Privacy Policy and Terms and conditions

LYNX SERVICE TERMS AND CONDITIONS OF USE

1. General:

The user hereby agrees to the following Terms and Conditions of Use (the “Agreement”) governing their use of the LYNX online service developed, operated and maintained by BANDALUX INDUSTRIAL, S.A. (“Bandalux”), which can be accessed from https://lynx.bandalux.com (or website address or IP address expressly related to the service), hereinafter referred to as the “Website”. If the user accepts this Agreement on behalf of a legal entity or company, they acknowledge that they have the authority to bind that entity and all users belonging to that entity.

Any reference to “us”, “our”, “LYNX” and “Bandalux” in this document refers to BANDALUX INDUSTRIAL, S.A., with Tax ID Number A08999161 and registered office at Polígono Industrial A Fieira, nave 1, Moraña, Pontevedra, and its affiliated entities. Any reference to “the user”, “user”, “subscriber” and “end user” in this document refers to the subscriber of the “Service”. BANDALUX may periodically make changes to these Terms and Conditions of Use, which will be accessible through the Service. It is the user’s responsibility to frequently check this document and be informed about any changes. If any changes are made to the Terms and Conditions of Use that we believe may affect the user, we will notify you by e-mail or through the App.

The Service includes an interface to an application, data encryption, transmission and secure data access and storage. The first time the user accesses the Service, the user, through a specific action, should consult and accept the Terms and Conditions of Use of the Service, as well as the Privacy and Security Policy. If you do not accept both documents, you will not be able to use the service.

2. Definitions:

“Agreement” refers to the Terms and Conditions of Use of the Website, “Content” means audio-visual information, documents, software, products and services available when using the Service. “User data” means any data, information or material sent or provided by the user or the security service provider to Bandalux or sent from your home or company devices electronically linked to the Service. Bandalux refers to BANDALUX INDUSTRIAL, S.A., with registered office at Polígono Industrial A Fieira, nave 1, Moraña, Pontevedra (Spain), Tax ID Number  A08999161. “Bandalux Technology” refers to all Bandalux technological property (including software, hardware, products, processes, algorithms, user interface, know-how, techniques, designs and other tangible or intangible material or information) that the user can access through the Service. “Service” means the online service ‘LYNX’, developed, operated and maintained by Bandalux and which can be accessed through https://lynx.bandalux.com.

“User(s)” means the person(s) authorized to use the Service who have been provided with a user ID and password.

3. LYNX license for use:

The LYNX service is owned by Bandalux, which only grants the user a non-exclusive, non-transferable license and the right to use the Service throughout the world, solely for own use and subject to the terms and conditions of this “Agreement”.

All rights not expressly granted to the user are reserved to Bandalux. The use of the Service shall only be permitted for users with a password. The user shall refrain from revealing and allowing third parties access to the Service.

The user shall not access the Service if they are a direct competitor of LYNX without the prior written consent from Bandalux.

The user may not access the Service for the purpose of monitoring availability, studying its performance or functionality, or for any other activity for competitive purposes against Bandalux.

Unless the user has a written consent of Bandalux, this license does not grant you the ability to (i) sell, transfer, assign, distribute or commercially exploit or make available the Services or the content in any way to any third party; (ii) create links to the Service; (iii) modify or create works based on the Service or its content; or (iv) carry out reverse engineering or access the Service for the purpose of (a) creating a product or Service that is in competition with LYNX, (b) create a product using ideas, features, functions or graphics similar to those of the Service, or (c) copy ideas, features, functions or graphics from LYNX Service, images or icons.

The user may use the Service only for their own purposes and may not: (i) send spam or otherwise duplicative or unsolicited messages in violation of applicable laws; (ii) send or store infringing, obscene, threatening, libelous, or defamatory content, any other criminal material, including material harmful to children or that violates third party privacy rights; (iii) send or store material containing software viruses, worms, Trojan horses or other harmful computer codes, files, scripts, agents or programs; (iv) interfere with the integrity or operation of the Service or the data contained therein, or (v) attempt to gain unauthorized access to the Service or its related systems or networks.

The rights granted to the user in accordance with the provisions of this “Agreement” extend to any updates or new versions that replace and/or complement the Service, unless the corresponding update or new version contains its own Terms and Conditions of Use.

