Privacy Notice – Thule App

1. Introduction

The purpose of this privacy notice is to provide information about how we, Thule Sweden AB, process your personal data in connection with the use of our mobile application Thule. We respect your privacy and protect the personal data we process about you.

Thule Sweden AB, reg. no. 556076-3970, address box 69, 330 33 Hillerstorp, Sweden (“Thule”), is the data controller of the processing of your personal data.

The following describes, among other things, how we collect, process and share your personal data and provides information concerning your rights and how you can exercise these.

We protect children’s integrity. Therefore, we do not intentionally process personal data relating to children under the age of 18.

2. Description of our processing of your personal data

In the below you will find a description of the personal data we process about you, for which purposes we process your personal data, the legal bases for our processing of and for how long the personal data is processed. All processing described below is conducted by Thule as a separate data controller, except for the processing described in Section 2.2.1 which outlines the processing carried out together with bubl. under a joint controllership.

2.1 When registering and logging in to a user account

In order for you to be able to register and use a user account, which is necessary to use the Thule app, we process your e-mail address and your password, as well as country.

The processing of your personal data for this purpose is based on our legitimate interest to be able to provide you with a user account and the features that follow from you registering for a user account. Thule has made the assessment that Thule’s interests outweigh any possible conflicting interests in not having the personal data processed. You can contact privacy@thule.com to receive further information regarding this assessment. The processing of your personal data is necessary in order to provide you with the Thule App.

The personal data will be stored for as long as your Thule account exists. If you do not wish continued processing you can request that Thule deletes your Thule account and your personal data will be deleted.

Thule also collects data for app analytics, the purpose of collecting analytics data is to get an insight into users' behavior in the app. We collect various events that help us understand how our users are using the app. With that data, we can improve the user experience. The analytics data doesn’t contain any personal data (PII) that could track back to the user or identify our users. It is possible to opt out of sharing analytics data in the app.

For processing relating to your purchases, order history, returns etc., please see our privacy notice for e-commerce https://www.thule.com/en-us/legal-and-privacy-policy.

2.2 When you use an Air Purifier product

2.2.1 Joint controlling by Thule and bubl.

Processing related to your Air Purifier (the “Air Purifier Product”) is, to a certain extent, carried out together with bubl. AB, reg. no 559167-7678, address Gert Fredrikssons Väg 3S-611 35 Nyköping, Sweden (“bubl.”)as joint controllers.

Thule and bubl. are working together to provide the functionalities of the Air Purifier Product. This means that certain personal data processed in relation to your use of the Air Purifier Product is processed jointly by Thule and bubl., whilst certain processing is carried out by each party as separate controllers.

For personal data processing carried out as joint controllers, Thule and bubl. jointly determine the purposes and means of processing of personal data described in this section.

1. When using the Air Purifier Product, information about your GPS location is collected by Thule from your mobile device and MAC address is collected by Thule from the Air Purifier and transferred to bubl. for the joint purpose of providing you with the Air Purifier Product’s features, e.g. the provision of air quality data.
   The personal data processed for these purposes will be temporarily stored when the data is gathered.
2. For the joint purpose of enabling detecting and solving technical issues (such as bugs) in your Air Purifier Product and, subsequently, ensure that the Air Purifier Product’s functions efficiently and smoothly and that the services can continuously be improved, Thule collects and transfers the following diagnostics data from your Air Purifier Product to bubl.:
   
   
   • Diagnostic event with timestamp,
   • Install Id,
   • MAC address for Air Purifier,
   • Operating system and version number,
   • SDK version of the bubl. SDK, and
   • local language codes from the mobile device.
   
   
   The personal data will be stored for these purposes only momentarily.
   The personal data will be processed on the legal basis of the legitimate interest of Thule and bubl. to provide you with; (1) the full range of features of the Air Purifier Product and Thule App, and (2) a functioning and efficient user experience.
   
   Thule and bubl. have jointly made the assessment that Thule and bubl.’s interests outweigh any possible conflicting interests in not having the personal data processed. You can contact privacy@thule.com to receive further information regarding this assessment. The processing of your personal data is necessary in order for the Air Purifier Product to function properly.

2.2.2 Further processing by Thule

Thule continues to process, as a separate controller, your Air Purifiers diagnostic data after transferring it to bubl. for Thule’s own, individual purposes of enabling detecting and solving technical issues (such as bugs) in your Air Purifier and App and, subsequently, ensure that the Air Purifier functions efficiently and smoothly and that the services can continuously be improved. Such processing is based on our legitimate interest to provide you with a functioning and efficient user experience and will be stored for a period of 3 years.

2.2.3 Further processing by Bubl.

Any continued processing of your personal data by bubl. for additional, individual, purposes, is carried out by bubl. as a separate controller. For such further processing by bubl., including information on relevant retention periods, we refer to Bubl’s privacy notice, which can be found https://www.get-bubl.com/privacy-policy/.

