Privacy & Cookie Notice

This Privacy & Cookie Notice explains how symetrIQ building intelligence Korlátolt Felelősségű Társaság processes personal data in connection with the SymetrIQ website and Portal.

1. Data Controller

The data controller is:

symetrIQ building intelligence Korlátolt Felelősségű Társaság
Registered office: 1112 Budapest, Repülőtéri út 2/a A. ép., Hungary
Company registration number: 01-09-459005
Tax number: 33098520-2-43
E-mail: info@symetriq.org

For privacy requests, please contact:

info@symetriq.org

2. Scope

This Notice applies to personal data processed when a person:

• visits the SymetrIQ website or Portal;
• creates or uses a Portal account;
• signs in using e-mail/password or Google Sign-In;
• browses products;
• downloads files;
• contacts SymetrIQ;
• acts as a manufacturer administrator or business contact; or
• otherwise interacts with the Portal.

3. Categories of Personal Data

Depending on how the Portal is used, SymetrIQ may process the following categories of data.

3.1 Account information

This may include:

• e-mail address;
• internal user identifier;
• authentication information;
• account status;
• account creation date; and
• information supplied by an external authentication provider where Google Sign-In is used.

Passwords are not intended to be stored in plain text.

3.2 Authentication information

Where the User chooses Google Sign-In, SymetrIQ receives the account information required for authentication that is made available through the configured Google authentication process.

The exact information received depends on the permissions configured by SymetrIQ.

3.3 Portal usage information

SymetrIQ may record:

• products viewed;
• number and timing of product views;
• files downloaded;
• downloaded file formats;
• interactions with Portal features;
• internal account or session identifiers; and
• country-level location information.

3.4 Technical information

SymetrIQ may process technical information required for security and operation of the Service, including:

• IP address;
• browser or device information where technically generated;
• authentication events;
• timestamps; and
• security and error logs.

3.5 Communication information

Where a person contacts SymetrIQ, we process the information contained in the communication, including the sender's contact details and the contents of the request.

3.6 Manufacturer contact information

For manufacturer customers we may process:

• business contact name;
• business e-mail address;
• employer or represented organisation;
• role;
• contractual correspondence; and
• support communications.

4. Purposes and Legal Bases

4.1 Account creation and Portal access

Purpose: creating and maintaining the User's Portal account and providing requested Portal functionality.

Legal basis: performance of the contract represented by the Terms of Service or steps requested by the User before entering into that relationship.

4.2 Authentication and account security

Purpose: authenticating Users, preventing unauthorised access and maintaining Portal security.

Legal basis: performance of the service contract and SymetrIQ's legitimate interest in protecting its systems, Users and digital assets.

4.3 Portal usage analytics

Purpose: understanding how products and digital assets are used, improving the Portal, measuring product interest and providing product-level analytics to participating manufacturers.

Data used may include product views, download events, file formats and country-level information.

Legal basis: SymetrIQ's legitimate interests in operating, improving and measuring the Portal and the legitimate interests of participating manufacturers in understanding aggregated engagement with their product portfolio.

SymetrIQ will take measures to minimise the information used for these purposes.

4.4 Manufacturer analytics

Manufacturer customers may receive statistics relating to their own products, including:

• number of product views;
• product-level engagement;
• number of downloads;
• downloaded file formats; and
• country-level geographic statistics.

Standard manufacturer analytics do not include the User's name, e-mail address or other directly identifying account information.

Aggregated analytics may be retained separately from identifiable User information.

4.5 Service security and abuse prevention

Purpose: detecting security incidents, misuse, unauthorised access and violations of the Terms of Service.

Legal basis: SymetrIQ's legitimate interests in protecting the Portal and its Users.

4.6 Customer and User support

Purpose: responding to enquiries, support requests, complaints and legal notices.

Legal basis: performance of a contract, taking requested pre-contractual steps, compliance with legal obligations or SymetrIQ's legitimate interest in responding to communications, depending on the nature of the request.

4.7 Manufacturer relationship management

Purpose: administering manufacturer subscriptions, onboarding, billing, support and contractual communication.

Legal basis: performance of the relevant contract and compliance with applicable legal obligations.

4.8 Legal compliance

SymetrIQ may process data where necessary to comply with applicable laws, regulatory requirements or legally binding requests.

