Datenschutzbestimmungen

Effective date: 28 August 2024

Processing of Personal Data at Atmotech INC.

When you use our website, products, software, or services, Atmotech, Inc. processes your personal data. This document provides details about the types of personal data we collect, why we collect this data, and your rights regarding the processing of your personal data.

Atmotech, Inc. is committed to complying with applicable data protection laws, ensuring that your personal data is handled responsibly and transparently. If you have any questions or concerns about how we process your personal data, you can contact us using the following details:

• Address: Atmotech Inc., 100 Pine street, Suite 1250, San Francisco, CA 94111, USA
• Email: info@atmotube.com

Environmental Data Ownership: The purchaser of the devices shall retain all rights, title, and interest in and to all data related to air quality and environmental conditions collected through the use of the devices ("Environmental Data"). ATMO agrees to use such Environmental Data solely in accordance with its standard data use policies, which are hereby incorporated by reference, and applicable laws and regulations. ATMO acknowledges that it has no ownership claims over the Environmental Data and shall not use, process, or disseminate said data except as expressly permitted under the terms of this agreement and within the bounds of applicable legal requirements.

1. The Purposes of Our Data Collection and What Types of Data We Collect

Atmotech offers Internet-enabled devices ("Devices") that monitor various environmental conditions. We also provide a mobile application ("App") and a web dashboard ("Dashboard"), which work alongside our Devices to deliver detailed environmental data where our Devices are installed. To fully benefit from our services, setting up an account is required.

We collect and process your personal data for several purposes based on the nature of your interactions with us:

• User Account Management: We collect your name, email address, username, address, phone number, named used in Shopify, and password to administer your user account. This information is necessary to identify our users and provide them access to their accounts, ensuring secure and personalized service.
• Device Sensor Data Processing: We gather data from the sensors in our Devices, such as air quality parameters, temperature, and humidity levels, to provide accurate service and improve device functionalities. This data helps us analyze environmental conditions and enhance the performance of our Devices. With the Atmotube PRO and Atmotube PRO v.2, users have the option to opt-in to utilize GPS data to enrich the air quality data they collect. This enriched data can be contributed in an anonymous and averaged form to our publicly accessible map at https://map.atmotube.com/, enhancing our community's understanding of environmental conditions. Additionally, users may choose to share this data with researchers, helping to support scientific studies and environmental research. Each of these options is provided to enhance the utility of the data while respecting the privacy and choices of our users.
• App and Dashboard Usage Monitoring: We collect information about how you use our App and Dashboard to improve the functionality and user experience. This includes data on the type of device you use, the operating system, and your IP address, which helps us tailor our services to better suit your needs. We further reserve the right to record user interactions and events for the purpose of improving user experiences.
• Support Interactions: When you reach out to us with inquiries or need support, we collect information related to your interactions with our support team to help resolve any issues you encounter and provide efficient customer service.

Your personal data is processed under the legal bases of contractual necessity (to provide the services you have signed up for) and our legitimate commercial interests (to improve our services and user experience). Where consent is required by law for specific processing activities, such as sending marketing communications, we will obtain your consent explicitly.

2. Disclosure of Personal Data to Others

Atmotech values your privacy and limits the sharing of your personal data. We share data with researchers under specific conditions to facilitate scientific studies and environmental research. These conditions are, inter alia, as follows:

• Device Ownership: If researchers own the device and have provided it to a participant for the purpose of a study, we allow researchers to manage all communications with research participants directly. This ensures that researchers maintain control over the study's integrity and participant interaction.
• Discounted Devices for Research: When researchers provide substantial discounts to consumers in exchange for their participation in a study, we facilitate data sharing. In such cases, we clearly state the possibility of data sharing at the time of purchase when consumers use a specific promotional code. This transparency ensures that participants are fully informed about the use of their data in research before they agree to participate.

These protocols are designed to uphold our commitment to ethical research practices and participant privacy, while enabling valuable scientific and environmental insights.