2.3 When you sign up for Thule’s newsletter

In order to provide you with our newsletter, once requested by you, we process your e-mail address and country, as well as date and time of consent.

The processing of your name and e-mail address for sending newsletters is based on your consent. You can always withdraw your consent with future effect by contacting us at the contact information provided in section 5 or by using the link to unsubscribe from newsletters.

The personal data will be stored for two (2) years initially (provided you do not withdraw your consent). Thereafter, you will be asked bi-annually whether or not you wish that we continue the processing of your personal data in accordance with the above. If you do not wish continued processing or if you do not answer the request within the time frame stated in the request, your personal data will be deleted.

3. Who has access to your personal data?

The number of people who have access to your personal data is limited. Only people who need to process your personal data in accordance with the purposes stated above have access to the personal data.

• Your personal data is shared with other companies within the Thule Group if it is necessary to fulfil the purposes mentioned above. This includes Thule local entities listed here.
• We also transfer your personal data to suppliers and partners, including IT suppliers such as providers of cloud services, for example AWS, if required in order to conduct our business operations, as well as the service providers listed here.
• We transfer personal data relevant for your Air Purifier Product to bubl. which is processed by bubl. both as a joint controller subject to this privacy notice and as an independent controller as described in Section 2.2.
• If required by law or to protect our interests in a legal proceeding we may also transfer personal data to other independent controllers such as legal representatives or law enforcement agencies.

4. Where is your data processed?

We aim to process your information in Sweden and within the EU/EEA. When required for the fulfilment of the purposes stated above, your information may be transferred to, and processed in, a country outside the EU/EEA by one of Thule’s business partners or their subcontractors. Thule will take all reasonable technical and organisational measures to protect your personal data in such transfers. Our transfers of personal data are based on Thule’s legitimate interest in fulfilling the purposes and conducting our business in an efficient manner.

When transferring personal data to countries outside the EU/EEA, we use standard contractual clauses approved by the European Commission to ensure a sufficient level of protection for your personal data, unless another legal basis for the transfer applies, such as an adequacy decision by the EU Commission. The standard contractual clauses can be found via the following link: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. Upon your request, you may receive a copy of those standard contractual clauses and a complete list of our third country transfers.

If you would like a full list of transfers of personal data to countries outside the EU/EEA and a copy of the applicable standard contractual clauses or information on whether there is an adequacy decision in place, please contact us at privacy@thule.com.

5. What are your rights?

You have several rights when we process personal data about you. If you wish to exercise any of the rights set out below or if you have any questions relating to Thule’s processing of your personal data, please contact us at privacy@thule.com. Please note that you may exercise your rights in relation to the joint processing towards both bubl. and Thule. If you wish to exercise your rights in relation to bubl. processing as separate controller, please be referred to contact information in bubl’s privacy notice. You may contact bubl. at info@get-bubl.com .

If you have questions regarding how we process personal data about you, you are most welcome to contact us at privacy@thule.com. If you have any objections or complaints about the way we process your personal data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten (“IMY”)).

You may request information on whether we are processing personal data relating to you and, if so, to receive a copy of such data together with details of (i) the purposes of the processing; (ii) the categories of personal data concerned; (iii) the recipients to whom the personal data have been or are to be disclosed; and (iv) the retention period and the existence of the right to request rectification and erasure and to request restriction and to object to processing. You also have the right to be informed about the right to lodge a complaint with IMY and about the from where the personal data has been collected, as well as about the existence of automated decision-making, if any, together with certain additional information.

If you believe that the personal data concerning you is inaccurate or incomplete, you may request that the data be corrected or completed.

When we process personal data on the basis of our legitimate interest, you have the right to object to the processing at any time. If we cannot show that there are compelling legitimate grounds to continue processing the data, we must stop processing it. You also have the right to object to our processing of personal data for direct marketing purposes, including profiling. If you object to such processing, we must cease processing.

In certain cases, for example if you have objected to our processing of your personal data, contested the accuracy of the personal data or if the processing of your personal data is unlawful, you have the right to request restriction of the processing of your personal data. By requesting restriction, you have the possibility, at least for a certain period of time, to stop us from using the data other than to, for example, defend legal claims. You can also prevent us from deleting the data, for example if you need the data to claim damages.

You have the right to have your personal data erased if we no longer need the personal data for the purposes for which it was collected or is processed, you withdraw your consent, you object to the processing and there are no legitimate grounds for further processing, your personal data has been processed unlawfully or if we are required by law to erase your personal data.

6. Change in the privacy notice

If any changes are made concerning the processing of your personal data, we will inform you of the changes by publishing an updated version of this privacy policy in the App. However, if we make material changes to this privacy policy, we will inform you by active means, e.g. by sending you an email or similar.