and the services offered via the App (1.a.),
• to store data/information and to send notifications, e.g. in the event of product purchases, customer service cases and similar contractual interactions, if you have used your Synced Home Appliance Account in this context (1.a.- d, e - f.),
• the email address provided (1 a.) to (i) verify that the customer has authorized a third party to receive their data in accordance with the Data Act (ii) fulfil legal provision obligations in accordance with the Data Act,
• for notification in the event of safety notices and/or voluntary recall information as part of product monitoring (1.a. to c., e.),
• for the purpose of notification in the event of product recalls, your name, contact details and appliance data (including customer service transaction data) will be stored in a separate "safety measures" database, e.g. to carry out product recalls (1.a., b. and e.).
• For proactive, appliance-related maintenance, including the provision of related in-App/email messages (e.g. recommendations on the use of settings and/or maintenance programs or anomalies that indicate an imminent major malfunction of the home appliance that can be avoided by taking appropriate preventive measures, e.g. if vibrations in the home appliance indicate an imbalance that which could damage the appliance) and reactive troubleshooting (e.g. as part of remote diagnostics, during on-site repairs or at the repair center) on connected home appliances (1.a. to c., e.), as well as to communicate product recommendations for maintenance (provided you have opted in to marketing).
• to improve the user-friendliness of the App (in particular the interaction between the App and the home appliance) and for specific or general troubleshooting in the App and the digital services offered through it, including the Synced Home Appliance Account (1. c and e.),
• to improve the range of products and services offered by the operator and the companies affiliated with the operator, in particular with regard to the home appliances themselves and with regard to the use of the home appliance (e.g. unused programs or frequently used programs) and other functions of the App and the home appliance (including algorithmic learning and AI-supported applications and models, e.g. to improve the detection of the fill level of refrigerators or the degree of browning in the oven) (1.c. to e.) and
• for billing purposes, insofar as the home appliances connected to the App or the services offered in the App provide for usage-based billing (1.a.-c.),
• for marketing and market research purposes (including the provision of in-App/email messages) (1.a.-e.), insofar and as long as the relevant consent has been given;
• To fulfil any monitoring obligations, comments and feedback on appliance-related functions (e.g. recipes) are pre-filtered by AI. In doing so, We rely on the guidelines and verification logic specified by the AI provider and follow the guidelines and procedural rules described in this user agreement. In case of doubt, this is checked by a human being.
• in anonymized form for statistics on the use of connected home appliances for use by HomeConnect and its affiliated companies for internal purposes and in the context of general communication, including social media (1.c anonymized).

The legal basis for the respective processing purposes within the scope of the GDPR (REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016) can be found in section 12 of this information.

For further information on data transfers within the Bosch Group in connection with the central SingleKey ID, please refer to the RB Data Protection Information at https://singlekey-id.com/en/data-protection-notice/.

3. Standard retention periods

Subject to deviating legal requirements, the following standard storage periods apply:

a. SingleKey ID: Deletion upon deletion of the SingleKey ID user account.

b. User master data: Deletion upon deletion of the local user account or the central BSH user account.

c. Appliance master data: Removal of the assignment to the user account with removal of the home appliance from the user account.

d. Appliance usage data: Storage in personalized form for a period of 30 days. Thereafter, storage in pseudonymized form (in a special database using a pseudonymization algorithm) and provision in personalized form for services and/or repair services provided via the App or on site/by the repair service (e.g. proactive or reactive maintenance/troubleshooting, where available) for the duration of the contract or (if the function can be deactivated) for the duration of the activation of the function. In addition, in pseudonymized form based on our legitimate interest, as long as our legitimate interest prevails, thereafter in anonymized form. If you have shared content with third parties, this content will not be deleted but will remain on the home appliances and/or end appliances of the third parties with whom you have shared the content.

e. App-related usage data: Storage in pseudonymous form and provision in personalized form for services/messages provided via the App, provided that the "Allow tracking of usage data" function is activated. When this function is deactivated, the individual ID used for tracking is reset so that App-related usage data that has already been collected can no longer be assigned to you.

