Platform Privacy Notice

In accordance with the applicable statutory data protection provisions, in particular the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”), the Swiss Federal Act on Data Protection (“FADP”), each as amended from time to time, and the European General Data Protection Regulation (“GDPR”), we wish to inform you of the nature, scope and purpose of our processing of personal data.

Allthings does not sell personal data and processes your data solely in the manner described below. The property management company, landlord or owner determines the purposes of your data; we process it solely on their instructions.

PART A — COMMON PROVISIONS

A.I Controller and Contact

The controller within the meaning of Art. 4(7) GDPR and the revised FADP is:

Allthings Technologies AG, Lange Gasse 8, 4052 Basel, Switzerland

Responsible contact person: Cordula Geng, Head of Compliance

Contact for data protection inquiries: support@allthings.me

A.II Server Locations and Processing on Our Behalf

Our servers are located with Amazon Web Services (“AWS”) in Zurich, Switzerland and Dublin, Ireland. A corresponding data processing agreement is in place with AWS as processor.

A.III Source of the Data Processed

We primarily process data that we receive directly from data subjects in the course of initiating or conducting a business relationship (see also Part E), as well as data generated through the use of our website and services (e.g., via the contact form) or technically collected by our IT systems.

To the extent necessary for the provision of our services or the performance of a contract, we also receive data from other companies within our corporate group or from partner companies, in particular from Allthings GmbH, Herrenstrasse 49, 79098 Freiburg, Germany.

In individual cases, we also process data obtained from other third parties (e.g., credit reporting agencies or public authorities) or from publicly accessible sources (e.g., telephone directories or the internet).

A.IV Categories of Data Processed

The categories of personal data we regularly process include, in particular:

Personal master and contact data: first and last name, address, e-mail address, telephone number, job title
Information on the nature and content of the business relationship: contract data, order data, sales and transaction data, customer and supplier history, advisory documentation
Advertising and sales data
Documentation data (e.g., advisory records, support tickets)
Data from electronic business communications (e.g., IP address, login data)
Other data received in the course of the business relationship (e.g., from customer conversations)
Data documenting consents given
Photographs taken at public events

A.V Purposes of Processing

We process your data, in particular, for the following purposes. The applicable legal basis depends on the law applicable to you and is set out in Part B (Switzerland) or Part C (EU/Germany), respectively:

Establishing and maintaining a customer or supplier account, and maintaining our customer/prospect database
Sending information, and offering and selling our software products and services (e.g., training, consulting, support)
Intra-group transfer of data to affiliated companies
Processing of payment transactions through external service providers
Engagement of debt-collection agencies and attorneys for the collection and enforcement of receivables
Assertion and defense of legal claims
Advertising, marketing and market research
Photographic and audio-visual recordings at public events
Measures relating to corporate management and the further development of our services
Conducting due diligence reviews in connection with corporate restructurings
Ensuring IT security and IT operations, as well as building and facility security
Compliance with statutory obligations, e.g., under commercial or tax law

A.VI Recipients and Categories of Recipients

Within Allthings, access to your data is granted to those employees and organizational units who require it in order to fulfil our contractual and statutory obligations or to safeguard our legitimate interests.

Beyond this, we disclose data to the following recipients or categories of recipients, to the extent necessary for the initiation or performance of a contract or to safeguard legitimate interests:

IT service providers (e.g., e-mail providers, web-hosting providers, cloud infrastructure providers)
Companies affiliated with Allthings (e.g., Allthings GmbH, Freiburg, Germany)
Partner companies (e.g., sales partners, advertising partners)
Communications service providers (e.g., telephone providers)
Payment service providers
Transport and logistics providers
Statutory auditors
Tax and legal advisors
Government authorities, to the extent a statutory duty of disclosure applies

Where we engage a service provider to process data on our behalf, we remain responsible for the protection of your data. Such processors are contractually obligated to process personal data confidentially and solely in accordance with our instructions. Data is transferred to government authorities only where legally required or undertaken on your behalf.

A.VII Retention and Deletion Periods

To the extent Allthings acts as a processor (in connection with the use of the Allthings services), retention and deletion periods are governed by the instructions of the responsible property management company and the applicable data processing agreement (“DPA”). In all other respects, we store personal data only for as long as necessary for the respective purpose, or as required by statutory retention or limitation periods.

