Legal notice for the Home Connect app

1. Types of Personal Information

In terms of App usage, the associated household appliances or services and functions offered by Home Connect (hereinafter "Services"). Home Connect collects, processes and uses the following categories of Personal Information.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual.

Personal Information that we collect from you and your device

User master data and usage data

Below we describe how we may collect and use our Personal Information when setting up a user account (registration) as well as when setting up the App. This data is stored into your account and this account is personal and non-transferable.

• When registering with the SingleKey ID:

– Access data, i.e. identification data that serves to control access to the SingleKey ID user account and consists of the user ID (e.g. email address or mobile phone number of the user). Responsible for providing this registration service is Bosch.IO GmbH, Bosch.IO GmbH, Ullsteinstrasse 128, 12109 Berlin, Germany ("BIO").

• Additional details that you provide during the registration process including the setting up of the app or registration of a central BSH user account, (as long as they are not transmitted via the SingleKey ID), such as:

– first and last name,

– email address (will also be used as the user ID),

– the country in which you operate your household appliance(s),

– password as access protection for the App/the central BSH user account.

The details requested as part of the registration process may differ from country to country and are managed (if available) via a central BSH user account, which can also be used as Home Connect account.

• Information which we collect and store during the registration process and while using the App:

– language setting of your mobile device

– system settings related to the app (e.g. permission to send in-app messages)

– consent to and recognition of the terms of use

– acknowledgement of this Privacy Policy

– marketing consent(s) and its scope

– status of the user account (activated/deactivated)

– default app tracking setting (depending on the selection of country, see item 7 below for more information)

– Service history (e.g. service technician assignment) of the connected household appliances as well as related orders of the user (e.g. consumables)

– "Detergent Scan": if this service is available for your appliance and you use it, we store the respective water hardness and the detergent used by you stored in the app, a "detergent history" is created in the app (and this history can be deleted by you at any time);

– the approximate device location derived from the zip code or shortened IP address (e.g., at the municipality level) to improve the user experience, e.g., by helping to set location-based device settings (such as water hardness in your region or local time zone)

• The content you upload to the Home Connect app (including, but not limited to, recipes, recipe images, including their labels), including the information required for you to share the content with third parties (e.g., your name as the creator of the recipe). If you, as a user, wish to share your own recipes with others, you must create a separate cooking profile for that purpose and choose a name and avatar for the profile, which will then be displayed with your shared recipe. The name and avatar do not have to relate to you as a person, so it can also be an alias.

Appliance master data

The data we collect and use concerning the connection between your household appliance and the user account are as follows:

– brand of the household appliance (e.g. Bosch),

– serial number and, if applicable, manufacture date of the appliance (so-called E number (full model) and FD (production) number – you can also find these details on the appliance label),

– the unique identifier of the network adapter installed in the household appliance (so-called MAC address).

– additional programs (if you have purchased additional programs for your home appliance that were provided via the Home Connect app, these additional programs are linked to the home appliance and not to the user account and therefore remain in the home appliance, but not in your user account if you sell or otherwise transfer the home appliance. Additional programs are generally not transferable to other home appliances).

These data are allocated to your user account for each connected household appliance under the "Home Connect" function.

Appliance usage data

The data we collect and use in relation to the usage of the household appliance are as follows:

• selected basic settings, program selection and preferred program settings on the household appliance or via the App,

• appliance status data such as ambient conditions, condition of parts, changes of appliance status (e.g. different mode of operation, open or closed doors/front panel, temperature changes, fill levels) and appliance status messages (e.g. appliance is overheated, water tank is empty, etc.) as well as error messages (including the respective error report of the affected household appliance).

• individual settings/contents of the household appliance including free-text fields (e.g. internal digital map for vacuum cleaner robots, beverage name for coffee machines, downloaded or self-designed recipes)

• video and/or image data (e.g. vacuum cleaner robots, stoves and ovens as well as refrigerators with built-in cameras) used for various functions of the respective home appliance. This may include, but is not limited to, imaging the contents of the refrigerator and, in some cases, the area visible to such cameras when the refrigerator door is open (Camera in the Fridge) as well as image data detecting the degree of browning (Camera in the Oven).

