Privacy notice for the BLACKROLL® CLIMATE FLOW TOPPER App

(hereinafter referred to as the ‘Privacy policy’)

We’re delighted that you’re using our BLACKROLL Climate Flow Topper mobile app (hereinafter referred to as the ‘App’), which is available for download from the Apple and Google app stores, and we thank you for your interest in our company and our services. Protecting your privacy whilst you use our App is important to us.

We'd like to explain how we process your personal data and your rights as a data subject when you use the app.

BLACKROLL AG
Hauptstraße 17
CH-8598 Bottighofen
Switzerland

Telephone: +41 71 508 57 79
Email: [email protected]

(Legal notice)

(hereinafter also referred to as ‘we’ or ‘BLACKROLL’)

As the data controller under data protection law and, at the same time, as a service provider, we'd like to provide you with the following information.

You can contact our Data Protection Officer using the following contact details:

David Heieck
c/o V-Formation GmbH
Stephanienstraße 18
76133 Karlsruhe
Germany

www.v-formation.de

Email: [email protected]

For readability, we use the generic masculine form below; all genders are included.

We process your personal data solely in line with applicable data protection law, in particular theUK GDPR, the Swiss Federal Act on Data Protection (‘DSG’) and other statutory provisions on data protection (collectively referred to hereinafter as‘data protection laws’).

If you'd like to read the UK GDPR yourself, you can find it online at: https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679. You can also find the DSG online via the following link: https://www.fedlex.admin.ch/eli/cc/2022/491/de.

This privacy notice relates solely to our app and your use of the Climate Flow Topper. It doesn’t apply to our online shop (available at blackroll.com/de/shop) or any of our other websites. Furthermore, it doesn’t apply to third-party websites operated by other providers to which the app provides links. Please also consult the privacy notices on those sites where applicable. We may provide you with further privacy notices in other situations involving contact or data processing; please read them where relevant.

Because our app is hosted on servers belonging to Amazon Web Services EMEA SARL, Avenue John F. Kennedy 38, 1855 Luxembourg, Luxembourg (hereinafter ‘AWS’) in Germany, the processing of your personal data also takes place in Germany, unless otherwise stated in this privacy notice. Where we process data in Switzerland, an adequate level of data protection is guaranteed for users from the European Union (EU) or the European Economic Area (EEA) in accordance with the EU’s adequacy decision for Switzerland pursuant to Article 45(1) of the UK GDPR.

The subject matter of our privacy policy is the protection of personal data (also referred to as ‘personal information’) within the meaning of the DSG and the UK GDPR. Personal data comprises all information relating to an identified or identifiable natural person (known as the ‘data subject’). Your personal data therefore includes all information that allows you to be identified, such as your name, address, phone number or email address. Information that's necessarily generated through the use of our app, such as the start and end times and the extent of use, or your IP address, may also constitute personal data.

We also collect personal data when you provide details and content during our customer dialogue (e.g. your name, your email address and your customer number).

As part of our contractual relationship, you must provide the personal data necessary to fulfil the contractual obligations arising from the Terms of Use and to comply with legal obligations. We'll inform you in an appropriate manner of the specific data required in your case (e.g. by marking mandatory fields in forms).

Your personal data is provided by you, in particular from the information you supply and from your use of the App.

We'll only process your data for specific purposes and to the extent permitted by applicable law. We'll process your data for the following purposes and on the following legal bases:

• Consent: We'll process certain data only on the basis of your prior voluntary consent. You have the right to cancel your consent at any time with effect for the future (see also section 12).
• Performance of a contract or implementation of pre-contractual measures: in particular, to implement and manage our contractual relationship with you on the basis of the Terms of Use.
• Compliance with a legal obligation: We also process your personal data to meet legal obligations, such as commercial and tax law retention requirements.
• Legitimate interests: We'llalso process certain data to pursue our legitimate interests, for example to run and improve this app. Object to such processing and learn when we must stop or restrict it in section 12.

Please note that this isn't an exhaustive or definitive list of possible legal bases; rather, these are merely examples intended to make the legal bases under data protection law more transparent. For further details on the legal bases for the individual data processing activities within our app, refer to the explanations in the following sections.

When you download our app, the necessary information is transmitted to the relevant app store. This includes, in particular, your username, email address, the time of the download and your device’s unique identifier. However, we don’t control this data collection, as it’s carried out by the relevant app store operator. Furthermore, we don’t save this data.

In this context, refer to the respective privacy notices of the app store operators:

• for the iOS App Store: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, available at www.apple.com/de/privacy/privacy-policy/ and
• for the Google Play Store: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, available at policies.google.com/privacy?hl=de.