Legal basis: compliance with a legal obligation.

5. Country Information

The Portal records country-level usage information.

Country information may be obtained from technical connection information such as the User's IP address or from other account or request data.

Manufacturer analytics are designed to present this information at country level rather than as precise geolocation.

SymetrIQ does not intend to collect precise GPS or street-level location through the standard Portal analytics described in this Notice.

6. Data Shared with Manufacturers

Manufacturers receive information about engagement with products within their own portfolio.

Standard manufacturer analytics are intended to be aggregated and non-directly identifying.

SymetrIQ does not disclose a Portal User's name or e-mail address to a manufacturer merely because that User viewed or downloaded the manufacturer's product.

If SymetrIQ later introduces lead-generation functionality or another feature involving the transfer of identifiable User information to a manufacturer, Users will receive separate information before such processing takes place and an appropriate legal basis will be established.

7. Service Providers and Recipients

SymetrIQ uses selected third-party service providers to operate, secure and support the Portal. Personal data is disclosed to such providers only to the extent necessary for the relevant service.

The principal service providers currently used for the Portal are:

Contabo GmbH, Germany – infrastructure hosting for the production environment. The Portal application, PostgreSQL databases, MinIO object/file storage and operational monitoring components are operated within SymetrIQ’s hosted infrastructure in the European Union. Processing carried out by Contabo on behalf of SymetrIQ is governed by Contabo’s applicable Data Processing Agreement.

Plus Five Five, Inc. (Resend), United States – transactional e-mail delivery, including account-verification, password-reset and account-related messages. Where personal data is transferred from the European Economic Area to the United States, SymetrIQ relies on applicable contractual and legal transfer safeguards, including Resend’s Data Processing Addendum and the EU Standard Contractual Clauses where relevant.

Microsoft Ireland Operations Limited / Microsoft 365 SharePoint Online – off-site backup storage used for business-continuity and disaster-recovery purposes. Microsoft 365 services are subject to Microsoft’s applicable data-protection terms and Data Protection Addendum. For eligible European customers and services, Microsoft provides commitments relating to storage and processing of Customer Data and personal data within the EU and EFTA under its EU Data Boundary, subject to documented limited exceptions.

Google Ireland Limited / Google – where a User chooses Sign in with Google, Google provides the authentication service. SymetrIQ requests only the standard OpenID Connect openid, email and profile scopes for this purpose. SymetrIQ does not use Google Sign-In to obtain access to the User’s Gmail, Google Drive, Calendar or other unrelated Google services. For Users in the European Economic Area and Switzerland, Google generally provides its consumer services through Google Ireland Limited.

SymetrIQ operates its PostgreSQL database, MinIO object/file storage, reverse proxy and operational monitoring components within its own hosted production environment. These components are not separate third-party recipients of personal data.

Service providers are required to process personal data only for the purposes necessary to provide their respective services and subject to applicable contractual, confidentiality and data-protection requirements. Where personal data is transferred outside the European Economic Area, SymetrIQ relies on an applicable lawful transfer mechanism, including an adequacy decision, the EU Standard Contractual Clauses or another mechanism permitted under applicable data-protection law.

8. International Data Transfers

SymetrIQ seeks to process and store personal data within the European Economic Area (“EEA”) wherever reasonably practicable. The Portal’s primary production infrastructure, including the application, database and object/file storage, is hosted within the European Union.

Certain service providers used by SymetrIQ may process personal data outside the EEA or may make personal data accessible from countries outside the EEA. In particular:

Resend (Plus Five Five, Inc.) provides transactional e-mail delivery services and may process relevant e-mail and delivery data in the United States.

Google may process personal data in connection with Google Sign-In through its international infrastructure in accordance with Google’s applicable privacy and data-transfer arrangements.

Microsoft 365 SharePoint Online is used for off-site backup storage. For eligible European customers and services, Microsoft provides commitments regarding storage and processing within the EU and EFTA under its EU Data Boundary, subject to documented limited exceptions and international processing that may be necessary for certain service, security or support functions.

Where personal data is transferred to a country outside the EEA that has not been recognised by the European Commission as providing an adequate level of data protection, SymetrIQ will ensure that an appropriate transfer mechanism is in place as required by applicable data-protection law. Such mechanisms may include:

• an adequacy decision adopted by the European Commission;
• the European Commission’s Standard Contractual Clauses (“SCCs”);
• participation by the relevant recipient in an applicable recognised data-transfer framework, where legally available and appropriate; or
• another lawful transfer mechanism permitted under applicable data-protection law.

