switchButler IoT (SBIOT) Privacy Policy

Version 1.1 — 16 September 2026 Document: sbiot-privacy · Effective from: 16 September 2026 · Change history: 1.1 contact form and spam prevention; 1.0 first edition

Basis: Swiss Federal Act on Data Protection (FADP, SR 235.1) and, where applicable, Regulation (EU) 2016/679 (GDPR).

1. Controller

The switchButler IoT (SBIOT) service is operated by Elbro AG, Gewerbestrasse 14, 8155 Niederhasli (ZH), Switzerland, UID CHE-107.927.973. Contact for data protection matters: info@elbro.com.

2. Principle of Data Minimisation

We process exclusively the technical, account and contact request data required to operate the service and handle requests (art. 6 FADP — proportionality). We do not collect data for third-party marketing purposes, do not sell personal data and carry out neither profiling nor automated individual decision-making.

3. Categories of Data Processed

Account data:

• first and last name, e-mail address, telephone number, preferred language;
• password hash (never the password in plain text);
• where acceptance is requested, timestamp and version of the acceptance of the Privacy Policy and the Terms of Use;
• timestamp of e-mail verification, account status and security timestamps.

Smartphone/app data:

• app installation ID, FCM push token;
• platform, manufacturer, brand and model, device name;
• operating system and version, app version and build, last access.

Installation/service data:

• installations linked to the account and the associated permissions;
• events, alarms, statuses and technical telemetry of compatible devices;
• commands sent via the app or portal when using enabled functions (with technical logging of actor, action, target, time and outcome, where available, for security and traceability purposes);
• notification history and delivery status.

Technical web portal data: security logs (IP address, user agent, timestamp) to protect the account and the service.

Public contact form data: name, email address, message, language and request time. We use these data to answer information requests. The request is sent to info@elbro.com, managed by Elbro, through the SMTP provider. To prevent automated submissions, we use a local verification and a per-IP limit: the limiter stores an IP fingerprint protected with a secret key and attempt times, without storing the plain IP in its tables. The fingerprint is pseudonymised, not anonymous. This function does not set browser cookies or identifiers and does not send data to an external bot-verification service.

4. Purposes

The data are processed in order to: create and protect the account; verify the e-mail address; connect the user with the installations they are authorised for; display statuses, events, alarms and notifications; send functional push notifications via FCM; provide support and diagnostics; ensure security logging and the continuity of the service.

Overview of the processing operations:

| Contact form | name, email, message, language and spam prevention data | answering requests and preventing abuse | legitimate interest (point (f)); pre-contractual steps (point (b)) when the request concerns a contract | Elbro, hosting CH/DE, SMTP provider | as per section 9 |

5. Legal Bases (Where the GDPR Applies)

• Performance of a contract (art. 6(1)(b) GDPR): account, functions of the service.
• Legitimate interest (point (f)): security, misuse prevention, diagnostics.
• Legal obligation (point (c)): retention required by law.
• Consent (point (a)): only for any future optional functions, revocable at any time.

6. Telephone Number

The telephone number is a profile/support detail. In this version it is not verified by SMS and is not used for password recovery. Any future premium SMS services will require separate activation, consent, pricing and technical verification.

7. Technical Providers and Data Disclosure

Elbro may engage technical providers required for operation:

• hosting/servers/database (Switzerland and/or Germany);
• infrastructure for transactional e-mails (SMTP);
• Google Firebase exclusively as a technical provider for push notifications (FCM). Firebase is not the authority over SBIOT accounts and does not decide on installation permissions;
• monitoring and security tools.

The providers process data only on our instructions (processors).

8. Data Location and Disclosure Abroad

The operational servers and data are located in Switzerland and/or Germany (a country with a recognised adequate level of protection). Solely for the push notification service (FCM), push tokens may be processed by Google; the transfer is based on the applicable adequacy decisions (Swiss-U.S. / EU-U.S. Data Privacy Framework) or on standard contractual clauses.

9. Retention and Deletion

• Spam prevention counters cover the last 30 minutes. IP fingerprints expire 30 minutes after the last counted attempt and are automatically deleted during the next periodic cleanup. If the service is stopped, cleanup resumes on restart. This rule concerns the form limiter, not other security logs.

• Name, email and message in the sending queue are deleted after SMTP acceptance for all recipients. Unsent requests and technical receipts are removed after 7 days during periodic cleanup. SMTP logs for this function, without message bodies, are retained for 30 days.

• Emails received by Elbro are retained for as long as needed to handle the request and any resulting relationship, subject to legal obligations and the protection of legal claims. Deleting queue records does not delete emails already delivered. Backup copies follow the normal backup cycle.

• Account data are retained as long as the account is active.

• Upon deletion of the account or of a device, the associated personal data are deleted from the operational systems, subject to statutory retention obligations and data required to document security-relevant operations. Residual security copies are not used for operational purposes and are deleted through the normal backup retention cycle.

• Technical logs, the event and alarm history and telemetry are retained for as long as required for operation, diagnostics and security, and are then deleted or anonymised.

10. Data Security

We take appropriate technical and organisational measures (art. 8 FADP): encryption in transit (TLS), authentication for every access to installation data, individual access credentials per device, logging of sensitive administrative access, separation between the public network and internal interfaces.

11. Rights of Data Subjects

Every user may request: access to their own data (art. 25 FADP; art. 15 GDPR); rectification; deletion of the account and of the data; restriction of processing or objection; release/transfer of the data; withdrawal of voluntary consents. Requests to: info@elbro.com.

Complaints: Federal Data Protection and Information Commissioner (FDPIC), Switzerland; for users in the EU, the supervisory authority of their own member state.

12. Minors

The service is not directed at persons under 16 years of age without the involvement of the installation owner or of the holders of parental responsibility.

13. Changes

We update this Policy as needed. The version in force, with date and version number, is available at any time in the app and in the portal.

14. Language Versions

This Policy is published in German, French, Italian and English. In case of discrepancies, the German version shall prevail.