nimly / Easy Access AB (“nimly”, “we” or “us”), company registration number 559313-2581, is committed to protecting your privacy and processing personal data in a safe and responsible manner.
This privacy policy explains what personal data we collect, why we process it, how it is used and stored, who it may be shared with, and what rights you have.
The policy applies when using nimly’s products and digital services, including our apps and websites, as well as when you contact us in connection with purchases, service or support.
Easy Access AB is the data controller for personal data processed by nimly. This includes, among other things, personal data processed when you:
• create and use an account in one of our apps or digital services
• connect locks or other nimly devices to a service
• use features such as digital keys, access management or proximity unlocking
• visit our websites
• contact us for service or support
• purchase products or services directly from us
Some of our digital services are delivered wholly or partly through external platforms. Where this is relevant, it is described in more detail below.
nimly offers several apps for the use and management of our products. Which personal data is processed, where it is stored and which providers are used depends on which app or service you use. When you choose to connect a nimly product to an external service, personal data and technical data may be exchanged with the relevant service to the extent necessary to establish and deliver the integration. The external provider’s own privacy policy applies to their further processing of personal data.
nimly home is our app for management and use of nimly locks and related products. The app is delivered and developed in collaboration with Knowit. When using nimly home, we may process, among other things:
• name, email address and phone number
• information about locks and other devices linked to the account
• users and access rights
• digital keys and information about sharing of access
• event and activity logs
• location data, including when using proximity unlocking
• technical data, diagnostics and crash reports
• technical information necessary for push notifications
Data related to nimly home is stored with Google in Belgium, within the EU/EEA. We use Google Firebase and Firebase Crashlytics for technical services, diagnostics, troubleshooting and crash reporting. Apple and Google may also process technical information necessary to deliver push notifications.
nimly Connect is an app for connecting and managing compatible nimly products and services.
The app and the underlying service are delivered through Safe4’s IoT platform and are based on Safe4’s white-label solution.
Safe4 processes personal data and technical data in connection with the delivery and operation of the service. This may include, among other things, account information, information about connected products and technical data necessary to deliver the service.
More information about Safe4’s processing of personal data can be found in Safe4’s privacy policy.
nimly BLE is used for connecting and managing compatible nimly products and services, including establishing connections between nimly products and third-party services such as Unloc. When using nimly BLE, we may process, among other things:
• name
• phone number
• address
• information about connected locks and devices
• technical device data
• information necessary to establish and manage connections to compatible services
Data related to nimly BLE is hosted using Amazon Web Services (AWS).
Which personal data we process depends on which products, apps and services you use. This may include, among other things:
Contact and account information
• name
• email address
• phone number
• address, where necessary
Information about products and devices
• locks and other devices linked to the account or service
• technical information and identifiers related to the devices
• information about connection and configuration
Access information
• digital keys
• users and access rights
• information about sharing of access
• event and activity logs related to locks and access
Location data
Certain features, such as proximity unlocking in nimly home, require access to location data. When such features are used, nimly may process and store location data in order to deliver the functionality. You can manage the app’s access to location through the settings on your mobile device. Restricting this access may cause certain features not to work as intended.
Technical data and diagnostics
We may process technical information about the app, the device and connected products in order to maintain stability, security and functionality. This may include information about app version, device, technical errors and crashes.
Push notifications
If you enable notifications from one of our apps, necessary technical identifiers may be processed in order to deliver push notifications. nimly does not aim to collect special categories of personal data.
Information necessary to use the services
Certain personal data is necessary for us to create a user account, deliver a service or make specific features available. Which information is necessary depends on which app, service or feature you use. If you do not provide information that is necessary for the relevant service, this may mean that we cannot create your account, deliver the service or make certain features available. Other information and permissions may be optional. If you choose not to provide such information or permissions, certain features may be unavailable without this necessarily affecting other use of the service.
We process personal data when this is necessary to:
• create and manage user accounts
• deliver and operate our apps and digital services
• connect and manage locks and other devices
• manage users, digital keys and access
• deliver features such as proximity unlocking
• deliver integrations with compatible third-party services
• send relevant notifications
• ensure stability, security and functionality
• analyse and correct technical errors
• provide customer service and technical support
• manage purchases and customer relationships
• improve our products, services and user experiences
• analyse the use of our websites
• measure the effect of marketing
• comply with legal obligations
We do not process personal data for other purposes that are incompatible with the purposes for which the data was originally collected.
The processing of personal data takes place on one or more of the following bases:
Performance of a contract
When you create an account and use one of our apps or digital services, you enter into an agreement with us or use a service that is provided in connection with a nimly product. We process the personal data that is necessary to deliver the services and features you have chosen to use.
Consent
For certain types of processing we ask for your consent. This may include specific features or the use of cookies and similar technologies on our websites. When processing is based on consent, you may withdraw your consent at any time.
Legitimate interest
We may process personal data when this is necessary to pursue our legitimate interests, for example to:
• improve and secure our products and services
• prevent misuse and security incidents
• handle and follow up customer enquiries
• carry out relevant analysis and product development
Before such processing is carried out, we assess our interests against your privacy interests and rights.