Where required, SymetrIQ will also take into account the circumstances of the transfer and the safeguards provided by the relevant service provider, including contractual, organisational and technical measures designed to protect personal data.

SymetrIQ’s use of service providers does not change the purposes for which personal data is processed. Personal data is transferred or made accessible outside the EEA only to the extent necessary for the relevant service and subject to the safeguards described above.

9. Retention

SymetrIQ retains personal data only for as long as reasonably necessary for the purposes for which it was collected and for applicable legal requirements.

Portal account data: retained while the account remains active and deleted or anonymised within a reasonable period following valid account deletion, subject to legal and security retention requirements.

Detailed identifiable Portal activity data:
Maximum 36 months unless a shorter period is technically sufficient.

Aggregated non-personal product statistics: may be retained for longer periods because they no longer identify an individual.

Security logs:
Up to 12 months unless a longer period is required to investigate an incident.

Support correspondence:
Up to 2 years after resolution unless a longer period is necessary for a contractual or legal claim.

Contractual and accounting records: retained for the period required under applicable law.

Backups: deleted or overwritten according to SymetrIQ's backup lifecycle.

10. Cookies and Similar Technologies

10.1 Strictly necessary technologies

The Portal may use cookies, browser storage or similar technologies where technically necessary to:

• maintain authenticated sessions;
• protect account security;
• remember essential session state;
• provide authentication functionality; and
• prevent abuse.

Such technologies are used only to the extent necessary to provide the requested service.

10.2 Google Sign-In

Where the User selects Google Sign-In, the User is redirected to or interacts with Google's authentication service.

Google may use its own technologies in connection with the authentication process under its own privacy documentation.

10.3 Analytics and marketing cookies

SymetrIQ does not place optional analytics, advertising, behavioural marketing or cross-site tracking cookies without the User's prior consent where such consent is legally required.

Portal product analytics described in this Notice may be performed server-side and do not necessarily require an optional browser cookie.

If SymetrIQ introduces Google Analytics, Meta Pixel, LinkedIn Insight Tag, session-recording technology or another non-essential tracking technology, SymetrIQ will update this Notice and implement an appropriate consent mechanism before activation.

11. User Rights

Subject to the conditions of applicable data-protection law, a person may have the right to:

• obtain information about the processing of their personal data;
• obtain access to their personal data;
• request correction of inaccurate data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive applicable data in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a supervisory authority.

Requests may be submitted to:

info@symetriq.org

SymetrIQ may need to verify the identity of a person making a request.

12. Objection to Analytics Based on Legitimate Interests

Where Portal analytics involving personal data are based on legitimate interests, Users may object to such processing on grounds relating to their particular situation.

SymetrIQ will assess such requests in accordance with applicable law.

Aggregated information that no longer constitutes personal data is not subject to data-subject rights under the GDPR.

13. Supervisory Authority

Users have the right to lodge a complaint with the competent data-protection supervisory authority.

In Hungary, the supervisory authority is:

Hungarian National Authority for Data Protection and Freedom of Information
(Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH)

1055 Budapest, Falk Miksa utca 9-11, Hungary
Postal address: 1363 Budapest, Pf. 9
E-mail: ugyfelszolgalat@naih.hu

Users located in another EEA Member State may also be entitled to contact their local supervisory authority.

14. Automated Decision-Making

SymetrIQ does not currently use Portal account or activity data to make solely automated decisions producing legal effects or similarly significant effects on Users.

15. Children

The Portal is not directed to children.

Users should be at least 18 years old to create a standard Portal account.

16. Security

SymetrIQ applies technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration or disclosure.

No Internet-based service can guarantee absolute security.

17. Changes to this Notice

SymetrIQ may update this Privacy & Cookie Notice where processing activities, technology or applicable legal requirements change.

The current version and effective date will be made available through the Portal.

Material changes will be communicated appropriately where required.

18. Contact

Privacy questions and requests may be sent to:

info@symetriq.org

symetrIQ building intelligence Korlátolt Felelősségű Társaság
1112 Budapest, Repülőtéri út 2/a A. ép.
Hungary