If you allow another user (regardless of whether via their own account or via your account) to use home appliances via the app, the appliance usage data created by the additional user will also be stored.

a. App related usage data and app download origin data

App related usage data are data generated by your interaction with the App, such as the features you use, click behaviour relevant to App controls, drop-down menu selections, on/off switch settings, information from A/B and multi-variant tests (i.e., from tests of how different versions of our app are accepted by the respective user in order to thus achieve an improvement in the user experience), and error reports of the app as well as interactions of your app with third-party applications (e.g. web pages that you open from within the app). See item 7 for more information. In addition, the App may also use the tracking technology “Adjust”, a service provided by Adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany ("Adjust"). For more information about their product and privacy policy, please visit: https://www.adjust.com/privacy-policy/. When you follow the links provided via our website and then launch the App after downloading it from the respective app-store, Adjust processes install and event data such as the website you started the download from. This help us understand how our users are interacting with those links and to optimize and analyze our app attribution model. For such analysis, Adjust uses your mobile identifier like IDFA or Google Play Services ID, and your pseudononymized (hashed) IP- and possibly MAC address. Adjust may also track your usage frequency of the App. The information gathered via these technologies may be used to directly or indirectly identify you as an individual user of the App. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the App. We use the information gathered through these tracking technologies to understand how our products are used, improve or develop new features or functionality for our products, notify you of your product usage and performance, and market products and services to you. We may use and disclose information on an aggregate for research and marketing purposes.

You can opt-out of such tracking by choosing at the start of the App if you allow tracking or not.

If you choose not to be tracked, even if the link of this website is used, you will not be tracked.

2. Purposes of use

Below we describe how we may collect and use our Personal Information when setting up a user account (registration) as well as when setting up the App. This data is stored into your account and this account is personal and non-transferable.

• When registering with the SingleKey ID:

– Access data, i.e. identification data that serves to control access to the SingleKey ID user account and consists of the user ID (e.g. email address or mobile phone number of the user). Responsible for providing this registration service is Bosch.IO GmbH, Bosch.IO GmbH, Ullsteinstrasse 128, 12109 Berlin, Germany ("BIO").

• Additional details that you provide during the registration process including the setting up of the app or registration of a central BSH user account, (as long as they are not transmitted via the SingleKey ID), such as:

– first and last name,

– email address (will also be used as the user ID),

– the country in which you operate your household appliance(s),

– password as access protection for the App/the central BSH user account.

The details requested as part of the registration process may differ from country to country and are managed (if available) via a central BSH user account, which can also be used as Home Connect account.

• Information which we collect and store during the registration process and while using the App:

– language setting of your mobile device

– system settings related to the app (e.g. permission to send in-app messages)

– consent to and recognition of the terms of use

– acknowledgement of this Privacy Policy

– marketing consent(s) and its scope

– status of the user account (activated/deactivated)

– default app tracking setting (depending on the selection of country, see item 7 below for more information)

– Service history (e.g. service technician assignment) of the connected household appliances as well as related orders of the user (e.g. consumables)

– "Detergent Scan": if this service is available for your appliance and you use it, we store the respective water hardness and the detergent used by you stored in the app, a "detergent history" is created in the app (and this history can be deleted by you at any time);

– the approximate device location derived from the zip code or shortened IP address (e.g., at the municipality level) to improve the user experience, e.g., by helping to set location-based device settings (such as water hardness in your region or local time zone)

• The content you upload to the Home Connect app (including, but not limited to, recipes, recipe images, including their labels), including the information required for you to share the content with third parties (e.g., your name as the creator of the recipe). If you, as a user, wish to share your own recipes with others, you must create a separate cooking profile for that purpose and choose a name and avatar for the profile, which will then be displayed with your shared recipe. The name and avatar do not have to relate to you as a person, so it can also be an alias.

Appliance master data

The data we collect and use concerning the connection between your household appliance and the user account are as follows:

– brand of the household appliance (e.g. Bosch),

– serial number and, if applicable, manufacture date of the appliance (so-called E number (full model) and FD (production) number – you can also find these details on the appliance label),

– the unique identifier of the network adapter installed in the household appliance (so-called MAC address).

– additional programs (if you have purchased additional programs for your home appliance that were provided via the Home Connect app, these additional programs are linked to the home appliance and not to the user account and therefore remain in the home appliance, but not in your user account if you sell or otherwise transfer the home appliance. Additional programs are generally not transferable to other home appliances).