f. Contract-related data: in the event of deletion of the Synced Home Appliance Account or individual deletion of such data, the contract data will be automatically deleted, provided that no binding retention period applies to this contract data. If a binding retention period exists, for example because the current contractual relationship has not yet been fully fulfilled or for tax reasons, the contract data will be retained for these reasons. In the case of statutory retention periods, however, the data will not be actively used and will also no longer be visible via the Synced Home Appliance Account (e.g. if you have not requested the deletion of the entire account).

g. Authorizations and authorization-related data: Storage until the corresponding authorization is revoked for data associated with this revocation declaration.

h. Name, contact details and appliance master data (including customer service transaction data): Storage in personalized form for a period of 30 years in a special "Safety Action" database, which is maintained exclusively for these purposes, e.g. to carry out product recalls.

If you sell your home appliance, please note that you must reset your home appliance to its factory settings before deleting the SingleKey ID or the App. If you have allowed another App user who does not have their own account to use your home appliance, deleting your account will also delete the other user's account. If you have allowed another App user who has their own account to use a home appliance, please note that deleting your account will not also delete the other user. If you do not want the other user to continue using the home appliance via the App, please also arrange for the deletion of the other user. If such deletion does not take place, the home appliance master data and home appliance usage data collected to date will remain available to the other user.

4. Control of data processing

a. Connectivity of your home appliance

You can control the connectivity of your home appliance via the App:

• If your home appliance has this function, you can disconnect it from the Home Connect server separately (menu item Appliances→ Settings) if necessary, with the result that
  – appliance usage data (1.c.) will no longer be transmitted to the Home Connect server; if your home appliance has a buffer memory, data may be transmitted to the Home Connect server when your home appliance's connection to the Home Connect server is restored.
  – certain functions of the App will no longer be available, in particular, it will no longer be possible to operate the home appliance even if there is an existing Internet data connection.

• If necessary, you can switch off the Wi-Fi connection separately for each home appliance (menu item Appliances→ Settings), with the result that
  – Appliance usage data (1.c.) may no longer be transmitted to the Home Connect server; if your home appliance has a buffer memory, transmission to the Home Connect server may take place when the Wi-Fi connection of your home appliance is restored or established for the first time.
  – The appliance can only be operated on the appliance itself, but no longer via the App.

b. User accounts and local App data

You can use the App to manage your user accounts and delete locally stored App data.

• You can delete your user account. (Menu item Profile→ Personal data→ Delete user account). This will result in the
  – link between your home appliance and your user account will be deleted,
  – your home appliance will no longer send appliance usage data to the Home Connect server, provided that no other user accounts are linked to the home appliance (see 1.a. above).

• By deleting the App or using the "Full reset" function, you will remove all locally stored user-related data, but not the accounts you have created.
• If you use SingleKey ID, the SingleKey ID account is deleted using the SingleKey ID functions, whereby individual linked applications can also be deleted in addition to the SingleKey ID itself. If the SingleKey ID is the only access mechanism to the App/central Synced Home Appliance Account, deleting the SingleKey ID may result in you no longer being able to access the connected services. Therefore, before deleting the SingleKey ID, check whether you still have any linked applications/user accounts.
• To delete the Synced Home Appliance Account, please use the function provided in the account.
• If you want to delete individual registered home appliances (data), you can do so using the function provided in the Synced Home Appliance Account, where you can delete individual products without having to delete the entire account.
• You can edit/delete your personal information, e.g. your address, and manage your communication preferences directly in the Synced Home Appliance Account. You have the option of completely or partially adjusting or terminating your communication preferences using the function provided in the account (Preference Centre).
• Some functions of the App do not store data generated by your user behavior locally. You can request the deletion of such data via the Home Connect service hotline and carry it out yourself using the corresponding function (which may only be available at a later date).
• If the main user deletes their Home Connect account and requests the deletion of their personal data, the purely appliance-related data (e.g. images from the refrigerator or oven) will also be deleted.
• The content you have uploaded to the Home Connect App (in particular recipes and recipe images). If you have shared content with third parties, this content will remain on the third party's home appliance and/or end appliance even if you delete the data locally.

