Privacy policy

Dyness Europe BV Privacy Notice

Last updated 22 September 2026

 

This Privacy Notice explains how Dyness Europe B.V. collects and uses personal data in connection with the Dyness cloud platform and the related online device monitoring and maintenance services. It also explains the choices and rights available to individuals under the General Data Protection Regulation (EU) 2016/679 (GDPR).

Scope. This Notice applies to users of the cloud platform in the European Union. It does not apply to employment-related processing or to processing undertaken independently by installers, distributors, utility operators or other third parties under their own responsibility.

 

1.  Controller and contact details

Controller
Dyness Europe B.V.
Lisbaan 4A
2908 LN Capelle aan den IJssel
The Netherlands
Dutch Trade Register number 81521944

Data Protection Officer
Email: DPO@dyness-tech.com

You may use the DPO email address for questions about this Notice, the processing of your personal data or the exercise of your GDPR rights.

 

2.  Personal data we process

We process only the personal data described below in connection with the cloud platform. Equipment data fall within this Notice only to the extent that they can be linked to an identified or identifiable individual. This occurs where a device is registered to a user account or the equipment data are otherwise associated with an account holder, an authorised user or an installation address. Equipment data that cannot be linked to an individual are not personal data for the purposes of the GDPR.

· Account data: email address and, if you choose to provide it, telephone number.

· Installation data: installation address, if you choose to provide it.

· Equipment data: device identifiers and operating data generated by equipment registered to or otherwise linked with your account, including data used for online monitoring and maintenance.

 

3. Where the data come from

We obtain account data and optional installation data directly from you. Equipment data are generated by equipment linked to your account and transmitted to the cloud platform. If another authorised user enters data on your behalf, we receive those data from that user.

 

4.  Purposes and legal bases

We use personal data only for the purposes set out below. Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

 

Data	Purpose	Legal basis	What happens if not provided
Email address	Account registration, login and delivery of verification codes	Article 6(1)(b) GDPR - performance of our service contract	Required to create and access an account
Optional telephone number	Communications and account support where you choose to use this channel	Article 6(1)(a) GDPR - consent	Optional; core platform functions remain available without it
Optional installation address	Determining the relevant country and time zone for platform functions	Article 6(1)(a) GDPR - consent	Optional; some location or time-zone functions may need to be set manually
Equipment data linked to an individual through an account or installation	Online device monitoring, maintenance and related platform services	Article 6(1)(b) GDPR - performance of our service contract	Required to provide monitoring and maintenance functions
Relevant account and equipment data	Protecting accounts and the platform, managing authorised access and investigating technical incidents	Article 6(1)(f) GDPR - our legitimate interests in platform security and reliable service delivery	Certain security processing is necessary to protect users and the platform
Relevant data	Complying with binding legal obligations and lawful requests from competent authorities	Article 6(1)(c) GDPR - compliance with a legal obligation	Processing may be required by law

Our legitimate interests. Where we rely on legitimate interests, we process only the data reasonably necessary to maintain account and platform security, manage authorised access, prevent misuse and provide a reliable service. We consider the impact on users and do not rely on this basis where their interests or fundamental rights and freedoms override our interests.

 

5. Who can access personal data

Personal data are accessible only to the relevant user, other users authorised for the same account or equipment and authorised Dyness Europe B.V. personnel who require access for after-sales, operational or technical support purposes. Role-based access controls are used to limit the data and functions available to personnel.

We do not currently disclose the personal data described in this Notice to third parties for processing on our behalf. We may disclose personal data where required by applicable law, a binding court order or a lawful request from a competent authority, or where necessary for the establishment, exercise or defence of legal claims.

 

6. Storage and international transfers

Personal data relating to users in the European Union are stored on servers located in Frankfurt, Germany. We do not transfer those personal data to, or make them remotely accessible from, countries outside the European Union. If this arrangement changes, we will update this Notice and implement the safeguards required by Chapter V GDPR before the transfer takes place.

 

7.  How long we retain personal data

We retain personal data only for as long as necessary for the purposes for which they were collected. In determining the relevant period, we consider the duration of the user account and service relationship, whether the data remain necessary to provide monitoring or maintenance services, applicable legal retention obligations, security requirements and the time limits for bringing or defending legal claims.

· Account data are retained while the account remains active and are deleted or anonymised after closure when no longer required for the purposes described above.

· Optional telephone and installation data are deleted when consent is withdrawn, unless continued retention is required by law or for legal claims.

· Equipment data linked to an individual are retained while required to provide the relevant monitoring and maintenance services and are then deleted or anonymised when no longer necessary.

We periodically review retained personal data and delete or anonymise data that are no longer required. Data that have been irreversibly anonymised may be retained for statistical and service-improvement purposes because they no longer identify an individual.

 

8.  Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Personal information stored in the platform database is encrypted. Equipment operating data are stored in a dedicated time-series database. Access by after-sales and operations personnel is restricted through data permissions and role-based access control.

No method of transmission or storage is completely secure. You should protect your password and authentication information and notify us promptly if you suspect unauthorised access to your account.

 

9.  Cookies and similar technologies

The cloud platform may use cookies or similar technologies that are strictly necessary to provide requested functions, maintain user sessions and protect account security. If we introduce non-essential cookies or similar technologies, we will provide separate information about their providers, purposes and duration and, where required by law, obtain consent before activating them.

 

10.  Your rights

Subject to the conditions and limitations in the GDPR, you may ask us to:

· confirm whether we process your personal data and provide access to those data;

· correct inaccurate personal data and complete incomplete data;

· erase personal data;

· restrict processing;

· provide data that you supplied to us in a structured, commonly used and machine-readable format, and transmit those data to another controller where technically feasible;

· stop processing based on your particular situation where we rely on legitimate interests; and

· withdraw consent at any time where processing is based on consent.

The right to erasure and the other rights are not absolute. We may retain or continue processing data where permitted or required by law, including for legal obligations and the establishment, exercise or defence of legal claims.

To exercise a right, contact DPO@dyness-tech.com. We may request information reasonably necessary to verify your identity. We will respond without undue delay and in any event within one month after receiving the request. Where permitted by the GDPR, this period may be extended by two further months because of the complexity or number of requests; if so, we will inform you within the first month.

 

11.  Right to object

Where we process personal data on the basis of legitimate interests, you have the right to object on grounds relating to your particular situation. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

 

12.  Automated decision making

We do not use the personal data described in this Notice for decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

 

13.  Complaints

We encourage you to contact our DPO first so that we can address your concern. You also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement. In the Netherlands, the supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): www.autoriteitpersoonsgegevens.nl.

 

14.  Changes to this Notice

We may update this Notice to reflect changes in our services, processing activities or legal obligations. We will publish the updated version through the relevant website or platform and revise the date shown at the beginning. Where required, we will provide additional notice or request consent before a material change takes effect.