4. User responsibilities:

The user is responsible for all activity that occurs under their user account, and must comply with all local, state, national and foreign laws, treaties and regulations regarding the use of the Service, including those related to data privacy, international communications and the transmission of technical or personal data. The user shall: (i) notify Bandalux immediately of any unauthorized use of their password or account or any breach of security; (ii) notify Bandalux immediately, and use reasonable means to instantly stop any illegal copying or distribution of content; (iii) not impersonate another user or provide false identity information to obtain access to or use of the Service.

5. User account information and data security:

Bandalux does not own any data, information or material that the user uploads to the Service while accessing it (“User data”).

As data controller, Bandalux is responsible for implementing the necessary technical and organizational security measures to ensure the security of the data processed.  In any case, they must implement mechanisms to:

1. Guarantee the confidentiality, integrity, availability and durability of the processing systems and services.
2. Restore the availability and access to personal data quickly in the event of a physical or technical incident.
3. Regularly verify, evaluate and assess the effectiveness of the technical and organizational measures implemented to guarantee the security of the processing.

However, it is the user who is responsible for the accuracy, quality, completeness, legality, reliability, appropriateness, and intellectual property or right of use of their data.

6. Intellectual Property:

Bandalux is the owner of all rights, titles and interests, including all intellectual property rights, related to the platform, the content and the Service, as well as any suggestions, ideas, enhancement requests, comments, recommendations or other information provided by the user or any other party related to the Service. This “Agreement” is not a sale and does not grant any ownership rights related to the Service, the technology or the intellectual property rights of Bandalux. The Bandalux name and logo and the names of products related to the Service are brand names belonging to Bandalux or third parties, and no rights or licenses are granted for their use. Any form of exploitation, reproduction, distribution, modification, public communication, transfer or transformation or any other form of dissemination of the information or elements contained in the Service mentioned in this section, by any support and means, and not expressly and previously authorized by their respective owners, is strictly prohibited. The content of the Service’s website may be downloaded to the user’s terminal or device provided it is for private and non-commercial use.

7. Third party providers of external services:

The LYNX service is based on enControl technology owned by the company AMPER S&C IoT, S.L., (hereinafter S&C) with which Bandalux has signed a distribution and service management contract that includes confidentiality and personal data protection annexes. The user is aware that their data shall be transferred to S&C in order to carry out the management of the service and provide third level support, when necessary.

While accessing the Service, the user can enter into correspondence with third party Services through the specific channels offered by the Service. Any activities, and all the terms, conditions, warranties or representations associated with such activities, are exclusively between the user and said third parties. Bandalux shall have no responsibility or liability for any correspondence, purchases or promotions between the user and such third parties.

Bandalux shall not be liable for Internet websites that are linked through the Service. Bandalux provides these links only for convenience purposes, and in no event is responsible for any content, products or other materials available through such sites.

Bandalux provides the Service in accordance with the Terms and Conditions of this Agreement. The user acknowledges that third party providers of software, hardware, or services may require acceptance of additional or different licenses or other terms of use prior to accessing such software, hardware or services.

8. International Use:

In recognition of the global nature of the Internet, the user agrees to comply with local laws on conduct and content. Please note that the information published on the Website may refer to products, programs or services that are not available in your country. Contact directly with Bandalux through support.lynx@bandalux.com to obtain information about products, programs and services that may be available to you in your country.

This Website is controlled, operated and managed by Bandalux from its facilities and its contractors within the EU.

9. Compensation:

The user shall compensate Bandalux, affiliates, officers, directors, employees, attorneys and agents from and against any and all claims, costs, damages, losses, liabilities and expenses (including attorneys’ fees) arising out of or in connection with: (i) a claim alleging that the use of the data by the user infringes the rights of or has caused damage to a third party; (ii) a claim, which if true, would constitute a violation by the user of their rights and guarantees; (iii) a claim arising from a breach by you of this Agreement, provided, however, that Bandalux: (a) notifies you in writing of the indictment promptly; (b) gives you control of the defense over the prosecution (provided that you do not settle or plead any claims, unconditionally releasing Bandalux from all liability; (c) provides you with all available information and assistance.