Depending on the action selected, you will receive immediate feedback on the changes made or a corresponding confirmation email.

c. Factory settings of the home appliance

You can reset your home appliance to its factory settings. This will result in

• the network settings are reset, thereby disconnecting the home appliance from the Home Connect server,
• the link between the home appliance and previously linked user accounts is deleted (requires the home appliance to be connected to the internet), meaning that your home appliance will no longer be displayed in the App
• and all content loaded onto the home appliance will be deleted.

To reset your home appliance to its factory settings, please refer to the operating instructions for your home appliance.

5. Transfer or disclosure of your data, e.g. to third parties

To provide the Synced Home Appliance Account, the App and the services offered through it, We work with various companies in the Home Connect Family and external service providers. We ensure data processing within the Home Connect Family through an internal data protection agreement. As We have obliged our external service providers to process data strictly in accordance with our instructions as processors, data processing by these service providers does not require your consent.

Service providers We use as processors:

• Service providers for hosting services
• Service providers for programming services
• Service providers for AI-supported offers and similar services
• Service providers for hotline services (including chat and similar means of communication) and other App services.

We only transfer your data to other recipients if this is necessary to fulfil a contract with you or between you and the third-party provider, if We or the recipient have a legitimate interest in transferring your data, or if you have given your consent to the transfer. These recipients include service providers and other companies affiliated with the operator. In addition, data may be transferred to other recipients if We are obliged to do so by law or by an enforceable official or court order.

Other recipients of your data include, in particular, service providers whose offers and services (third-party services) Home Connect mediates within the scope of the App or enables access to such services (see 9. below).

Content, in particular recipes that you have created yourself, may also be transferred to other BSH companies (including internationally) as part of technical processing and provision. If We carry out such a transfer/processing, this is done on the basis of data protection agreements between the BSH companies involved, which also include the application of standard contractual clauses, provided that the transfer is outside the scope of the GDPR and does not fall under Article 45 of the GDPR.

6. Recording of App usage

The App offers the option of collecting App-related usage data (see 1.d. above), whereby – depending on the country in which you are based and which operating system you use – consent is obtained or there is the option of changing activated consents as described below. To collect App-related usage data, We use the following providers :

• Adobe Analytics from Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland (hereinafter "Adobe").
• Optimizely Inc., 631 Howard Street, Suite 100, San Francisco, CA 94105, United States, (hereinafter "Optimizely").

If the function "Allow analysis " is activated, App-related usage data is sent to and stored on the servers of the aforementioned providers located in the EU. The App-related usage data enables an analysis of your use of the App and the provision of notifications for services provided via the App (see 1.d. above). IP anonymization has been activated for this App, meaning that the IP address you use is truncated beforehand. On behalf of Home Connect, the respective provider will use this information on our behalf to evaluate your use of the App, generate error reports and compile reports on App activity for Home Connect. A/B and multivariate testing is performed on our behalf by Optimizely. For this purpose, App-related usage data is collected, transferred to an Optimizely server, and stored and processed there.

These analyses serve as a basis for us to improve the App itself, to better understand and improve App usage and the connection of home appliances, and to provide context-related content in the App and on websites that you use. In order to provide context-related content, We create typical usage profiles (known as "audiences") that enable us to provide you with content that is relevant to you.

The IP address and other personal data transmitted from your mobile device in connection with the aforementioned services will not be merged with other data from the aforementioned providers or from Home Connect without your separate consent.

You can control the collection of App-related usage data (including your IP address) by the aforementioned services and the processing of this data by the aforementioned services by activating or deactivating the function in the personal settings within the App or in the corresponding system menu of your mobile device. Depending on the legal situation in your country, the analysis or tracking function may be active by default, but you can still change your personal settings.

In addition, error reports can be sent to us from the App so that We can take specific measures to eliminate such errors. These error reports are used in a personalized manner to analyze and rectify the error in the event of a specific error report from you. Without any direct personal reference, error reports are used to eliminate errors for all users of the App in general and to avoid future errors as far as possible.

If covered by a separately declared consent (e.g. a marketing consent given by you via the website), We may also use the App-related usage data within the scope of this consent to personalize the corresponding (marketing) communication to you and your interests. Within the scope of such consent, We will also inform you about such possible use.