These data are allocated to your user account for each connected household appliance under the "Home Connect" function.

Appliance usage data

The data we collect and use in relation to the usage of the household appliance are as follows:

• selected basic settings, program selection and preferred program settings on the household appliance or via the App,

• appliance status data such as ambient conditions, condition of parts, changes of appliance status (e.g. different mode of operation, open or closed doors/front panel, temperature changes, fill levels) and appliance status messages (e.g. appliance is overheated, water tank is empty, etc.) as well as error messages (including the respective error report of the affected household appliance).

• individual settings/contents of the household appliance including free-text fields (e.g. internal digital map for vacuum cleaner robots, beverage name for coffee machines, downloaded or self-designed recipes)

• video and/or image data (e.g. vacuum cleaner robots, stoves and ovens as well as refrigerators with built-in cameras) used for various functions of the respective home appliance. This may include, but is not limited to, imaging the contents of the refrigerator and, in some cases, the area visible to such cameras when the refrigerator door is open (Camera in the Fridge) as well as image data detecting the degree of browning (Camera in the Oven).

If you allow another user (regardless of whether via their own account or via your account) to use home appliances via the app, the appliance usage data created by the additional user will also be stored.

a. App related usage data and app download origin data

App related usage data are data generated by your interaction with the App, such as the features you use, click behaviour relevant to App controls, drop-down menu selections, on/off switch settings, information from A/B and multi-variant tests (i.e., from tests of how different versions of our app are accepted by the respective user in order to thus achieve an improvement in the user experience), and error reports of the app as well as interactions of your app with third-party applications (e.g. web pages that you open from within the app). See item 7 for more information. In addition, the App may also use the tracking technology “Adjust”, a service provided by Adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany ("Adjust"). For more information about their product and privacy policy, please visit: https://www.adjust.com/privacy-policy/. When you follow the links provided via our website and then launch the App after downloading it from the respective app-store, Adjust processes install and event data such as the website you started the download from. This help us understand how our users are interacting with those links and to optimize and analyze our app attribution model. For such analysis, Adjust uses your mobile identifier like IDFA or Google Play Services ID, and your pseudononymized (hashed) IP- and possibly MAC address. Adjust may also track your usage frequency of the App. The information gathered via these technologies may be used to directly or indirectly identify you as an individual user of the App. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the App. We use the information gathered through these tracking technologies to understand how our products are used, improve or develop new features or functionality for our products, notify you of your product usage and performance, and market products and services to you. We may use and disclose information on an aggregate for research and marketing purposes.

You can opt-out of such tracking by choosing at the start of the App if you allow tracking or not.

If you choose not to be tracked, even if the link of this website is used, you will not be tracked. https://singlekey-id.com/en/data-protection-notice/.

3. General retention periods

Provided there are no statutory provisions to the contrary, the following general retention periods shall apply:

a. SingleKey ID: Deletion with deletion of the SingleKey ID user account.

b. User master data: Deletion as soon as the local user account or the central BSH account is deleted.

c. Appliance master data: Removal of link to the user account upon removing the household appliance from the user account.

d. Appliance usage data: User-specific storage for a period of thirty (30) days. Afterwards storage in pseudonymized form (in a special database using a pseudonymisation algorithm) and provision in personalized form for services and/or repair services provided via the App or by on-site / repair service (e.g. proactive or reactive maintenance/troubleshooting, if available) for the duration of the validity of the contract or (if the function can be disabled) for the duration of the activation of the function. Furthermore, in pseudonymized form based on our legitimate interest, as long as our legitimate interest prevails, afterwards, in anonymized form. Insofar as you have shared content with third parties, this is not deleted, but remains on the appliance and/or end devices of the third parties with whom you have shared the content.

e. App related usage data and app download origin data: Storage in pseudonymised form and provision in personalized form for services/messages provided via the App to the extent that the "Enable usage-data tracking" function is activated. Deactivating the function resets the individual ID used for tracking, so that App usage data already collected can no longer be connected to you.

f. Name, contact details and device master data (including customer service transaction data): Stored in personal form for a period of 30 years in a separate "Safety Action" database, held there solely for these purposes, e.g., to conduct product recalls.

