EDASTYL, s.r.o. ("Edastyl", "we") is the controller of the personal data described here.
| Registered address | Poštová 1040/15, 982 01 Tornaľa, Slovak Republic |
| Company ID (IČO) | 36173576 |
| Contact | info@heatmon.eu |
| Service | Heatmon — heating, solar and battery monitoring |
The Heatmon Android app, the web portal at heatmon.eu, and the monitoring equipment installed at your site. It does not cover the websites or products of your installer, energy supplier or equipment manufacturer.
Each time you sign in from a phone we record an installation identifier generated by the app (not a device serial, and reset if you reinstall), the phone model, app version and Android version, the time you signed in, the time of your last activity and the IP address of that activity, and the result of the Google Play Integrity check that confirms the request came from a genuine, unmodified installation.
We keep a record of significant actions taken through your account — signing in, changing who has access to a site, and commands sent to heating equipment.
Your equipment reports temperatures, power consumption, solar generation, battery state and operating mode. These are tied to the site rather than to you personally, but we treat them as personal data, because a detailed record of a household's energy use can reveal when people are at home and how they live.
We do not collect your postal address, your location, your contacts, your photos, or any advertising identifier. The app contains no advertising and no third-party analytics or tracking software.
| Data | Purpose | Legal basis |
|---|---|---|
| Account | Creating and running your account | Contract — Art. 6(1)(b) |
| Measurements | Showing you your system and letting you control it | Contract — Art. 6(1)(b) |
| Session and device | Keeping you signed in; showing your signed-in devices; detecting misuse | Legitimate interests — Art. 6(1)(f) |
| Play Integrity result | Blocking automated abuse and fraudulent sign-ups | Legitimate interests — Art. 6(1)(f) |
| Activity records | Establishing who changed what; security investigation | Legitimate interests — Art. 6(1)(f); legal obligation — Art. 6(1)(c) |
| Phone number | Helping you regain access if locked out | Consent — Art. 6(1)(a); optional |
| News emails | Occasional product news, only if you asked for it | Consent — Art. 6(1)(a); withdrawable |
Where we rely on legitimate interests, we have weighed those interests against your rights. You may object at any time — see section 8.
We do not sell personal data and we do not share it for advertising. It is disclosed only to:
All Heatmon data is stored on servers in the European Union and the European Economic Area — specifically Germany and Austria. The equipment at your site also holds recent readings locally, on your own premises.
| Data | Retention | Why |
|---|---|---|
| Account | While the account exists, then 30 days | A window in which an accidental deletion can be reversed |
| Session records | Until revoked or expired, then 180 days | Investigating unauthorised access |
| Email verification tokens | 30 minutes | The record that verification completed is kept while the account exists |
| Activity records | 4 years | The period in which a claim about a change to your heating could be brought |
| Site measurements | 3 years | So you can compare one year against another |
| Invoices and accounting records | 10 years | Required by Act 431/2002 Coll. on Accounting and Act 222/2004 Coll. on VAT |
| Security rate-limiting counters | 7 days | Detecting attacks after the fact |
Only the last of these is fixed by law. The others are our own judgement about what is necessary, and we will shorten them if they prove longer than they need to be.
Under the GDPR and Act No. 18/2018 Coll. you have the right to ask what we hold about you and receive a copy; to have inaccurate data corrected; to have your data erased; to ask us to restrict processing while a dispute is resolved; to receive your data in a machine-readable format; to object to processing based on legitimate interests; and to withdraw any consent you have given, without affecting processing carried out before you withdrew it.
You can delete your account yourself at heatmon.eu/account/delete/ or in the app under Profile. For anything else, write to info@heatmon.eu. We will respond within one month.
If you believe we have handled your data improperly you may complain to the Slovak supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava 27, statny.dozor@pdp.gov.sk.
Deleting your account immediately withdraws your access to every site, signs out every device, and prevents you from signing in again. It does not change any setting on your heating system, which continues to run exactly as it was.
Your name, email address and password are removed 30 days later. Records of actions taken on heating equipment are kept for the period in section 7, because they may be needed to investigate a fault or a safety incident; once your account data is removed, those records identify the action rather than you. Measurements belong to the site rather than to your account and are not deleted.
Passwords are stored only as hashes. Access codes and session tokens are stored only as hashes, so a copy of our database contains nothing that can be replayed. Connections between the app, our servers and your site equipment are encrypted. Access to production systems is restricted to named individuals.
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights, we will tell you without undue delay, as Article 34 GDPR requires.
Heatmon is not intended for children, and we do not knowingly create accounts for anyone under 16.
Any new version is published here with a new version date. If a change materially affects how we use your data, we will ask you to review it when you next sign in.