7. Other specific data processing

Error reports in connection with the App: We use tools (e.g. the Visual Studio App Centre https://appcenter.ms) to create and send anonymous performance and/or error reports in the event of unplanned behavior of the App, in particular in the event of crashes. Our service provider and Home Connect only receive personalized error reports with your prior explicit consent. We ask for your consent separately before each transmission.

Pairing logs: As part of the pairing process, We also collect information about the pairing process itself, in particular the relevant parameters in the App, the connection status and the pairing status of the home appliance, in order to be able to resolve problems with pairing in general and regarding specific requests from you.

Surveys (App/other channels): We conduct surveys on your satisfaction with our products and services. When We conduct surveys in the App, they are usually conducted anonymously. We may ask you for feedback in various ways, e.g. via a form in the App, on our websites or by email. When We ask you to rate our products and services by email, you can usually rate them on a scale of up to ten points. You can also leave comments in a free text field or, if necessary, provide your telephone number so that We can call you back regarding your rating and comments. Participation in surveys is entirely voluntary. We store the data you provide in such a survey together with your contact details and transaction data relating to the products or services We provide. We use this data to improve our products and services. Your personal data will be anonymized after 12 months.

8. Data security

We use technical and organizational measures to protect your data from manipulation, loss and unauthorized access by third parties. These measures include the use of encryption technology, certificates, a firewall on the Home Connect server and password protection for the Home Connect App. The data security of the Home Connect App has been tested and certified by TÜV Trust IT. We continuously review and improve our security measures in line with technological advances.

9. Scope of the information on data protection

This Data Protection Information applies to the services offered by Home Connect via the App. If additional functions, features or services are offered within the App by Home Connect or a BSH Hausgeräte Group company, specific Data Protection Information will be provided for these if their use is subject to special data protection requirements.

However, this Data Protection Information does not apply to third-party services, even if Home Connect facilitates the use of or access to these third-party services within the App (for third-party services, see also the Terms of Use). In this case, the respective privacy policy of the service provider and, if applicable, additional Data Protection Information from us that addresses the specific features of these third-party services and is only relevant in this respect applies to the use of these third-party services.

In the event of referral to another service provider, Home Connect shall make reasonable and appropriate efforts to indicate the fact of the referral (e.g. when embedding the service provider's content within the App using inline frames), unless the referral is obvious. This is obviously the case, for example, if a link is used to leave the Home Connect App and the App or website of another service provider is accessed.

If you are a user within the scope of the GDPR, please note that the use of third-party services may result in your personal data being processed in countries outside the scope of the General Data Protection Regulation. Please refer to the Data Protection Information of the respective third-party service provider.

10. Changes to the information on data protection

As the App is further developed – for example, due to the implementation of new technologies or the introduction of new services – it may be necessary to amend this Data Protection Information. Home Connect reserves the right to change or supplement this information as necessary. Home Connect will always store the current version of the Data Protection Information in the App so that you can find out about the current version of the information at any time.

11. Rights and contact information

If, despite our efforts to ensure that data is accurate and up to date, incorrect information about you is stored, We will correct it at your request. If you have given us your consent to collect, process and use your personal data, you can revoke this consent at any time with future effect. You can usually revoke your consent by activating the corresponding setting within the App, or by using the contact options specified in the App.

Your personal data will be deleted if you revoke your consent to its storage, if knowledge of the personal data is no longer necessary to fulfil the purpose for which it was stored, or if storage is inadmissible for other legal reasons. Please note that for technical or organizational reasons, there may be an overlap between your revocation and the use of your data, e.g. in the context of a newsletter that has already been sent. Data that is required for billing and accounting purposes or is subject to statutory retention obligations is not affected by this.

If you have any questions about data protection or wish to exercise your data protection rights to revoke your consent, request information, correction, deletion or blocking, please contact us using the contact information provided in the App.