If you sell the home appliance, please note that you must reset your home appliance to its factory settings before deleting the SingleKey ID or the app. If you have allowed the use of a home appliance together with another app user who does not use his own account, the deletion of your account also triggers the deletion of the other user. If you have allowed the use of a home device together with another app user who uses his own account, please note that the deletion of your account does not trigger the deletion of the additional user at the same time. If you do not want the other user to be able to continue using the home appliance via the app, please also arrange for the deletion of the other user. If such deletion does not take place, the previously collected appliance master data and appliance usage data will remain available for the additional user.

4. Data processing management

a. Connectivity of your household appliance

You can use the App to manage the connectivity of your household appliance:

• If required and if your household appliance provides for this function, you can set up the connection to the Home Connect server in such a way that each household appliance is connected separately (menu item Appliances → Settings). After doing this:

– the appliance usage data (1.c.) will no longer be transmitted to the Home Connect server; if your home appliance is equipped with buffer memory, the appliance usage data will be transmitted to the Home Connect Server in the event that the Wi-Fi connection of your household appliance to the Home Connect Server is restored;

– certain App features will no longer be available; in particular the App cannot be used to operate the household appliance, even if an internet data link is set up.

• If desired, you can switch off the Wi-Fi connection for an individual household appliance (menu item Appliances → Settings). After doing this:

– the appliance usage data (1.c.) will no longer be transmitted to the Home Connect server; if your household appliance is equipped with a buffer memory, the appliance usage data will be transmitted to the Home Connect Server, in the event that the Wi-Fi connection of your household appliance is restored.

– the household appliance may only be operated from the appliance itself, not via the App.

b. User accounts and local App data

You can manage your user accounts via the App and delete locally stored App data.

• You can delete your user account ("Profile" → "Personal Information" → "Delete account"). After doing this:

– the connection between your household appliance and your user account will be deleted,

– your household appliance will no longer send any appliance usage data to the Home Connect server provided no other user accounts are linked to the household appliance (see item 1.a. above).

• By deleting the App or using the “Full reset”-function, all locally stored user-related data will be removed, but not the accounts which were created separately.

• If you use the SingleKey ID, the SingleKey ID account will be deleted via the SingleKey ID functions, whereby in addition to the SingleKey ID itself, individual linked applications can also be deleted. If the SingleKey ID is the only access mechanism to the app/to the central BSH user account, the deletion of the SingleKey ID may make access to the linked services impossible. Therefore, before deleting the SingleKey ID, please check if you still have linked applications/user accounts.

• To delete the central BSH user account, please use the function provided in the account.

• Some features of the App do not store user-related data locally. You can have such data deleted by reaching out to the Home Connect Service Hotline or (possibly at a later date) by using the corresponding function in the App.

• The content you uploaded to the Home Connect app (in particular recipes, recipe images). If you have shared content with third parties, this content will remain on the third party's appliance even if you delete the data locally.

c. The household appliance's factory settings

You can reset your household appliance to its factory settings. After doing this:

•

You can reset your household appliance to its factory settings. After doing this:

• the household appliance will lose its connection to the Home Connect server due to the network settings being reset,

• the household appliance will no longer be linked to any previously associated user account (requires the household appliance to be connected to the Internet) and it will not be displayed in the App

• and all contents stored on the household appliance will be deleted.

Please read your household appliance's user manual before restoring the factory settings.

5. Transmission or disclosure of your data (e.g., to third parties)

Information Disclosed to With Our Service Providers

We work together with various service providers to create and run the App and provide the respective services. To the extent that we have bound these service providers to process data in line with strict instructions in their capacity as data processors on our behalf, any data processing activities undertaken by such providers shall not require your consent.

The service providers we have commissioned to create and run the App:

• Service providers for hosting services

• Service providers for programming services

• Service providers for hotline services (also if performed via a chat-function or similar communication channels) and other App services

We transmit your data to other recipients where necessary to fulfil a contract with you or between you and the third party, where we or the recipient has a legitimate interest in the disclosure of your data, or where you have given your consent to that transmission. These recipients include service providers and other companies within our corporate group. Furthermore, data may be transmitted to other recipients in the event that we are obliged to do so due to legal provisions or enforceable administrative or court orders.