Legal obligation
In certain cases we are legally required to process or retain information. This includes, among other things, information that must be retained in accordance with accounting and bookkeeping rules.
Some of our services make it possible to invite other users, share digital keys or give other persons access to a product.
When a user invites another person or shares access, we may receive personal data about the invited person from the user who creates the invitation. This may for example be name, phone number or email address.
The data is used to send and manage the invitation, create or manage the relevant access and deliver the features related to this. The processing takes place on the legal basis that applies to the relevant service and processing.
The invited person will receive information about the processing of personal data in connection with the invitation or when they start using the service, where this is required under applicable data protection legislation.
If you receive an invitation, your personal data may therefore have been provided to us by the person who invited you.
Access to personal data is limited to persons and providers who need the data in order to deliver, operate, secure or further develop our services. We do not sell your personal data. We use external providers who process personal data on our behalf or deliver services that may involve the processing of personal data. This includes, among others:
• Google – infrastructure and hosting of nimly home. Data related to the service is stored in Ireland.
• Google Firebase and Firebase Crashlytics – technical services, diagnostics, troubleshooting and crash reporting.
• Apple and Google – platform services and delivery of push notifications.
• Knowit – development and technical services related to nimly home.
• Safe4 – platform and technical services related to nimly Connect.
• Amazon Web Services (AWS) – infrastructure and hosting related to nimly BLE.
• Google Analytics and Google Ads – analysis, marketing and measurement on our websites.
When a provider processes personal data on our behalf, we enter into the necessary agreements and set requirements for how the data may be processed and secured.
Where personal data is stored depends on which service is used.
Data related to nimly home is stored with Google in Ireland, within the EU/EEA. Other services, including nimly Connect and nimly BLE, use other technical infrastructure as described above.
Certain providers and technical services may involve personal data being processed or made available outside the EU/EEA.
When personal data is transferred to countries outside the EU/EEA, we ensure that the transfer takes place in accordance with applicable data protection legislation. Where necessary, we use approved transfer mechanisms, such as the EU Standard Contractual Clauses (SCCs), and assess the need for additional security measures.
We store personal data for as long as it is necessary for the purpose for which it was collected, or for as long as we are legally obliged to retain it.
Information related to a user account is normally processed for as long as the account is active.
When an account is deleted, personal data related to the account is deleted in accordance with our established routines, unless we are legally obliged to retain certain information for a longer period.
Information that must be retained due to legal requirements, for example accounting information, is retained for as long as the relevant legislation requires.
Technical data, logs and other information is deleted or anonymised when it is no longer necessary for the purpose for which it was collected.
We use cookies and similar technologies to ensure that the websites work, understand how they are used and measure the effect of marketing.
This may include services from Google Analytics and Google Ads.
Where required under applicable legislation, such cookies and technologies are only used after you have given consent.
You can manage or withdraw your consent through the cookie settings on the website.
nimly does not use automated individual decision-making, including profiling, that is solely based on automated processing and that has legal effects for you or similarly significantly affects you.
When personal data about you is processed, you have a number of rights under applicable data protection legislation. Depending on the processing, you may have the right to:
• receive information about how your personal data is processed
• request access to the personal data that is processed about you
• have inaccurate or incomplete data corrected
• request that personal data be deleted
• request that the processing be restricted
• object to certain forms of processing
• receive personal data that you yourself have provided in a structured and machine-readable format (data portability)
• withdraw consent when the processing is based on consent
Some of these rights only apply under certain conditions. Requests to exercise data protection rights are as a main rule free of charge and are handled without undue delay and within the deadlines that follow from applicable data protection legislation
If we process your personal data for direct marketing, you have the right at any time to object to such processing. This also applies to any profiling to the extent that the profiling is related to direct marketing.
If you object to processing for direct marketing, your personal data will no longer be processed for this purpose.
You may also at any time unsubscribe from electronic marketing by using the unsubscribe option in the relevant communication.
If you believe that your personal data is being processed in violation of applicable data protection legislation, you may contact us so that we can investigate the matter.
You also have the right to lodge a complaint with the relevant data protection authority in the country where you live or work, or where you believe a possible breach of data protection legislation has occurred.
For users in Norway the relevant authority is the Norwegian Data Protection Authority (Datatilsynet). In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY), and in Denmark the Danish Data Protection Agency (Datatilsynet).
We continuously work to protect the personal data we process against unauthorised access, alteration, disclosure, loss or misuse.
We use technical and organisational security measures that are adapted to the type of personal data, the processing and the risk associated with it.
We may update this privacy policy if our products, services or the way personal data is processed change, or if this is necessary as a result of changes in legislation.
The version applicable at any time will be available on our websites. In the event of significant changes we will inform about this in an appropriate manner.
If you have questions about this privacy policy, how nimly processes personal data or wish to exercise your data protection rights, you can contact us:
Easy Access AB / nimly
Company registration number: 559313-2581
Email: privacy@nimly.io
Gustav III:s Boulevard 32
169 73 Solna
Sweden