When you access and use our app, the following information about your access and usage may be collected and processed:

• IP address of your mobile device
• App screens accessed and times of access
• Operating system and device model of your mobile device
• App version
• device identifier (MAC address)
• Product ID of your Climate-Flow Topper

This data is processed automatically when you open our app and you won't be able to use it without providing it. We don't, as a matter of principle, use this data to identify you and we don't combine it with any other personal information you've provided (e.g. your name and customer number).

We process this usage data to fulfil our contractual relationship with you and on the basis of our legitimate interests in providing the app, ensuring its technical operation and the security of our IT systems. In doing so, we pursue the interest of enabling and permanently maintaining the use of our app and its technical functionality.

You may object to the processing of your usage data; however, in this case, you’ll no longer be able to use the app to its full extent, as this data is essential for the app to operate smoothly.

The app supports the display of notifications (so-called push notifications) on your device’s home screen and within the app (so-called in-app messages) using the Firebase Cloud Messaging feature of the Google Firebase service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). The app may therefore ask you to grant the relevant device permission. Granting this permission is voluntary. However, if you wish to receive push notifications, you must grant this permission, as you'll otherwise be unable to use this feature. We require this permission in order to provide you with the requested services in accordance with our Terms of Use.

To send you push notifications or in-app messages we use Google Firebase technology. Your device is assigned a pseudonymised push reference, which also provides information on when and for how long a specific push notification or in-app message was read. It acts as the destination for these messages and lets us show them on your device.

This information about how you use our app (including your IP address and the other usage data listed in section 4) is usually sent to a Google server in the USA and stored there. Google’s parent company, Google LLC, is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework (see https://www.dataprivacyframework.gov/list). Any transfers of personal data from individuals resident in the EU to the USA are subject to the EU Commission’s adequacy decision based on the EU-US Data Privacy Framework. Any transfers of personal data from individuals resident in Switzerland to the USA are subject to the Standard Contractual Clauses entered into with Google, which you can access at https://business.safety.google/adsprocessorterms/?sjid=2513094034223128120-EU.

Even if push notifications or in-app messages include third-party content from distributors of BLACKROLL products, we won't transfer your personal data to those distributors.

We process this data on the basis of our legitimate interests in optimising the App’s user-friendliness and in enabling optional features and services.

This authorisation stays active until you deactivate it in your device’s Settings. You can disable and re-enable push notifications at any time. On an Android device, go to ‘System settings > Apps > BLACKROLL Climate Flow Topper App > Permissions’; on an iOS device, go to ‘System settings > BLACKROLL Climate Flow Topper App > Notifications’.

When you use the Climate-Flow-Topper, the built-in sensors automatically record the following measurements and send them to our app via Bluetooth Low Energy (BLE):

• Temperatures of the 4 heating zones in °C
• Room temperature in °C
• Temperature of the controller inside the housing in °C
• Air quality (calculated from air pressure, humidity and VOC levels directly on the device)
• VOC levels in the air (volatile organic compounds)
• Humidity in %
• Air pressure (hPa)
• Temperature of the mattress itself
• Current flows through the 4 heating zones
• Date and time of measurements
• Input voltage at the controller

We do this solely to ensure the Climate Flow Topper functions as it should and to fulfil our contract with you. We don’t use this data to draw conclusions about your identity, and we don’t combine it with any personal information you’ve provided (e.g. your name and customer number).

If you provide us with personal data (e.g. your name, email address or customer number) in connection with a support enquiry (via email, contact form or telephone) regarding your Climate Flow Topper, we'll process this data to ensure your enquiry is dealt with properly.

We transfer your support enquiry and the data you’ve provided to our ticketing system. In doing so, we use the services of Zendesk Inc., 181 Fremont Street, San Francisco, CA 94103, USA (hereinafter ‘Zendesk’). Zendesk acts on our behalf on the basis of a data-processing agreement that we’ve concluded with Zendesk. Under this agreement, Zendesk undertakes to process the relevant personal data solely on our behalf and in accordance with our instructions. In doing so, your data may be transferred to and saved on Zendesk’s servers outside Switzerland and the EU or the EEA, in particular in the USA. Zendesk is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework (see https://www.dataprivacyframework.gov/list). Any transfers of personal data to the USA are subject to the adequacy decision of the European Commission or the adequacy decision of the Swiss Federal Council on the basis of the EU–US Data Privacy Framework or the Swiss–US Data Privacy Framework Agreement. Furthermore, we've entered into the EU Standard Contractual Clauses with Zendesk.