Other recipients of your data are especially such service providers whose offers and services (third-party services) can be used in connection with the App or where the App enables access to such services (see item 10).

Content, especially recipes, which you have created yourself, may also be transmitted to other BSH companies (also internationally) within the scope of technical processing and provision of the content/services. We base such transmission/processing on data protection agreements between the BSH companies involved, which also include the application of standard contractual clauses, insofar as the transmission includes a country outside the scope of the GDPR and if it’s not a case of Art. 45 GDPR.

Information Disclosed in Connection with Business Transactions

We may disclose PI to a third party in the event of reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any of our business, assets, or stock, including in connection with bankruptcy or similar proceedings.

Information Disclosed for Our Protection and the Protection of Others

We may disclose your PI if legally required to do so, pursuant to a request from a governmental entity, or if we believe in good faith – after considering your privacy interests and other factors – that such action is necessary to:

1) Conform to legal requirements or comply with legal processes (including subpoenas);

2) Enforce or apply our terms of use and other agreements, including for billing and collections purposes;

3) Protect our property rights, rights and safety or property, rights and safety of a third party, our affiliated companies, or the public in general; or

4) Stop any activity that we consider illegal, unethical, or legally actionable.

Information Disclosed in an Aggregated or Anonymized Manner

We may also share information about our App with our partners and other third parties so that they can understand you and how you use our App in order to serve advertisements to our sites or other sites with which we have a business relationship. However, such information is not considered Personal Data because it is anonymized and aggregated in such a way that it cannot reasonably linked back to you.

Information Disclosed to Others in Accordance with Your Preferences

We may disclose such PI to third parties if you consent to such disclosure. For example, when configuring your profile, you may have the option to indicate that you would like to receive information about the opportunities, products or services of third parties.

Also, you have the option to connect your Home Connect appliance (via your Home Connect account) with various compatible third-party services, such as Amazon Alexa, Fit Bit, Side Chef, and others. If you voluntarily decide to connect your Home Connect appliance (via your Home Connect account) to such third-party services, then we will disclose your data to such third party for the purposes of carrying out the requested services in accordance with your decision to connect. Please note that your use of third-party services is governed by such third party’s privacy policy, whose practices may differ from Home Connect. We encourage you to review such third party’s privacy policies for information about their practices.

6. Location of processing and information

Personal Information collected in accordance with this Privacy Policy may be transferred to, processed in and stored in the following jurisdictions: United States, all member states of the European Union. The privacy laws in such other jurisdictions may differ from U.S. privacy laws and your Personal Information may be accessible to governmental authorities, law enforcement authorities, or the courts.

Should you relocate your Appliance outside of the U.S. or use the App outside of the U.S., you may be subject to different terms of use and a different privacy policy or data protection statement.

7. Recording of App related usage

Data on App related usage can be recorded by the App (see item 1.d. above) where, depending on your country of residence and operating system, your consent is obtained accordingly or you have the option to change consent once it has been activated, as described below. For the recording of App related usage data, the following Analytics services are used, which is offered by

• Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland (hereinafter "Adobe")

• Adjust Tools by Adjust GmbH, Saarbrücker Str. 37a, 10405 Berlin (hereinafter „Adjust“).

• Thunderhead Analytics by Thunderhead Ltd., 5th Floor, Ingeni Building, 17 Broadwick Street, Soho, London W1F 0DJ (hereinafter “Thunderhead”).

• Optimizely Inc., 631 Howard Street, Suite 100, San Francisco, CA 94105, United States, (hereinafter “Optimizely”).

If the "Enable usage-data tracking" function is activated, App related usage data will be sent to and stored on servers of providers located in the European Union. The App related usage data enable you to analyse how you use the App and provide messages (inApp or email) to you for services provided via the App (see item 1.d. above). IP anonymisation is activated for this App, which means that the IP address you use is truncated before being sent to the server. The analytics providers will use this information on behalf of Home Connect to evaluate how you use the App, generate error reports and to prepare reports on App activity for Home Connect. A/B and multi-variant tests are performed on our behalf by Optimizely. For this purpose, app-related usage data is collected, transmitted to a server of Optimizely and stored and processed there. Such analysis serves as a basis for us to improve the app itself, to better understand and improve app usage and the connection of home devices, but also to provide contextual content in the app and on websites you use. In order to provide contextual content, we build typical usage profiles (so-called "audiences") that enable us to provide such content in a way that is appropriate for you. IP addresses transmitted from your mobile device and other Personal Information within the context of the aforementioned analytics activities will not be merged with other data held by analytics providers or Home Connect without your consent given separately.