Unless a shorter period is specified elsewhere in this notice, the following general benchmarks apply in particular:

Contract-related data: until termination of the business relationship, plus applicable statutory limitation and warranty periods (typically three years; in certain cases up to ten or thirty years)
Commercial- and tax-law documentation and retention obligations: generally between six and ten years (e.g., under commercial or tax law)
Website log files: 90 days (see A.VIII)
Chatbot data: 12 months, or for the duration of an active account (see A.XI)
Account/usage data relating to the Allthings services: until the end of use, thereafter deletion or anonymization (see D.III)

A.VIII Provision of the Website and Log Files

Each time our website is accessed, our system automatically collects data transmitted by your internet browser to us or to our web host (so-called log files). These server log files contain IP addresses or other data that may allow identification of a user. The following data is collected:

Browser type and version
User's operating system
User's internet service provider
User's IP address
Date and time of access
Websites from which our website was accessed, and websites navigated to from our website

This data is not stored together with any other personal data of the user. It is used to provide and optimize the website and to ensure IT security, and is deleted — or anonymized such that identification is no longer possible — no later than 90 days after collection. As this data is necessary for the operation of the website, no right to object applies in this respect.

A.IX Cookies and Similar Technologies

1. Use of Cookies

Our website uses cookies or comparable techniques, through which we collect usage data (e.g., access times, pages visited) as well as metadata and communications data (IP address, device information). Session cookies are deleted at the end of the browser session; persistent cookies remain on your device for a specified period. Cookies from partner companies or other third parties may additionally be used (third-party cookies).

We deploy cookies that are strictly necessary for the operation of the website without separate consent. For all other cookies, we obtain your consent via our cookie-consent tool. You may adjust or withdraw your consent at any time through that tool's settings.

We currently deploy, in particular, essential and/or strictly necessary cookies; a current, detailed listing thereof may be found at: https://drive.google.com/file/d/1MCknVz0-F9h1EqYeFh2E2boNMaDUfhtl/view

Where we process your personal data by means of cookies on the basis of your consent (“opt-in”), the legal basis is Art. 6(1)(a) GDPR. Otherwise, we have a legitimate interest in the effective functionality, improvement and economical operation of the website, such that the legal basis is Art. 6(1)(f) GDPR. The legal basis for strictly necessary cookies is our legitimate interest in the functionality and security of the website. For all other cookies, your consent is determinative. Further details are set out in Part B or Part C, as applicable.

You may additionally restrict or delete cookies through your browser settings; cookies already stored may be deleted at any time. This may limit certain functions of the website.

2. Cookiebot (Cookie Consent Tool)

We use the cookie-consent tool “Cookiebot,” provided by Cybot A/S, Copenhagen, Denmark. Cookiebot provides information on the cookies used and allows consent to be granted, amended or refused, either granularly or in full. Technically necessary cookies are set independently of this tool.

The legal basis is our legitimate interest in the optimal functionality and security of the website (for details, see Part B/C). You may adjust your cookie settings via Cookiebot at any time by clearing your cache and reloading the website.

3. Deleting Cookies

Information on deleting cookies by browser is available at:

Chrome: https://support.google.com/chrome/answer/95647
Safari: https://support.apple.com/en-us/guide/safari/sfri11471/mac
Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
Microsoft Edge: https://support.microsoft.com/en-us/help/4027947/windows-delete-cookies

A.X Further Tools and Plug-Ins on Our Website

1. SSL/TLS Encryption

We use SSL/TLS encryption, recognizable by the change from “http://” to “https://” and the padlock icon in the browser address bar.

2. Google reCAPTCHA (Invisible reCAPTCHA)

To protect our login, registration and form-submission processes, we use reCAPTCHA provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, offered within Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In doing so, Google evaluates user actions (in particular mouse movements) to distinguish between human and automated use. Data collected includes, among other things, the referring page, IP address, referrer URL, operating system, screen resolution, language settings, time zone, installed browser plug-ins, and mouse and keyboard behavior.

According to Google, the IP address is shortened within the EU/EEA and is transmitted unshortened to servers in the United States only in exceptional cases. Further information is available at: https://policies.google.com/privacy.

This data collection is technically required for the operation of our online offerings; objection is possible only by disabling JavaScript, which will limit the usability of our services.