• Legal Obligations: We may disclose your personal data when required by law, for example, in response to legal proceedings or government inquiries.
• Data Processors: Atmotech employs third-party service providers (data processors) to manage tasks such as customer support, data storage, and order fulfillment on our behalf. We ensure the protection of your data by executing data processing agreements with all our processors. This mandates them to maintain the highest level of privacy and security. Some of our current data processors include:

1. Cloud storage providers (e.g., Amazon Web Services) to store personal and device data securely;
2. Customer support services to manage inquiries and provide timely support;
3. Shipping and logistics companies to deliver products directly to you

In all cases, these processors are strictly prohibited from using your data for any purposes other than those explicitly agreed upon by Atmotech.

Transfer to Third Countries: Your personal data may be transferred to, and processed in, countries outside of the European Economic Area (EEA). We ensure that all data transfers are protected by appropriate safeguards, such as standard contractual clauses approved by the European Commission. These measures are designed to ensure that your data receives the same level of protection as if it remained within the EEA.

3. Storage and Retention of Personal Data

Atmotech is committed to only storing personal data for as long as it is necessary for the purposes for which it was collected. The duration for which we keep your data depends on the type of data and the purpose for which it is processed:

• Account Data: Personal data used to administer your user account, such as your name, email address, and account settings, is retained as long as you maintain an account with us. If you choose to delete your account, your personal data will be removed immediately, although some essential data may be retained in an anonymized form for analytical purposes.
• Device Data: Environmental data collected by our devices is critical for the performance of our services. This data is retained as long as you use our devices and is associated with your account. If you delete your account or discontinue the use of our services, this data is anonymized and may be used in aggregated form for improving our products and services.
• Support Data: Data collected during support interactions is retained for a limited period to ensure quality control and to facilitate follow-up support if needed. Typically, this data is held for no longer than two years unless specific issues require extended retention.
• Marketing Data: If you have agreed to receive marketing communications from us, we retain your contact information until you opt out or unsubscribe. You can withdraw your consent at any time, and we will cease the processing of your data for these purposes.
• Legal Compliance: In some cases, we are legally required to hold certain information for a set period, such as for tax, legal, and audit purposes. In these cases, your personal data will be stored in compliance with the applicable laws and regulations.
• Data Security: We employ robust security measures to protect your data from unauthorized access, alteration, disclosure, or destruction. These include technical measures like encryption and IT security policies, and organizational measures like staff training and limited access to personal data.ithdraw your consent at any time, and we will cease the processing of your data for these purposes.
• Anonymization and Aggregation: Where possible, we anonymize your data when it is no longer needed for the purposes collected. Anonymized data may be used for research or statistical purposes, as it no longer constitutes personal data and, as such, is not subject to data protection laws.

4. Rights of Data Subjects

As a user of Atmotech services, you have several rights concerning the processing of your personal data. These rights ensure you can maintain control over your information. Here are the rights available to you:

• Right to Access: You have the right to request access to the personal data we hold about you. This includes the right to be informed about the nature of the personal data, the purposes of processing, and the recipients to whom the data is disclosed.
• Right to Rectification: If you find that the personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or complete it.
• Right to Erasure: You can request the deletion or removal of your personal data when there is no compelling reason for its continued processing. This right is also known as the "right to be forgotten."
• Right to Restrict Processing: Under certain circumstances, you have the right to block or suppress further use of your data. When processing is restricted, we can still store your data but will not use it further.
• Right to Data Portability: This allows you to obtain and reuse your personal data for your own purposes across different services. You can request that we transfer a copy of your data to you or another organization in a safe and secure way, without hindrance.
• Right to Object: You are entitled to object to certain types of processing, such as direct marketing (including profiling) and processing for purposes of scientific or historical research and statistics, provided that such processing is carried out in the public interest.
• Right to Withdraw Consent: If you have given your consent to the processing of your data, you have the right to withdraw that consent at any time, though this will not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Lodge a Complaint: If you believe that the processing of your personal data infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection.