12. Additional information in accordance with the GDPR

a) Legal basis for data processing

We base the following data processing on

• legal permission in accordance with Art. 6 (1) (b) GDPR:
  – Provision of access to the Synced Home Appliance Account via the SingleKey ID using the data categories listed in 1.a).
  – Provision of the Synced Home Appliance Account itself, its functions and the data-based or other services offered via the Synced Home Appliance Account by processing the data categories listed in 1.a.- f.
  – Provision of the App's functionalities and the services offered via the App by processing the data categories 1.a.-c.
  – Processing of contract data within the Synced Home Appliance Account in order to provide synchronized information across all Home Connect Family touchpoints (data categories 1.a – f.).
  – Transfer of the data categories listed in 1.a.-c. to third-party service providers that Home Connect mediates within the App (see 9. below).
  – Transfer of the data categories listed in 1.a.-f. to Home Connect Family companies and/or third-party service providers that are processed in connection with the Synced Home Appliance Account.
  – Elimination of malfunctions by processing the data categories listed in 1.b.-d.
  – Processing of the content you upload via the Home Connect App, including the information required for you to share the content with third parties.

• Legal permission pursuant to Art. 6 para. 1 lit. f GDPR:
  – Improvement of the user-friendliness of the App by processing data categories 1.d. (applies to jurisdictions that allow the collection of App usage data based on legitimate interests. In this case, the "Allow tracking of usage data" function is active in the default setting).
  – Improvement of the user-friendliness of the Synced Home Appliance Account by processing data categories 1.e and f. (applies to jurisdictions that allow the collection of App usage data based on legitimate interests. In this case, the "Allow tracking of usage data" function is active in the default setting).
  – Improvement of our product and service offering, in particular with regard to unused programs or frequently used programs and other functions of the App and the home appliance by processing (including algorithmic processing) data categories 1.c. and d.

• Your consent in accordance with Art. 6(1)(a) GDPR:
  – Direct marketing by processing data categories 1.a.-f.
  – Improvement of the user-friendliness of the Synced Home Appliance Account by processing data categories 1.e and f. (applies to jurisdictions that only allow the collection of App usage data based on consent. The "Allow tracking of usage data" function is only activated with the user's consent).
  – Improvement of the user-friendliness of the App by processing data categories 1.d (applies to jurisdictions that only allow the collection of App usage data based on consent. The "Allow tracking of usage data" function is only activated with the user's consent).

• Legal permission pursuant to Art. 6(1)(c) and (d) GDPR:
  – Storage of data categories 1.a., c. and e. in the "Safety Action" database.
  – Notification in the event of safety notices and/or recall information in the context of product monitoring by processing data categories 1.a.-c and e.

b) Your rights with regard to data protection

In addition to section 11, you are entitled to the following rights. To assert your rights, please use the contact details provided at the end of this Data Protection Information.

•

• Your right to information about your data: Upon request, We will provide you with information about the data We have stored about you.
• Your right to correct or complete your data: We will correct any incorrect information about you if you notify us accordingly. We will complete any incomplete data at your request if this is necessary for the appropriate processing of your data.
• Your right to have your data deleted: We will delete any personal data We have stored about you upon request. However, some data will only be deleted after a specified retention period, because, for example, We are required by law to retain the data in some cases, or We need the data to process the contractual relationship with you.
  Please also note section 11 in this regard.
• Your right to block your data: In certain cases, specified by law, We will block your data if you so request. Blocked data will only be processed to a very limited extent.
• Your right to withdraw consent: You may withdraw your consent to the processing of your data at any time with effect for the future. The lawfulness of the processing of your data until withdrawal remains unaffected.
  Please also note section 11.
• Your right to object to the processing of your data: You may object to the processing of your data at any time with future effect if We process your data on one of the legal bases pursuant to Art. 6(1)(e) or (f) GDPR. In the event of an objection, We will cease processing your data unless there are compelling legitimate grounds for further processing. Compelling legitimate grounds do not exist for us if We process your data for the purpose of direct marketing.
• Your right to data portability: At your request, We can provide you with certain data in a structured, commonly used and machine-readable format.
• Your right to lodge a complaint with the supervisory authority: You can also lodge complaints regarding data protection with a data protection authority. To do so, please contact the data protection authority responsible for your place of residence or the data protection authority responsible for us, as listed below.
  Bavarian State Office for Data Protection Supervision, www.baylda.de.

c) Transfer of personal data to recipients outside the EEA

If necessary for the provision of the functionalities of the Synced Home Appliance Account, the App and the services offered via the App, We also transfer personal data to recipients based outside the EEA in so-called third countries. In this case, before transferring the data, We ensure that the recipient either has an adequate level of data protection (e.g. based on an adequacy decision by the EU Commission for the respective country or the agreement of so-called EU standard contractual clauses of the European Union with the recipient) or that you have given your consent to the transfer.