3. YouTube

We embed video content via a plug-in provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (a subsidiary of Google LLC), offered within Europe by Google Ireland Limited. Our videos are embedded in “extended data protection mode”: data is generally transmitted only when the video is played, at which point YouTube receives, in particular, your IP address. For logged-in users, usage may be associated with their YouTube account. Further information is available at: https://policies.google.com/privacy.

A.XI Chatbot and Artificial Intelligence

In connection with the use of our chatbot, we process only the data you explicitly and voluntarily provide to the chatbot, solely for the purpose of providing our services. We advise against entering sensitive information; should you nonetheless do so, we will process such information only on the basis of your express consent or another legal basis identified to you at the time of disclosure.

Chatbot data is not disclosed to third parties and is retained for the duration of an active account, or otherwise for a maximum of 12 months.

A.XII Contact Form and E-Mail Correspondence

If you use our contact form or write to us by e-mail, we process the data submitted in order to handle your inquiry and, in the case of forms, additionally to prevent misuse and to safeguard our IT security. This data is deleted once the respective correspondence has concluded, unless statutory retention obligations require otherwise. You may object to this processing at any time; the correspondence cannot then be continued.

A.XIII Newsletter and Surveys

1. Newsletter

With your consent, we inform customers and prospective customers by newsletter about our products, services, webinars and other news. Registration takes place via a double opt-in procedure. For verification purposes, we store your e-mail address, name, IP address and the time of registration.

For newsletter distribution, we use Mailchimp, provided by The Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. For product-update mailings, we use the platform provided by Mailjet SAS, 13-13 bis, rue de l'Aubrac, 75012 Paris, France (privacy policy: https://www.mailjet.com/privacy-policy/).

You may unsubscribe from the newsletter at any time via the unsubscribe link contained in every newsletter e-mail, or by contacting support@allthings.me; other business communications remain unaffected.

2. Surveys

From time to time, we conduct voluntary customer and user surveys (e.g., relating to customer satisfaction). Where participation is anonymous, only technical usage data (log files) is generated.

For sending survey e-mails and for the technical conduct of surveys, we engage the service providers Widgix, LLC, 4888 Pearl East Circle, Boulder, CO, USA, and SurveyGizmo, Suite 100W, Boulder, CO 80301, USA. According to its own statements, SurveyGizmo uses its own cookies (e.g., to prevent multiple participation) and aggregated, anonymized data for the further development of its own service (see https://www.surveygizmo.com/privacy/).

This data is deleted once the survey has concluded. Consent may be withdrawn at any time; in the case of prize draws, this may preclude further participation.

A.XIV Online Presence on Social Networks

We maintain an online presence on social and industry networks and link to these from our website in order to communicate with customers, prospective customers and users. Processing by the operators of these platforms is governed by the respective operator's terms of service and privacy policy; unless otherwise indicated, we generally have no influence over such processing.

1. LinkedIn

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy. Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

A.XV Links to Third-Party Websites

Our website may contain links to third-party offerings. Allthings has no influence over the content or design of such offerings, and this privacy notice does not apply to external providers. Please inform yourself of the applicable data protection practices after being redirected to any such site.

PART B — SUPPLEMENTARY PROVISIONS FOR DATA SUBJECTS IN SWITZERLAND

This Part B supplements Part A for individuals whose data is subject to Swiss data protection law: the Federal Act on Data Protection, as revised effective September 1, 2023 (the “revised FADP”), and the Ordinance on Data Protection (“DPO”).

B.I Principle Governing the Processing of Data

Under Swiss law, the processing of personal data is generally permissible provided it does not unlawfully infringe the personality of the data subject (Art. 30 et seq. revised FADP). Unlike under the GDPR, express consent is required only in certain cases, in particular when processing particularly sensitive personal data or conducting high-risk profiling (Art. 5, 6 et seq. revised FADP). For the processing purposes described in Part A, we accordingly rely primarily on this statutory principle and, where required, on your consent.

B.II Your Rights under the Revised FADP

Right of access (Art. 25 revised FADP): confirmation of whether, and to what extent, we process your data, including the statutory minimum disclosures.
Right to rectification of inaccurate data (Art. 32(1) revised FADP).
Right to erasure or destruction of unlawfully processed data, unless retention obligations preclude this (Art. 32(2) revised FADP).
Right to receive or transfer the data you have provided in a commonly used electronic format (Art. 28 revised FADP).
Right to object to processing for direct-marketing purposes and to automated individual decisions having legal effect (Art. 21 revised FADP).
Right to withdraw consent given, with effect for the future (Art. 6 et seq. revised FADP).
Right to lodge a complaint with the Federal Data Protection and Information Commissioner.

