Privacy Policy - Merkur ME SMART

Merkur and Reduxi respect and value your privacy. Whether you visit our websites or purchase and use our products and services, Merkur and Reduxi are committed to protecting your personal information and handling it responsibly.

When you provide Merkur and Reduxi with your personal information or we obtain your personal information from other sources, Merkur and Reduxi will treat it in accordance with this Privacy Policy.

This Privacy Policy describes how we collect your personal information, how we use and process it and how we share it when you visit our websites and use our products and services.

Personal data and other terms

"Personal Information" is any information relating to you that can identify you as a specific or identifiable individual. An individual is identifiable when he can be directly or indirectly identified, in particular by specifying an identifier such as name, identification number, location data, online identifier, etc., or by specifying one or more factors that characterize an individual's physical, physiological, genetic, mental, economic, cultural or social identity.

"Website" refers to all Merkur and Reduxi websites and includes the following:

• website Reduxi https://www.reduxi.eu;

"Web Application" refers to both of and Reduxi web applications and includes the following:

• Amibit application,
• Web application Merkur and Reduxi https://app.Merkur and Reduxi.eu.

"Sites" refers to all Merkur and Reduxi websites and web applications.

"Controller" refers to our hardware and includes the following:

• Merkur ME SMART controller

"Operator" means natural or legal person, public authority, agency or other body that alone or together with other determines the purposes and means of processing.

"Contractual partners" are partners with whom Amibit has a written agreement to use our Controller and our Web Application for further distribution. If Contractual Partners store personal data on our server and share their customers' personal data with us, Amibit will treat them in accordance with this Privacy Policy.

Operator and authorized person for data protection

The operator of personal data is the company Reduxi Adria d.o.o., Šaleška cesta 2a, 3320 Velenje, Slovenia.

The appointed authorized person for data protection at  Reduxi can be reached at the e-mail address [e-mail]

Legal basis for personal data processing

We collect and process your data based on the following legal bases:

• Processing based on the law.
• Processing based on a contract.
• Processing based on the individual's consent.
• Processing based on legitimate interest.

a)    Processing based on a contract

We process your data when this is necessary for the conclusion, implementation and fulfilment of contractual obligations. You provide us with personal data voluntarily.

If you do not provide us with personal data, we cannot conclude a contract with you and guarantee you the performance of our services and the sale of our products.

b)    Processing based on the individual's consent

We process your data when you give us your explicit consent. You can withdraw your consent at any time. If you revoke your consent, we will not be able to provide you with some services.

c)    Processing based on legitimate interest

We may process your personal data based on a legitimate interest that we pursue and that overrides your interests. In case of processing personal data based on a legitimate interest, you have the right to object (more about this right in the section Your rights).

d)    Processing based on the law

We may process your personal data when such processing is required by legislation that binds us. We process this personal data in accordance with the requirements of the law.

Cookies

Cookies are text files that are stored on the user's device with which the user accesses the website when visiting and using the website. When visiting the website again, Merkur and Reduxi can access data on the user's device that has been collected with the help of cookies.

You can read more about cookies in the Cookie Policy.

Types of personal data and purpose of processing

You can contact us via different channels through which we collect your personal data in various ways.

We must process some personal data in order to respond to your inquiry, sell you a product or provide you with our services. You may provide us with some personal data voluntarily.

The personal data that we collect and process is:

• contact information such as: name, surname, address, telephone number, e-mail address, title, position, etc.;
• information you provide to us via online forms, e-mail or telephone;
• information about your profile, if you create an account in our Web Application; including username;
• technical information about the user, such as data about the use of websites, including IP address, location, etc.;
• information about measurements obtained from the Controller, if you use the Web Application and you have given us explicit consent to access the Controller;
• transaction information, including credit card information, when you purchase products or services from us.

We do not process special categories of personal data, except in the case when you have given your explicit consent for this, or it is necessary due to legal regulations.

We collect and process personal data in accordance with the legal bases specified in the section Legal basis for personal data processing. We will collect and process your personal data if:

• you voluntarily gave your consent,
• the processing of personal data is necessary for communication with you,
• processing is necessary for the fulfilment of legal obligations or legitimate interests,
• the processing is necessary for our legitimate interests or for the legitimate interests of third parties and such data processing is not harmful to you.