10. Waiver of guarantees:

Bandalux does not guarantee the reliability, promptness, quality, suitability, truthfulness, availability, accuracy or completeness of the Service or its content.

Bandalux does not guarantee that:

1. a) The use of the service is safe, fast, uninterrupted or error-free by itself or in combination with any other hardware, software or data system.
2. b) The service shall meet your needs or expectations.
3. c) That the stored data is accurate or reliable.
4. d) That the quality of any product, service, information or other material purchased or obtained by you through the Service shall satisfy your needs or expectations.
5. e) That errors or defects shall be rectified.
6. f) That the Service or the servers that offer the service shall be available at all times and free of errors.

The Service and all content is provided to you strictly “As is”. The user waives all conditions, statements and guarantees, whether express or implied, statutory or otherwise, including, but not limited to, marketing assurance, fitness for a particular purpose and infringement of third party rights, to the fullest extent permitted by law.

11. Internet and electronic communications:

The service may be subject to limitations, delays and other problems inherent to the use of the Internet and electronic communications. Bandalux shall not be liable for delays, delivery failures or any other results inherent in the use of the Internet and electronic communications.

12. Limitation of liability:

Under no circumstances shall Bandalux be liable for any direct or indirect, punitive, special, exemplary, incidental, consequential damage or harm of any kind whatsoever, (including loss of data, revenue, profits, use or other financial benefits) arising from or in any way connected to this Service, including but not limited to the use or inability to use the Service, or any content obtained through the Service, any interruptions, inaccuracies, errors and omissions, regardless of the cause, even if Bandalux has been warned of the possibility such damage may occur.

13. Notifications:

In the event Bandalux needs to communicate with the user, it shall do so through the user’s contact information or through the App.

The user may contact Bandalux at any time by sending an e-mail to support.lynx@bandalux.com.

14. Modifications of the Terms and Conditions of Use:

Bandalux reserves the right to modify the Terms and Conditions of Use at any time and shall inform the user about the changes made through an e-mail or through the application.

15. Applicable law and jurisdiction

The Terms and Conditions are subject to Spanish law. For the resolution of any dispute that may arise from access to the Service, the user and BANDALUX expressly agree to submit themselves to the courts of the city of Barcelona, waiving any general or special jurisdiction to which they may be entitled.

LYNX SERVICE PRIVACY AND SECURITY POLICY

1. Purpose, data controller and scope of application:

This document outlines the Privacy and Security Policy applied by BANDALUX INDUSTRIAL, S.A. when it collects, uses, consults or processes the user’s personal data in the context of the service marketed under the LYNX name. Therefore, it shall not apply when the information is obtained: (1) offline, (2) by means other than through the service, or (3) through any other source.

This Policy should be read in conjunction with the Service Terms and Conditions of Use.    The data controller is:

BANDALUX INDUSTRIAL, S.A. (also the provider)

Tax ID Number: A08999161

Address: Polígono Industrial A Fieira, nave 1, 36660 Moraña, Pontevedra (Spain)

E-mail: rgpd.lynx@bandalux.es

BANDALUX INDUSTRIAL, S.A., as the party responsible for the service and the associated Website, in accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (GDPR)  on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and other current legislation on the protection of personal data, and under Law 34/2002 of 11 July 2002 on Information Society Services and Electronic Commerce (LSSICE), informs you that it has implemented the necessary technical and organizational security measures to guarantee and protect the confidentiality, integrity and availability of the data entered.

One of the obligations of the LYNX service (the “Service”) is safeguarding user privacy, including personal/private information (“Personal Information”), and installation information (“Installation Information”). This document informs you about the privacy and security issues covered by the “Service” and notifies you of the information that is stored when you use the “Service” via the website https://lynx.bandalux.com (or website address or IP address expressly related to the Service) hereinafter referred to as the “Website”. In this document we inform you of our reasons for storing such information and how we use it.

In order for you to enjoy the “Service”, you must first accept the terms contained in this document, in addition to the Service Terms and Conditions of Use (specified in a separate document). If you accept this Agreement on behalf of a legal entity or company, you acknowledge that you have the authority to bind that entity and all users belonging to that entity. The “Website” can be accessed directly from the application or through your Gmail account.