You can control whether or not App related usage data (incl. your IP address) is recorded and processed by one of the abovementioned providers by activating or deactivating this in the personal settings within the app or in the corresponding system menu of your mobile device. Depending on the legal situation in your country, the analytics and/or tracking function may be activated by default, but you may change these settings to your personal preferences.

In addition, error reports from the app can be sent to us so that we can take concrete measures to eliminate such errors. These fault reports are used on a personalized basis to analyze and correct the error in the event of a specific error report from you. Without direct personal reference, error reports are used to eliminate errors in general for all users of the app and to avoid future errors as far as possible.

If covered by a separately declared consent (e.g. a marketing consent given by you via the website), we may also use the app-related usage data within the scope of this consent to personalize the corresponding (marketing) communication to you and your interests. In the context of such consent, we also inform you in each case about such possible use.

8. Error reports

We use tools (e.g. Visual Studio App Center (https://appcenter.ms) to collect and send anonymous error reports if the App performs as not intended and/or behaves in an unexpected way, especially if the App crashes. Our service providers and Home Connect shall receive error reports only with your explicit consent. We shall ask for your consent each time we wish to transmit such information.

9. Data security

We deploy reasonable technical and organizational measures to protect your data, for example, from manipulation, loss and unauthorised third-party access. These measures include the use of encoding technologies, certificates, firewalls on the Home Connect servers and password protection in the Home Connect App. The data security level of the Home Connect App has been tested and certified by TÜV Trust IT. We are constantly reviewing and improving our security measures in accordance with technological advancement. However, please not that no method of transmitting data over the internet is 100% secure and we therefore cannot guarantee the absolute security of the Personal Information that we maintain.

If your mobile device is sold or passed on to a third party, make sure to first log out of your Account and delete the App. It will then no longer be possible to (re)assign the mobile device to your user ID or Appliance. If you sell the Appliance, be sure to restore the factory settings. This will sever the link between the Appliance and your Account.

If you purchase an Appliance that was previously owned by another user, check the Account settings in the App to make sure that no unknown users are linked to the Appliance. In case of doubt, be sure to restore the factory settings to protect your Personal Information.

10. Scope of application of the data protection information

This data protection information shall apply for the functions and services offered by Home Connect via the App. Insofar as additional functions or services are offered within the App by Home Connect or a BSH Group company, special information on data protection is provided, insofar as their use is subject to special data protection regulations or information.

However, this data protection information shall not apply for third-party services, even if Home Connect facilitates the use of and/or access to such third-party services in the App (such as video files available on the App). The use of such third-party services is governed by the prevailing data protection provisions put in place by the third-party service provider and, if applicable, additional data protection information on our part which outline the distinctive features of these third-party services and shall only be relevant in this regard.

If you are referred to another service provider, Home Connect shall make reasonable and appropriate efforts to elucidate such referral (e.g. by embedding the service provider's content within the App using inline frames) if such referral is not clear. If you click on a link in the Home Connect App which calls up an app or website of another service provider, this is considered to be a clear referral.

Please note that your use of third-party services is governed by such third party’s privacy policy, whose practices may differ from Home Connect. We encourage you to review such third party’s privacy policies for information about their practices.

11. Multiple Users

The Home Connect App may be used by multiple users, as set out in the Terms of Use. The data sent to Third-Party Service Providers may contain Appliance Usage Data pertaining to the usage behaviour of other Appliance users.

12. Children

The Home Connect App is for use by persons that are at least 18 years old. We do not collect Personal Information from a person under 18. If we discover or are notified that we have collected Personal Information from a person under 18, we will delete that information from our systems.

13. Changes to the Privacy Policy

As the App and the services provided via the App continues to undergo development – among other things, through the implementation of new technologies or the introduction of new services – this Privacy Policy may need to be adjusted accordingly. Home Connect shall reserve the right to amend or supplement this Privacy Policy, as required, by publishing a new version here. Home Connect will always update the Privacy Policy in the App; it is your responsibility to familiarize yourself with the latest version, and by continuing to use the App, you are deemed to consent to any such changes in the Privacy Policy.