You can obtain an overview of the recipients in third countries and a copy of the specific agreements made to ensure an adequate level of data protection from us. To do so, please use the contact details provided at the end of this Data Protection Information.

Please also refer to section 9 for the transfer of personal data when using third-party services.

d) Contact details of the data protection officer

If you have any questions about data protection and exercising your rights, you can contact our data protection officer directly using the following contact details:

If you are resident in an EU country (except for the United Kingdom):

BSH Hausgeräte GmbH

Data Protection Officer

Carl-Wery-Str. 34

81739 Munich, Germany

Data-Protection-DE@bshg.com

If you are resident in the United Kingdom:

BSH Home Appliances Limited

Data Protection Officer

Grand Union House, Old Wolverton Road

Wolverton, Milton Keynes, MK12 5PT

Data-Protection-GB@bshg.com

Representative in the United Kingdom pursuant to Article 27 UK GDPR

BSH Home Appliances Limited

UK GDPR Representative Home Connect

Grand Union House, Old Wolverton Road

Wolverton, Milton Keynes, MK12 5PT

Representative in Switzerland

BSH Hausgeräte AG as representative for Home Connect GmbH,

BSH Hausgeräte AG, Fahrweidstrasse 80, CH-8954 Geroldswil

Data-Protection-CH@bshg.com

13. Additional information for residents in New Zealand

Our New Zealand subsidiary’s privacy policy, which is available at https://www.bosch-home.co.nz/metapages/privacy or by emailing privacy.nz@bshg.com, includes our New Zealand subsidiary’s contact details, explains more about how you can seek access to, and correction of, your personal information, how to make a privacy complaint and how our New Zealand subsidiary deals with these complaints.

As of August 2025

- For EU users only –

I. Nature, estimated scope and frequency of product data collection

Type: The data owner is expected to receive the following categories of product data:

Appliance usage data (e.g. basic settings made).

Appliance status data (such as environmental conditions, component statuses, status changes to the home appliance (e.g. depending on the appliance category: change of operating mode, opening or closing of the door/front panel, temperature changes, fill levels) and status messages of the home appliance (e.g. depending on the appliance category: appliance is overheated, water tank is empty, etc.).

• Video and image data (e.g. for refrigerators, cookers and ovens with camera functionality) used for various functions of the respective home appliance, such as detecting the degree of browning (Camera in the Oven).

Estimated scope: The scope of the product data depends on the scope of the product functions used. Based on current estimates, average use of the connected product generates less than approximately 10 MB of product data per day. If the product has a camera, approximately 1 MB is added for each camera image transmitted (e.g. an image is created each time the door of a refrigerator with a camera is opened and closed). Since derived data that is not covered by the Data Act and other general data (e.g. metadata that may be sent redundantly) are also transmitted, the actual amount of data sent may vary significantly.

Regardless of this, the information content of this data is significantly lower and regularly amounts to only a few percent of this technical raw data stream.

Frequency of collection: The connected product is capable of continuously generating readily available data in real time. However, the continuous and real-time availability of this data depends on other factors (e.g. the product's Wi-Fi connection, internet connection, availability of APIs, etc.). For technical reasons, there is always a certain amount of latency due to the various transmission processes.

II. Type and estimated scope of the connected service data to be generated

Type: The following categories of connected service data are generated:

Interactions with the connected product

User orders connected to the connected home appliance (e.g. consumables)

"Detergent scan": if such a service is available for your home appliance and you use it, We store the respective water hardness and the detergent you use, which you have stored in the App, whereby a "detergent history" is created in the App (you can view and delete this history at any time)

Additional programs (if you have purchased additional programs for your home appliance that were provided via the Home Connect App, these additional programs are linked to the home appliance and not to the user account and therefore remain in the home appliance, but not in your user account if you sell or pass on the home appliance. Additional programs are generally not transferable to other home appliances).