To exercise these rights in connection with the Allthings services (e.g., access to, deletion of, or rectification of your data within the tenant app), please contact your responsible property management company directly. For all other inquiries, please contact support@allthings.me.

B.III Supervisory Authority

The competent supervisory authority is the Federal Data Protection and Information Commissioner (“FDPIC”). Further information and contact details are available at: https://www.edoeb.admin.ch/en/contact.

B.IV Disclosure of Personal Data Abroad

Where we process your data in a country that does not ensure an adequate level of data protection according to the FDPIC's list (e.g., the United States), we ensure adequate safeguards - in particular standard contractual clauses or comparable contractual guarantees - or, in individual cases, obtain your express consent (Art. 16 et seq. revised FADP). The EU recognizes Swiss data protection law as ensuring an adequate level of protection, such that data transfers from Switzerland to the EU/EEA are likewise permitted without additional safeguards.

PART C — SUPPLEMENTARY PROVISIONS FOR DATA SUBJECTS IN THE EU/GERMANY

This Part C supplements Part A for individuals whose data is subject to the European General Data Protection Regulation (“GDPR”) and, for Germany, the Federal Data Protection Act (“BDSG”) and the Telecommunications-Digital Services Data Protection Act (“TDDDG”).

C.I Legal Bases for Processing

Performance of (pre-)contractual obligations, Art. 6(1)(b) GDPR — in particular, customer/supplier administration and the offering and sale of our products and services.
Safeguarding legitimate interests, Art. 6(1)(f) GDPR — in particular, intra-group data transfers, payment processing, receivables management, enforcement of legal claims, advertising/marketing, market research, photographic/audio-visual recordings at events, IT and facility security, due-diligence reviews, website log files, and strictly necessary cookies. For certain processing activities within the foregoing categories — in particular photographic and audio-visual recordings at public events and certain marketing measures — we additionally obtain your express consent under Art. 6(1)(a) GDPR before processing your data accordingly.
Compliance with legal obligations, Art. 6(1)(c) GDPR — in particular, obligations under commercial and tax law.
Consent, Art. 6(1)(a) GDPR — in particular, sending newsletters, non-essential cookies, and use of the chatbot; revocable at any time with effect for the future, without affecting the lawfulness of processing carried out prior to revocation.

C.II Your Rights under the GDPR

Right of access, Art. 15 GDPR
Right to rectification, Art. 16 GDPR
Right to erasure, Art. 17 GDPR
Right to restriction of processing, Art. 18 GDPR
Right to data portability, Art. 20 GDPR
Right to object, Art. 21 GDPR — in particular, to processing for direct-marketing purposes and any related profiling
Right to withdraw consent given, Art. 7(3) GDPR
Right to lodge a complaint with a supervisory authority, Art. 77 GDPR

To exercise these rights in connection with the Allthings services (e.g., access to, deletion of, or rectification of your data within the tenant app), please contact your responsible property management company directly, as it, acting as controller, decides on your request. For all other inquiries, please contact support@allthings.me.

C.III Supervisory Authority

You have the right to lodge a complaint with the supervisory authority of your place of residence, place of work, or the place of the alleged infringement (Art. 77 GDPR in conjunction with Section 19 BDSG). An overview of the German data protection authorities is available at: www.bfdi.bund.de.

C.IV Transfer of Data to Third Countries

Where your data is transferred to countries outside the EU/EEA for which the European Commission has not issued an adequacy decision (e.g., the United States), such transfer takes place only on the basis of appropriate safeguards — in particular EU Standard Contractual Clauses — or your express consent, Art. 44 et seq. GDPR.

PART D — USE OF THE ALLTHINGS SERVICES

Allthings makes the Allthings platform available to its customers as software-as-a-service (“SaaS”). The property management company uses these services to enable digital communication and administration with tenants and users.

Processing on Behalf of the Controller: With respect to all data entered, generated or processed by you as a user (e.g., profile information, tickets, pinboard posts), Allthings acts as a processor on behalf of your landlord or property management company (as controller).