 Any reference to “Bandalux “, “us”, “our”, “LYNX”, “Service provider” and “provider” in this document refers to the provider of the “Service” (data controller) and its affiliated entities. Any reference to “your”, “you”, “yours” and “user” in this document refers to the subscriber of the “Service”.

Bandalux reserves the right to modify and update the Privacy and Security Policy. We shall inform you of these changes if they involve a substantial change in data processing, if they are relevant to the nature of the processing, or, when they are relevant to you and affect the correct protection of your data. The notification will be made by e-mail o through the App.

2. Information collected and purpose

Through its “Service”, Bandalux processes your personal data for its own use. The legal basis for the processing is the consent obtained during the subscription process or, in the case of analytics data from anonymized apps, the consent obtained during the onboarding process.

LYNX collects and gathers “Personal Information” and automatically receives and stores information on its servers from your web browser, including, but not limited to, your IP address, cookie information, the page you view on the “Website”, the use of the “Website”, and events from security devices linked to LYNX.

When the user accesses the “Service”, the LYNX servers generate and store information on the activity of the “Website”: your IP address, the time spent browsing, the date and time of access, the pages visited and the type of web browser.

The “Personal Information” is necessary to create an account to access LYNX and consists of subscriber number, HW identifier, and an e-mail address. Other information related to the installation of sensors and actuators installed in your home/company is also stored (number of sensors and type, and their name and location, name of the areas of your home/company and map with location of the sensors (“Installation Information”). The user access to the “Service” and the password shall be issued by the provider of the “Service”, although you can change your password at any time. If you forget your password, you can obtain a new one through the “Website”. Personal data also includes third party tokens used to integrate with third parties, obtained during Amazon Alexa and Google Assistant integration set up.

LYNX stores the information/images sent from the devices installed in the home/company. The purpose is to provide information, in real time and historically, on key resources/elements within the home/company. These devices include, but are not limited to, temperature, brightness and presence sensors, and electronic control relays of electrical devices and circuits. The home/company can have any number and variation of these types of sensors installed, depending on their needs. When presence sensors are installed in the home/company, it must be taken into account that these devices cannot identify people. The information is stored encrypted on servers to maintain your privacy. Only the user is authorized to request information from their devices.

Bandalux requires the support of external service providers, who act as (sub)processors and who process your data on our behalf, under the instructions and authority of Bandalux. Bandalux enters into Data Processing Agreements with these external service providers, who agree not to disclose “Personal Information”, nor use it for any purpose other than those needed to provide services to Bandalux. Both your “Personal Information” and your “Installation Information” may be used by the external service provider and/or shared for exclusively technical purposes and to improve the “Service”. Data that is not traceable to homes or companies is used to manage the “Service” and the “Website” to monitor its use and to make improvements. Any non-identifiable information linked to your home or company may be used by third parties to provide service improvements to users. IPs are monitored and stored only as a measure to increase the security of the “Website” and the “Service”.

Bandalux will not transfer your personal data to others for marketing actions or any other purposes.

3. Legal basis for the processing

The legal basis for the data processing is your consent granted to carry out the purposes described above, which the user gives by checking the box to accept the Privacy Policy and the Terms and Conditions of Use. This procedure is carried out after you have downloaded the application and before you start using it.

Please note that you are under no obligation to provide information to Bandalux. Furthermore, you have the right to withdraw your consent at any time, in which case the “Service” may be limited.

In cases where there is a prior contractual relationship between the parties, the legal basis to fulfill administrative, fiscal, accounting and labor obligations necessary under current legislation shall be the prior existence of the commercial relationship established between the parties.

4. Recipients of data transfers

The provider shall not sell, transfer, share or use your “Personal Information” or your “Installation Information”, except in the cases contemplated in this Privacy and Security Policy document.

In the event that the provider is bought, absorbed, or related in any way to another company, or enters into bankruptcy, it may have to assign its “Personal Information” and/or its “Installation Information”. In the event of being obliged to share such information and/or any other information related to the “Service” by the newly formed company, the new company will be governed by this Privacy and Security document.