14. Rights and contact information

If, despite our efforts to only store data which is correct and up-to-date, your personal details are stored incorrectly, we shall correct such information upon your request. After giving us your consent for the collection, processing and use of your Personal Information, you may withdraw such consent at any time with effect for the future. Consent may generally be withdrawn using the respective App setting or otherwise through the contact information referred to in the App. However, such revocation of consent will result in reduced functionality of the App and/or prevent you from using the App altogether. With your consent, we may send promotional push notifications or alerts to your mobile device. You can elect to stop receiving these messages at any time by changing the notification settings on your mobile device.

Please bear in mind that, for technical or organizational reasons, there may be an overlap between you withdrawing your consent and your data being used, e.g. in the case of a newsletter which has already been sent out. Data required for billing and accountancy purposes or which are subject to the legal duty to preserve records are not affected by this.

Should you have any questions on the topic of data protection or should you wish to exercise your rights to withdraw consent or to information, rectification, deletion or suspension, please contact us using the contact information provided in the App.

15. Notice to California Residents

If you are a California resident who has provided Personal Information to Home Connect, or a California resident that reasonably believes that Home Connect collected or stores your Personal Information, you may exercise your rights under the California Consumer Privacy Act and the California Privacy Rights Act (collectively “CPRA”) and submit your requests in one of the following methods: (a) by submitting this form (link is https://datarequest.bsh-group.us/en/form?c=us), (b) by emailing bsh-us-dataprotection@bshg.com

(please include your name, address, and phone number or email in all communications and state clearly the nature of your request), or (c) by calling our toll free number at (855) 769-1755.

NOTE: we do not sell or share your Personal Information as that term is defined in CPRA or under Nevada Law (Section Chapter 603A of the Nevada Revised Statutes). Given that we neither “sell” nor “share” Personal Information for CPRA purposes, we do not provide a mechanism to opt out of such disclosures pursuant to CPRA.

You have the following rights under the CPRA:

• Right to request to know about Personal Information in accordance with CPRA:

(1) The categories of Personal Information BSH has collected about you;

(2) The categories of sources from which the Personal Information was collected;

(3) The business or commercial purpose for which it collected your Personal Information;

(4) The categories of third parties to whom BSH discloses Personal Information;

(5) The specific pieces of Personal Information BSH has collected about you.

• Right to request deletion of your Personal Information

You may also request that we delete any Personal Information that we have collected from you, provided that we may retain Personal Information as authorized under CPRA, including, but not limited to, retaining Personal Information necessary to provide our Services, detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, debug to identify and repair errors that impair our App, enable solely internal uses that are reasonably aligned with your expectations based on the your relationship with us, comply with a legal obligation or otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided it.

• Right to request correction of inaccurate Personal Information maintained by BSH in accordance with CPRA.

• Right of no retaliation. We will not discriminate against you If you decide to exercise one of the rights listed above.

To the extent we collect any Sensitive Personal Information (as such term is defined under CPRA), please note that we do not use your Sensitive Personal Information for purposes other than those set forth in Modified Proposed CPRA Regulations § 7027.

In order to submit a request, we will need to verify your identity by using commercially reasonable means. If you have an account with us that is password-protected, we may verify your identity through our existing authentication practices for your account. If you do not have an account with us, we may request from you two or more data points of personal information to verify your identity.

If you are a member of a household making a request, you represent that you have the right to request information relating to said household. We may also individually verify all members of the household before responding to a request.

Please note that following your verified request, we will send you your Personal Information from the following email address: bsh-us-dataprotection@bshg.com (Any response to your request, including any Personal Information may be sent as an encrypted file).

Please note that once you have submitted a request, we will send you a receipt, acknowledging your request, within 10 days. If, for some reason, you do not receive such a receipt within 10 days of your submitted request, please send us an email to bsh-us-dataprotection@bshg.com as an error may have occurred.

We will process and respond to your request within 45 days after it is received (in some cases, as is allowed under the CPRA, this process may be extended by an additional 45 to 90 days).

We will process and respond to your request within 45 days after it is received (in some cases, as is allowed under the CPRA, this process may be extended by an additional 45 to 90 days).