D.I Allthings Core Micro-Apps

Which micro-apps are available within a given customer app depends on the service agreement with that customer. In general, these include (designations may vary by customer):

Micro-App	Purpose
Pinboard	Central communication within a property: exchange of information and interaction with other users.
Service Point / Service Center	Messages in the form of tickets to the property management company, e.g., for repair requests or defect reports.
Information	Building information relevant to the user (plans, cleaning schedules, appointments, house rules, etc.).
My Apartment	Central storage of information and documents relating to the rented apartment.
Bookings	Booking of shared spaces or other communal facilities.
My Neighbors	Networking with neighbors, building a tenant community, personal profiles.
Marketplace	Local digital marketplace for selling used items.
Sharing	Local digital sharing service for renting or lending used items.

The provisions of Part A, and, depending on the data subject's location, Part B or Part C, apply correspondingly to processing carried out within these micro-apps.

D.II Third-Party Micro-Apps

Third-party micro-apps are functionalities integrated into the app that are provided and hosted by third parties on their own servers and offered subject to their own terms of use. For certain functions, data (e.g., access credentials) is transmitted to the relevant third-party provider to enable unified access. All third-party offerings are identified as such prior to use. Responsibility for the further use of your data lies exclusively with the relevant third-party provider; please consult that provider's privacy policy.

D.III Registration, User Accounts and Provision of the Allthings Services

Access to the platform is granted, depending on the applicable contractual terms and manner of use, in one of the following ways:

a) Invitation with Activation Code, Issued by the Customer

Our customer (e.g., the property management company) or a service provider engaged by it sends an invitation containing an activation code or a personalized access URL to the specified e-mail address. Our customer is solely responsible for the lawfulness of sending such invitation. Further use requires, at minimum, a name, a (verified) e-mail address, and a password.

b) Invitation by an Existing User

Already-registered residents may send an invitation link to further individuals authorized by the customer. This function may be deactivated at the customer's request.

c) Access Approval by the Property Management Company

Absent an activation code, an access request may be submitted via the login page to the responsible property management company, which may grant access following review.

Outside the login function, we use your e-mail address only to send essential information relating to the applications used, service disruptions, or data security matters.

Upon termination of use, account and usage data are deleted or anonymized in accordance with the instructions of the responsible property management company, unless statutory retention obligations require otherwise.

D.IV Cookies within the Allthings Apps

Within the Allthings applications, we deploy cookies for the purpose of ensuring a user-friendly design thereof. A current and detailed listing of the cookies employed may be found at the link provided under Section A.IX.

The explanations regarding legal basis, purpose and objection rights set out in Part A, Section A.IX apply correspondingly.

PART E — CONTRACTUALLY AGREED RELATIONSHIPS WITH CUSTOMERS AND PARTNERS

E.I Obligation to Disclose Data

If you enter into contract negotiations with us, accept an offer, or otherwise conclude a contractual arrangement with us, we process the data provided in that connection. The specific data required depends on the relevant subject matter of the contract. Providing this data is, as a rule, a mandatory prerequisite for concluding or performing the contract; without such data, we may, in certain circumstances, be unable to conclude a contract or process an order.

Where you act as a contact person for a customer, business partner or cooperation partner (typically as an employee thereof), there is generally no overriding conflicting interest, provided the interaction falls within your area of responsibility; a right to object is accordingly generally excluded in such cases. You are, however, under no obligation to provide data that is not relevant to the performance of the contract or not legally required.

E.II Communications

When communicating with us (in person, by telephone, by post, by fax or by e-mail), we process the data transmitted in order to handle and follow up on the relevant inquiry.

Please note that, for technical reasons, e-mails cannot always be encrypted. We do not disclose such data to third parties, except in pursuit of legitimate interests or where required by law.

E.III Data Processing in Connection with the Sales Relationship

In connection with sales and contractual relationships, we process data in order to carry out pre-contractual measures and contracts, and for the administration and communication necessary in that connection.

Further details are set out in the relevant contractual documents and terms and conditions.

We further process data to the extent necessary to comply with legal obligations or to assess and manage business risk.

E.IV Data Transfer

Where necessary for an inquiry, offer or contract, data may be transferred to the authorities, affiliated companies, or service providers referred to in Section A.VI.

PART F — MISCELLANEOUS PROVISIONS

Due to the ongoing development of our online offerings or services, or as a result of changes in applicable statutory or regulatory requirements, it may become necessary to amend this privacy notice. The current version is available at any time on our website and may be printed if required.