We collect and process your personal data for the following purposes:

• providing information about our products and services for which you have sent an inquiry via online forms on our websites, online mail, etc.,
• delivery of our products and performance of our services,
• sending online news and other marketing materials,
• management of our business relationships and negotiations and implementation of agreements,
• providing various services and support to customers and Contractual partners,
• insight into the user experience of our customers and Contractual partners when using Websites, products and services with the aim of improving the user experience,
• general communication with you,
• fulfilment of legal obligations or legal interests.

Storage

Personal data is kept only as long as it is necessary to achieve the purpose for which it was collected or processed. Once the purpose has been fulfilled or you have withdrawn your consent to processing, your personal data will be deleted, destroyed, blocked or anonymised. Exceptionally, personal data is further processed if there is another legal basis and/or another purpose.

Minors

Minors under the age of 16 should not submit any personal information to websites or in any other way without the permission of the parent responsible for the child. We will never knowingly collect personal information from persons we know to be minors (under 16 years of age) or use or disclose it in any way to an unauthorized third party without the permission of the child's parent.

Links to other websites, etc.

Our Websites and Controller may contain links to other websites that we do not own. We are not responsible for the content of third-party websites that are not under our control or influence. We are not responsible for their personal data practices. When you visit third-party websites, you should read their privacy policies and any other policies that affect the collection and processing of personal data.

Other data that we collect

• Continuously in real time or near real time: data from grid meter and other devices connected to Merkur and Reduxi device (solar, battery, EV charger and others). This data includes (but is not limited to): power, energy, voltage, current, setpoints, device statuses, device operating modes and device fault/error notifications is collected in 1 second interval and stored locally on Merkur and Reduxi device. Same data, but aggregated to 1 minute and 15 minute time intervals, is also stored in Merkur and Reduxi cloud (EU-based) for purpose of calculation, analyse, forecasting, reporting and displaying to end user (via Mobile app or webpage);
• Once or occasionally (when user changes it): user data such as (but not limited to) data entered in user account registration process, such as (but not limited to) e-mail, physical (street address or GPS coordinates) of Merkur and Reduxi device, name, connected devices, ID of Merkur and Reduxi device. This data is stored locally on Merkur and Reduxi device and in Merkur and Reduxi Cloud.

Merkur and Reduxi does not forward the this data to third parties, unless this is necessary for the performance of services (for example, but not limited to physical location to obtain weather forecast), or it is regulated (for example, but not limited to data requested by grid operator as prescribed in relevant regulations) or by law.

Personal data protection

We will take all necessary measures to ensure the secure processing of your data in accordance with our Privacy Policy. You are also responsible for protecting personal data; especially if you are a user of the Web Application and/or the Controller. Ensure the security of your username and password and use appropriate software to protect your devices through which you access our Websites or the Controller.

We use cloud technology to store data from the Web Application and the Controller. It is equipped with a security mechanism that ensures a high level of data protection. Due to advanced encryption of communication, data is safe in case of misuse, as well as in case of misuse by an unauthorized person. The controller and the Web application are protected by symmetric and asymmetric encryption and thus subject to high security standards.

This website is protected with an SSL certificate; personal data is secured during information transfer.

When you buy our Controller, you become the owner of the Controller. With this, you become fully responsible for the protection of your personal data. Merkur and Reduxi does not have access to Controller data unless you give us your consent for the purpose of support or help with configuration. If you give us your consent to access the Controller, we will act according to this Privacy Policy.

If you connect to the Web Application, you must provide your consent to agree to our Privacy Policy. In this case, we have access to the Controller you use, including certain personal information such as your username. If you do not give your consent, we cannot provide you with certain services.

We use all available means to protect your Personal Data, but we cannot guarantee absolute security. The security of your Personal Data is very important to us, but you should be aware that no method of transfer over the Internet or method of electronic storage is 100% secure.

Your rights

In relation to personal data processing, you have the following rights:

a)    Right of access to personal data

As an individual, you have the right to request information about whether we are processing personal data about you. If we process your personal data, you have the right to access information about what personal data we process and certain information related to your personal data.

b)    The right to withdraw consent

If you, as an individual, have consented to the processing of your personal data, you may revoke your consent at any time, without affecting the legality of data processing, which was carried out on the basis of consent until its revocation.