You can exercise these rights by contacting us via our provided contact details. We will respond to your request within a reasonable timeframe and notify you of the action we have taken.

5. Data Security Measures

At Atmotech, the security of your personal information is paramount. We employ a variety of technical, administrative, and physical measures designed to protect your personal data from unauthorized access, use, alteration, and disclosure.

• Technical Measures: We use encryption technologies to secure data during transmission and storage. Our systems are configured with data loss prevention capabilities to prevent data leakage or unauthorized data movement.
• Administrative Measures: Our internal policies ensure that your data is only accessible by appropriately trained staff who need access to provide our services. Regular training on data protection and security is provided to staff to reinforce the importance of protecting personal data.
• Physical Measures: Access to facilities where personal data are stored is strictly controlled, using secure access mechanisms and physical barriers to prevent unauthorized access.

Despite these measures, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

We are committed to responding swiftly to any security incidents. In the event of a data breach, we will promptly notify you and the relevant authorities, in accordance with applicable laws, if it is likely that the breach poses a risk to your rights and freedoms.

6. Children's Privacy

Atmotech takes children's privacy seriously. Our Services and Products are not designed for, nor intentionally targeted at, children under the age of 18. We do not knowingly collect or solicit personal data from children under 18.

If we become aware that we have collected personal data from a child under the age of 18 without verification of parental consent, we take steps to remove that information from our servers. Additionally, if you believe that a child under 18 may have provided us personal data, we strongly encourage you to contact us immediately, and we will do our best efforts to promptly remove such information from our records.

By implementing these measures, we adhere to our commitment to protecting the privacy of children and ensuring compliance with applicable laws and regulations concerning children's data.

7. Complaints and Legal Processes

If you believe that Atmotech's processing of your personal data is not aligned with the described practices or otherwise does not comply with data protection regulation, you have the right to lodge a complaint. We recommend reaching out to us directly in such instances to resolve any issues swiftly. However, if you feel the need to escalate your concern, you can file a complaint with the appropriate data protection authority.

For those residing in jurisdictions covered by the General Data Protection Regulation (GDPR), you may contact the data protection authority in your country. Atmotech is committed to adhering to the guidelines and resolving complaints under the EU-U.S. Privacy Shield Framework, and will cooperate with the EU data protection authorities (DPAs) regarding unresolved Privacy Shield complaints concerning human resources data transferred from the EU in the context of the employment relationship.

Additionally, for clients and users in the United States, Atmotech commits to compliance with the Health Insurance Portability and Accountability Act (HIPAA) as applicable. This commitment ensures the protection and confidential handling of any health-related information that may be collected or processed through our Products or Services. Atmotech will cooperate with U.S. health oversight agencies and adhere to HIPAA guidelines in managing and resolving any related complaints or inquiries.

In response to lawful requests by public authorities, including to meet national security or law enforcement requirements, Atmotech may disclose personal information. In scenarios of illegal onward transfers of personal data to third parties, Atmotech acknowledges its potential liability under the Privacy Shield.

Should there be an unresolved issue, under certain conditions, you may have the option to invoke binding arbitration as detailed in the Privacy Shield Principles and related annexes.

8. Changes to Our Privacy Policy

Atmotech reserves the right to update or modify this Privacy Policy at any time and from time to time without prior notice. Please review this policy periodically, especially before you provide any personal data. This Privacy Policy was last updated on the date indicated at the beginning of this document. Any changes to our Privacy Policy will become effective upon posting of the revised policy on the website. However, we will use your personal data in a manner consistent with the Privacy Policy in effect at the time you submitted the data, unless you consent to the new or revised policy.