We may also forward your support enquiry to our technology partner, Variowell Development GmbH, Fridtjof-Nansen-Weg 5a, 48155 Münster, Germany (hereinafter ‘Variowell’). Variowell provides second-level support on our behalf and operates on the basis of a data-processing agreement we've closed with Variowell. However, Variowell only receives the product ID of your Climate-Flow-Topper from us and, in particular, doesn't receive your name or contact details.

We process your data to perform our contract with you and to respond appropriately to your enquiry, taking into account any information you’ve provided voluntarily.

If we process your data on the basis of legitimate interests, you may object to the storage of your personal data at any time. If you do, we won't process your data unless we can demonstrate a legitimate interest in doing so or are otherwise legally obliged to store it. To exercise your right to object to the processing, contact us by email.

We'll only share your personal data with external recipients when it's necessary to provide the app, when you've given consent or when another legal basis applies.

External recipients include, in particular

• Amazon Web Services EMEA SARL, Avenue John F. Kennedy 38, 1855 Luxembourg, Luxembourg (‘AWS’, cloud infrastructure provider); data processing by AWS takes place exclusively for the purposes specified by us and in accordance with our instructions, on the basis of a data processing agreement that we’ve concluded with AWS.

• Variowell Development GmbH, Fridtjof-Nansen-Weg 5a, 48155 Münster, Germany (‘Variowell’, technology partner); data processing by Variowell takes place exclusively for the purposes specified by us and in accordance with our instructions, on the basis of a data processing agreement that we’ve concluded with Variowell.[VP1][MS||B2][JH3]

• Zendesk Inc., 181 Fremont Street, San Francisco, CA 94103, USA (‘Zendesk’, provider of the ticketing system); data processing by Zendesk is carried out exclusively for the purposes specified by us and in accordance with our instructions, on the basis of a data processing agreement that we’ve concluded with Zendesk.

Furthermore, external recipients may include, in particular:

• Data processors: These are service providers we engage to deliver services, for example in the areas of technical infrastructure and maintenance of our app. We carefully select and regularly review such data processors to ensure that your privacy is protected. These service providers may only use the data for the purposes specified by us and in accordance with our instructions. We're authorised to use such data processors in accordance with statutory requirements.
• Public authorities: these are government bodies, state institutions and other bodies governed by public law, such as regulatory authorities, courts, public prosecutors’ offices or tax authorities. We’ll only transfer personal data to such public authorities when required by law.
• Private bodies: service providers and agents to whom data is transferred in connection with the provision of our app, either on the basis of a legal obligation or to safeguard legitimate interests, such as solicitors, tax advisers or auditors.

As a rule, we don't process your data outside Switzerland, the European Union (EU) or the European Economic Area (EEA). Should we need to transfer your data to another country outside Switzerland, the EU or the EEA in a specific case, we'll first make sure either a legally permitted exception applies, the recipient maintains an adequate level of data protection or you've consented to the transfer. An adequate level of data protection is guaranteed, for example, by the recipient’s certification under the EU–US Data Privacy Framework or the Swiss–US Data Privacy Framework, the conclusion of EU Standard Contractual Clauses or the existence of so-called Binding Corporate Rules (BCR). Contact us via the communication channels listed above to obtain a copy of the specific ‘safeguards’ in place for the transfer of your data to third countries.

We implement technical and organisational security measures to protect your personal data against accidental or deliberate manipulation, loss, destruction or unauthorised access. Our data processing and security measures are updated in line with the current state of the art.

Your data is transmitted securely via encryption; we use the Transport Layer Security (TLS) protocol, more widely known by its former name, Secure Sockets Layer (SSL).

Please note, however, that we can't guarantee complete data security, particularly when communicating via the contact form or by email. Use a secure method of delivery, such as post, when sending confidential information.

Our employees are bound by a duty of confidentiality regarding personal data.

We'll only keep your personal data for as long as is necessary to fulfil the purposes for which it was collected or — in the case of consent — for as long as you don't withdraw your consent. If you object, we won't process your personal data further unless we're permitted or obliged to do so under relevant legal provisions (e.g. in the context of commercial and tax law retention obligations). We'll also remove your personal data if we're obliged to do so for legal reasons. For further details on the retention period for your personal data, refer to the relevant explanations under the sections above.

We've appointed a representative in an EU member state. Contact them as follows:

V-Formation GmbH

Stephanienstr. 18

76133 Karlsruhe

Germany

www.v-formation.de

Tel: +49 721 170 290 34

Email: [email protected]

From time to time, it may be necessary to update the content of this privacy notice. We therefore reserve the right to amend it at any time. Check the latest version of this privacy notice whenever you visit our app again. We’ll also publish the updated version of the privacy notice here.

Last updated: 09/10/2026