The withdrawal of consent to the processing of personal data does not have any negative consequences or sanctions for the individual. However, it is possible that after revoking your consent to the processing of personal data, we will no longer be able to provide you with some of our services.

c)    The right to correct personal data

You have the right to correct inaccurate personal data relating to you without undue delay or to complete it if necessary.

d)    The right to delete personal data

You have the right to request that we delete personal data relating to you without undue delay where one of the following reasons exists:

• data is no longer needed for the purposes for which they were collected or otherwise processed,
• if you revoke your consent, and there is no other legal basis for the processing,
• if you object to the processing, but there are no overriding legal reasons for the processing,
• data was processed illegally,
• data must be deleted to comply with legal obligations in accordance with EU law or the law of a Member State applicable to us,
• the data was collected in connection with the information society's service offers.

However, as an individual, in certain cases described in paragraph 3 of Article 17 of the GDPR, you do not have the right to delete data.

e)    Right to limit the processing of data

You have the right to request that we limit the processing when one of the following cases exists:

• if you object the accuracy of the data for a period that allows us to verify the accuracy of the data,
• the processing is illegal, and you object to the deletion of the data, but instead request a limitation of their use,
• we no longer need the data for processing purposes, but you need it to assert, implement and defend legal claims,
• you filed a complaint regarding the processing, until it is verified that our legitimate reasons prevail over your reasons.

f)      The right to data transfer

When data processing is based on consent or contract, the individual has the right to request his data to be sent to him personally or transferred to another company. The data must be in a commonly used and machine-readable format.

As an individual, when exercising the aforementioned right to data transfer, you have the right to have personal data directly transferred from one Operator to another, when this is technically feasible.

g)    The right to object data processing

If the processing is carried out for the legitimate interests that we are pursuing, you can object to such processing at any time. Amibit will stop processing your personal data, unless otherwise required by applicable law.

Where personal data is processed for marketing purposes, the individual has the right to object at any time to the processing of data relating to him for the purposes of such marketing, including profiling, insofar as it is related to such direct marketing; when an individual objects to processing for direct marketing purposes, the data is no longer processed for these purposes.

When data is processed for scientific or historical research purposes or statistical purposes, the individual has the right to object to the processing of data concerning him for reasons related to his special situation, unless the processing is necessary for the performance of the task being carried out for reasons of public interest.

h)    The right to file a complaint with the supervisory authority   

Without intervention to any other (administrative or other) legal remedy, you as an individual have the right to file a complaint with a supervisory authority, in particular in the country in which you have your habitual residence, your place of work or in which the violation allegedly occurred (in Slovenia, this is the Information Commissioner), if you believe that the processing of personal data concerning you violates regulations on the protection of personal data.

Without intervention to any other (administrative or our of court) means, you as an individual have the right to an effective legal remedy, namely against the legally binding decision of the supervisory authority in relation to it, as well as in the case when the supervisory authority does not consider your complaint or you are does not inform about the status of the case or about the decision on the appeal within three months. Courts of the Member State in which the supervisory authority has its seat are competent for proceedings against the supervisory authority.

For the purposes of reliable identification in the case of exercising rights in relation to personal data, the Operator may request additional data from the individual, and may refuse to take action only if he proves that it cannot reliably identify the individual.

The Operator must respond to the individual's request, with which he/she is exercising his/her rights in relation to personal data, without undue delay and no later than one month after receiving the request.

Changes to the Privacy Policy

This Privacy Policy enters into force on 6.12.2022 and remains in effect, except in the case of additions or changes to the Privacy Policy that may occur in the future. The modified or amended Privacy Policy enters into force as soon as it is published on our Websites.

We reserve the right to supplement or change our Privacy Policy at any time, so please check when you visit our Websites if there have been minor changes to the Privacy Policy. By your use of our Websites after we publish a new Privacy Policy, you automatically agree to the new Privacy Policy.

By using our Websites after we publish a new Privacy Policy, you automatically agree to the new Privacy Policy.

In case we make key changes in relation to this Privacy Policy, you will be notified via the e-mail you have provided or by a visible notice on our Websites.

Contact

If you need more information about our practices regarding the processing of personal data, have a question regarding this Privacy Policy, or would like to make a request regarding your personal data (to exercise any of the rights listed in the section Your rights), you can contact our authorized person for data protection via the e-mail address [e-mail] or write to at the address given below.

Authorized person for data protection

Reduxi Adria d.o.o.

Šaleška cesta 2 a

3320 Velenje

Slovenia