9. Your Rights to Access, Correct, and Delete Your Information

You have the right to access the personal information that Atmotech holds about you, to correct any inaccuracies, and to request the deletion of your information under certain circumstances. You may exercise these rights by accessing your user account or contacting us directly. If you do not have an account or are unable to use the account to exercise these rights, please reach out to us via our designated contact methods. We aim to respond to your request within 30 days. If additional time is required, we will inform you of the reason and extension period in writing.

10. Changes to This Privacy Policy

Atmotech reserves the right to update or modify this Privacy Policy at any time to reflect changes in our practices or service offerings, or changes in the law. We will post the revised policy on our website with an updated revision date. We encourage you to review this Privacy Policy regularly for any changes. Your continued use of our services after any changes or revisions to this Privacy Policy will indicate your agreement with the terms of the revised policy.

10.1. Data Transfer Outside of the European Economic Area (EEA)

Atmotech occasionally transfers personal data to countries outside of the European Economic Area (EEA). We ensure that these transfers are conducted in accordance with legal requirements and are protected by appropriate safeguards, specifically using standard contractual clauses approved by the European Commission. These measures are designed to ensure that your data receives the same level of protection as if it remained within the EEA.

10.2. Details of Data Processors

To facilitate our operations, Atmotech uses various third-party service providers to process personal data on our behalf. Below are some of our key data processors:

• Cloud Storage Provider: Amazon Web Services (AWS). Hetzner – AWS and Hetzner hosts and manages our data storage, ensuring high levels of security and data integrity.
• Customer Support Services: Freshdesk – Freshdesk is used to manage customer inquiries and provide timely support.

• Marketing and Email Communications:

1. HubSpot – HubSpot assists in managing our marketing emails and user engagement analytics;
2. Mailchimp - HubSpot assists in managing our marketing emails;
3. Google Analytics - assists in managing marketing analysis.

• Logistics and Shipping:

1. DHL, FedEx and UPS and other – These companies are responsible for the delivery of our products directly to customers;
2. Warehouses in the U.S., Germany, U.K. China - these companies are responsible for storing and shipping your good with the shipping companies;
3. Amazon - is responsible for storing and shipping products in several countries.

• Product Analytics: Google Analytics provides tools to manage and analyze data, which helps us identify areas for product usability improvement.
• Payment / Order processors: Stripe, Shopify and ZoHo are tools for managing your orders.
• Internal communication: Google G Suite and Slack are tools for communicating the issues in timely manner within the company.

These processors are strictly prohibited from using your data for any other purposes and are required to maintain the confidentiality and security of the data.

10.3. Use of Cookies and Tracking Technologies

Atmotech utilizes cookies and similar tracking technologies to enhance user experience and analyze website traffic. Cookies help us remember your preferences and understand how you interact with our website. You can manage your cookie preferences through your browser settings. For more detailed information about the cookies we use, please visit our Cookie Policy page.

10.4. Legal Obligations and Law Enforcement

We may disclose your personal data to public authorities in response to lawful requests, such as subpoenas or court orders, or in compliance with applicable laws. Additionally, we may share your data to protect the security or integrity of our services, to protect Atmotech’s rights, safety or property, and to enforce our policies or contracts.

10.5. Security Measures

Atmotech employs robust security measures to protect your personal data from unauthorized access, use, alteration, or destruction. These include:

• Technical Measures: Use of encryption to secure data transmissions and data at rest, implementing secure networking technologies such as VPNs, and deploying anti-malware technologies.
• Administrative Measures: Conducting regular security training for our employees, implementing a data access policy to ensure that only authorized personnel have access to personal data.
• Physical Measures: Using secure facilities with restricted access to physical servers that store personal data.

10.6. International Data Protection Compliance

Atmotech is committed to complying with international data protection laws and regulations, including the GDPR. We engage with data protection authorities as required and adhere to the guidelines for international data transfer and processing. If applicable, Atmotech will adhere to frameworks such as the EU-U.S. Privacy Shield to manage data transfers to the U.S.