Bandalux informs you that the LYNX service is based on enControl technology owned by the company AMPER S&C IoT, S.L., which is in charge of third level technical support and therefore has access to your information. The data processing carried out by this entity is regulated by a data processor contract between Bandalux and this company. Under no circumstances shall the processor subcontract services involving any processing of data by third parties without the prior consent of Bandalux.

5. Protection of information related to your home or your company

The “Service” includes the reception of information on consumption values, time and environmental aspects of its installation, both from the measurement and control devices installed in the home/company and from external sources and the reception of event information from the security devices installed in homes/companies. All communication through a public communications channel dependent on the “Service” is securely carried out (encrypted).

In order to offer you support, employees of the provider, as well as third party companies, may need to access this information.

The provider stores the values and events of the devices connected to LYNX for a limited time. At the end of this period, all information is removed from our servers. Bandalux will store your data for up to one year after you close your account or, if you have not closed your account, for up to five years after your last use of the “Service”. Please note that once deleted, the information cannot be retrieved.

6. Security Measures

LYNX uses standardized secure communication technologies, including SSL (Secure Sockets Layer) technology and Website encryption (https). These measures are designed to protect your confidential information in electronic communications, thus minimizing the possibility of such information being captured and your identity or security being jeopardized. You can check that the communication through your browser is secure as the browser itself informs you of this. Passwords are stored in an irreversible encryption format.

 All “Personal Information” is stored on servers protected against unauthorized access by firewalls or other technological means. The servers are located in secure locations, and only the provider’s employees and related agents have access, when strictly necessary, to the “Personal Information” and “Installation Information”.

Bandalux cannot guarantee that all data transmissions over the Internet are 100% secure. To the fullest extent permitted by applicable law, the “Service” is provided “AS IS”. As a result, Bandalux is committed to protecting your personal data, but we do not offer any warranty, express or implied, with respect to the security or integrity of the user’s data. All implied warranties, including but not limited to, marketing assurance or fitness for a particular purpose are hereby disclaimed to the fullest extent permitted by law.

Affected users shall be notified as required by the GDPR in the event that personal information is compromised as a result of a security breach and when such breach is likely to pose a high risk to their rights and freedom.

7. Official means of communication

Bandalux shall send you information about important LYNX updates, notifying you by e-mail or through the App itself.

The provider of the “Service” shall keep all the information updated when it is submitted, and shall protect the privacy of the user by continually evaluating the application and nature of the Privacy Policy. If the information relating to the user changes, or an error is identified in the user’s records, the user may send an e-mail to rgpd.lynx@bandalux.es. The provider of the “Service” shall update the incorrect data as soon as possible. If you have any questions, comments or complaints regarding LYNX’s Privacy Policy, you may contact the Service provider at support.lynx@bandalux.com. The provider is not responsible for the unintentional or accidental disclosure of any “Personal Information” or “Installation Information”.

8. Geofencing

A  virtual  perimeter  (geofence)  is  a  circular  geographic  area  centred  on  a  given  location.  This  default location  is  the  location  of  the  home  installation.  IOS  and  Android  applications  will  notify  the  service when a user (their mobile) is crossing the boundaries of a perimeter.

The  iOS  and  Android  applications  configure  the  geofence  service  offered  by  the  operating  system,  by registering a specific latitude and longitude (which should coincide with  the one of the installation) and radius. The number of geofences that can be used is restricted by the service offered by the Android or iOS operating system.

The  operating  system  (phone)  will  notify  the  application  when  the  (phone)  enters  or  leaves  the perimeter.  The  application  does  not  obtain  phone  positioning  points,  it  will  only  receive  an  “entering perimeter  X”  or  “leaving  perimeter  Y”,  and  therefore  the  exact  location  is  never  being  sent  to  the Service. The  service  does  not  maintain  a  history  of  perimeter  entries  and  departures.  Only  the  last  notification sent.

The number of geofences is determined by the service offered by the Android and iOS operating system. Notice that Android may provide generic information about the APP in which the user is informed that the APP is accessing precise phone’s positioning (NETWORK and GPS). As stated before, our APPs do not access nor capture nor store GPS locations, just notify the Service when user crosses a given perimeter.