Personal preferences (e.g. preferred time zone, favorite programs and recipes, food, program start times, etc.).

Estimated scope: The scope of the connected service data depends on the scope of the service functionalities used. Based on current estimates, less than approximately 1 MB of connected service data is generated per day with average usage. Since derived data that is not covered by the Data Act and other general data (e.g. metadata that may be sent redundantly) are also transmitted, the actual amount of data sent may vary significantly.

Regardless of this, the information content of this data is significantly lower and regularly amounts to only a few percent of this raw data stream.

III. Storage and retention period for product data and associated service data

The data is stored remotely on a server. Individual data is stored (temporarily) on the networked product.

We will delete any personal product data and associated service data stored by us about you upon request. However, some data will only be deleted after a specified retention period, because, for example, We are required by law to retain the data in some cases, or We need the data to process the contractual relationship with you.

There are no deletion periods for non-personal data.

IV. Modalities for accessing and retrieving product data and associated service data

Access to and retrieval of data from products that can be connected via Home Connect, as well as product data generated via Home Connect as a connected service, is generally carried out via the REST API provided as part of the Home Connect Developer Program. Further information on the technical means required for this and on the relevant service quality can be found at: https://developer.home-connect.com/eu_data_act.

In order to access the data via the Home Connect Developer Program, you must accept the terms of use for both the Developer Program and the provision of data in accordance with the Data Act. The current version of these terms of use can be found at: https://developer.home-connect.com/developer_agreement and https://developer.home-connect.com/eu_data_act_user_agreement. The privacy policy for the Developer Portal can be found at: https://developer.home-connect.com/data_privacy.

In addition, a general Home Connect account is required. The current version of these Home Connect account terms of use will be provided to you during the registration process and afterwards in the Home Connect App. The relevant Data Protection Information can be found above.

If you wish to have personal product data or associated service data deleted, please contact us at https://datarequest.bsh-group.com.

V. Use of readily available data

We use readily available personal data for the purposes specified in the current version of the Data Protection Information. Third parties support us in this as contract data processors.

We use non-personal data for the purposes agreed in the current version of the Home Connect Terms of Use. Here, too, We are supported by third parties.

VI. Data controller and contact

The data controller is Home Connect GmbH, based at Carl-Wery-Straße 34, 81739 Munich, Germany. For further data processing parties, please refer to the general Data Protection Information.

For fast and efficient communication with us, you can reach us at:info.de@home-connect.com or by telephone on: +49 (0) 89 / 4590 01.

VII. Data transfer to third parties

If you wish to transfer data to a third party, you must link your Home Connect account to your account with that third party (usually via the third party's App).

If you wish to stop data being transferred to the third party, you must disconnect your Home Connect account from your account with that third party (either via the Home Connect App or, if possible, via the third party's App).

VIII. Right to complain

Complaints relating to breaches of obligations under Chapter II of the Data Act can be submitted to the competent authority under Section 37(1) of the Data Act. Regardless of your place of residence, this is the Federal Network Agency (https://www.bundesnetzagentur.de/).

If this complaint concerns personal data, you can also submit it to the Federal Commissioner for Data Protection and Freedom of Information (https://www.bfdi.bund.de/), which is the competent authority under Section 37(3) of the Data Act.

IX. Trade secrets

The data provided does not contain any trade secrets.

X. Contract term and early termination

If you only use Home Connect, you only agree to the Home Connect Terms of Use with us. For the exact contract term and the terms and conditions for early termination of these Terms of Use, please refer to the current version of the Home Connect Account Terms of Use, which are provided to you during the registration process (and subsequently in the Home Connect App).

If you wish to provide data in accordance with the Data Act, you must accept the Terms of Use for both the Developer Program and the provision of data in accordance with the Data Act. For the exact contract duration and the terms and conditions for early termination of these contracts, please refer to the current version of these Terms of Use (available at:

https://developer.home-connect.com/developer_agreement

and

https://developer.home-connect.com/eu_data_act_user_agreement).

Version: 1.0rs dated August 2025