As a California resident, you also have the right to designate an agent to exercise these rights on your behalf. We may require proof that you have designated the authorized agent to act on your behalf and to verify your identity directly with us. Please use this form (link is https://datarequest.bsh-group.us/en/form?c=us) or contact us at bsh-us-dataprotection@bshg.com for more information if you wish to submit a request through an authorized agent.

Notice of Information We Collect

Pursuant to CPRA, this serves as notice of the categories of Personal Information that we collect through the App and the specific commercial purposes for which the Personal Information was collected. Please see Section 2 for the specific commercial purposes for which Personal Information was collected, and Section 3 for the general retention periods of such collected Personal Information.

Please note that all of the categories of Personal Information we collect about you (as detailed below) come from the following categories of sources:

• You, including through your use of our services

• Automatically collected from you

• Our affiliate companies

• Third parties

In particular, the App has collected the following categories of Personal Information from California consumers within the last twelve (12) months:

• Contact Information: such as your name, and email address;

• Device Information: information regarding your BSH device as well as the type of device on which the App are used or downloaded, the operating system name and version of the device used to access the App, device manufacturer, App version accessed on your device, device ID, IP address, and geolocation data.

• App usage data: information related to your in-app preferences such as preferred language, purchase history, device history, and maintenance history.

• Demographic Information: including your zip code or postal code, age, preferences, gender, race or ethnicity, interests and favorites.

Categories of Personal Information that have been disclosed for a business purpose

In the past 12 months, we have disclosed the following categories of Personal Information for a business purpose to the third parties listed below:

16. Special Notice to Colorado, Virginia, Utah, and Connecticut Residents

This section describes the Personal Information we collect or process about Colorado, Virginia, Utah and Connecticut residents and describes your rights pursuant to the Colorado Privacy Act, Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, Connecticut Data Privacy Act.

In the last 12 months, we have not sold Personal Information collected in and through the App. Likewise, we also do not process Personal Information for advertising purposes. Consequently, we do not have such opt-out functionality on our App.

Your Rights

Under Colorado, Virginia, Connecticut, and Utah law, users who are residents of these states have specific rights regarding their Personal Information. These rights are subject to certain exceptions described below. When required, we will respond to most requests within 45 days unless it is reasonably necessary to extend the response time. Subject to certain limitations, you have the following rights:

Right of access: You have the right to confirm whether we process your PI and request to access to such PI.

Right to Deletion: You have the right to request that we delete the Personal Information we have collected about you.

Right to Data Portability: You have the right to request that we provide you with your Personal Information in a portable format.

At this time, we do not process your PI for purposes of targeted advertising, the sale of PI, or profiling in furtherance of decisions that produce legally or similarly significant effects concerning a consumer, and therefore, such opt-outs are not available.

Colorado, Connecticut, and Virginia only:

Right to Correction: You have the right to correct inaccuracies in your Personal Information.

How to Exercise these Rights

You may submit a verifiable consumer request to us for disclosure or deletion of Personal Information by contacting us at bsh-us-dataprotection@bshg.com, or submitting a request at https://datarequest.bsh-group.us/en/form?c=us.

Alternatively, you may call us at our toll free number at (855) 769-1755.

We will respond to verifiable requests for disclosure or deletion of Personal Information free of charge, within 10 days of receipt.

In the event that you are unhappy with the outcome of your request to exercise one of your rights above, you may appeal our decision by contacting us at the location listed below. Within 45 days of receiving your appeal, we will review your file and inform you of our decision with a written explanation of our conclusion. In certain circumstances, we may require an additional 45 days to process your appeal. We will inform you of such extension within the initial 45-day window.

17. Contact Us

You may address all communications to bsh-us-dataprotection@bshg.com or call our toll-free number at 855-769-1755. Please include your name, address, and phone number or email in all communications and state clearly the nature of your request.

You may also direct a complaint concerning compliance with the Privacy Policy to the US Data Protection Officer. The complaint must be in writing. Within a reasonable time of receipt of the complaint, an investigation into the complaint may be conducted depending on the nature of the complaint. The format of this investigation will also vary depending on the circumstances and the nature of the complaint.

After any investigation into the complaint, Home Connect may take appropriate measures necessary to rectify the source of the complaint if it is necessarily required.

Date of issue: February 26, 2024