9. Cookies and related technology

“Persistent Cookies” are small data files that are stored by the web browser on the personal computer or mobile device used to access the “Website”. “Personal Information”, such as such as a password, shall never be stored. The user can configure their web browser with different options related to cookies. If you choose not to use all cookies, you will not be able to access all the pages of the “Website”. “Secure Session Cookies” are cookies that are only stored in temporary memory rather than on the hard drive, and are deleted when the web browser is closed. To offer secure access to the “Service”, a unique session identifier is created; this session identifier expires when the user exits the “Service” or when a period of inactivity is exceeded. We may use different technology and monitor navigation to capture anonymous information about access to the “Service”. This is to help us to continuously improve the “Service” we offer and the user experience. Cookies or other technology may be used by third parties to help us manage our marketing efforts more efficiently (for example, e-mail servers, analytical tools, etc.). We select these service providers and coordinate with them to ensure that only anonymous information related to “Personal Information” or “Installation Information” shall be shared with us.

10. Monitoring of the law

Bandalux may be required by the authorities to share your “Personal Information” and/or “Installation Information” in the event the provider is obliged by law to access said information.    In general, the provider shall also access your “Personal Information” or “Installation Information” if considered necessary: (1) to comply with the law or a legal process in which the provider or the “Website” or the “Service” is included; (2) to defend and protect the rights or properties of the provider; or (3) to protect the personal safety of users of the “Service” and/or the “Website”. Given that it is potentially possible to use the “Service” negligently, the provider reserves the right to offer the relevant authorities any information related to such abuse, including any illegal activity carried out through its user account.

11. Rights of the interested persons

As a user, you can exercise the following rights against Bandalux free of charge by sending an e-mail to rgpd.lynx@bandalux.es, indicating as Subject: “LOPD, ARCO Rights”, and attaching a photograph of your ID or any similar legal means, as indicated by law.

In particular, the user has the following rights:

• Right of access: for the interested party to know and obtain information about their personal data subjected to processing.
• Right of rectification or deletion: to correct errors and modify inaccurate or incomplete data.
• Right of cancellation: to delete inappropriate or excessive data.
• Right of opposition: for the interested party to object to the processing of their personal data or to stop it.
• Limitation of the processing: this entails flagging the personal data stored, with the aim of limiting its future processing.
• Data portability: to provide the data being processed to the data subject, so that they can transfer it to another controller, without hindrance.
• Right not to be subject to automated individual decisions (including profiling): right not to be subject to a decision based on automated processing that produces effects or significantly affects you.

As a user, you have the right to withdraw the consent given at any time. The withdrawal of consent shall not affect the legality of the processing carried out before said consent is withdrawn.

You also have the right to file a claim with the supervisory authority if you consider that your data protection rights may have been violated.

12. International transfer of information

All information on the “Website” or the “Service” are stored and processed in Europe. By using the “Service” and the “Website”, you consent that transfers of information may be made of your “Personal Information” or “Installation Information”, in a secure and encrypted manner, outside your country.

13. Third party practices

The information you send to a third party website that is linked to or from the “Website”, or any other information that the “Website” stores, is not subject to the privacy and security policy described in this document, but to the privacy and security policy, where applicable, of that website.

The provider shall not be liable for the practices, actions or policies of such companies, and shall not be liable for the content or privacy practices of such websites.

14. Measures regarding minors

The “Service” is not intended for use by minors. Bandalux does not knowingly collect or solicit the personal data of any person under legal age and does not allow such persons to register with the “Service”. If Bandalux becomes aware that it has collected personal data from a minor without the consent of their parent or legal guardian, it will take immediate action to delete that information.

15. Termination

If you stop using the “Service” or unsubscribe, we shall keep the information related to you only for the time necessary to comply with our commercial purposes and with the legislation in force at that time.

Your personal data will be deleted from the database, as well as from the backup copies, after the end of the period of retention legally established in each country.

In general, a data maintenance period of one year from the time you deactivate your account or five years (in case the account is not deactivated) from the last time you used the “Service” is established.

16. Applicable law and jurisdiction

The terms and conditions set out in this Agreement are subject to Spanish law. For the resolution of any dispute that may arise from access to the “Service”, the user and Bandalux expressly agree to submit themselves to the courts of the city of Barcelona, waiving any general or special jurisdiction to which they may be entitled.