Privacy policy.What we do with data, and what we don't.

Last updated: 22 May 2026

This Privacy Policy describes how IoT Fabrikken ApS ("IoT Fabrikken", "we", "us" or "our") collects, uses and shares personal data when you use our website, the RoomAlyzer platform and related services (together, the "Service"). It also explains your privacy rights and how applicable law protects you.

We use personal data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. Where we process personal data on behalf of a customer (for example sensor readings and building data in RoomAlyzer), we act as a data processor under the customer's instructions; the customer's privacy notice and data processing agreement apply to that processing.

Interpretation and definitions

Interpretation

Words with an initial capital letter have the meanings set out below. The same meaning applies whether they appear in singular or plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access parts of the Service.
• Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for directors or other managing authority.
• Application means the RoomAlyzer software provided by the Company, including the web application at app.roomalyzer.com and related mobile or integration interfaces.
• Company (referred to as "the Company", "We", "Us" or "Our") means IoT Fabrikken ApS, Brønsager 1, 4000 Roskilde, Denmark (CVR 39 11 03 93).
• Country means Denmark.
• Device means any device that can access the Service, such as a computer, mobile phone or tablet.
• Personal Data means any information relating to an identified or identifiable natural person.
• Service means the website iot-fabrikken.com (and related domains), the Application, customer support portals, demo and contact flows, newsletters and any other services we operate that link to this policy.
• Service Provider means a natural or legal person who processes data on behalf of the Company to facilitate the Service, provide the Service on our behalf, perform services related to the Service or help us analyse how the Service is used.
• Usage Data means data collected automatically, either generated by use of the Service or from the Service infrastructure itself (for example, duration of a page visit or API request metadata).
• You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and using your personal data

Personal data

While using our Service, we may ask you to provide personal data that can be used to contact or identify you. This may include, but is not limited to:

• Email address
• First and last name
• Phone number
• Company or organisation name and job title
• Address, city, region and postal code (where relevant for orders or contracts)
• Account credentials and profile preferences
• Content of messages you send us (support, sales, demo requests)
• Usage Data

Usage data

Usage Data is collected automatically when you use the Service.

Usage Data may include your Device's Internet Protocol address (IP address), browser type and version, the pages you visit, the time and date of your visit, time spent on those pages, unique device identifiers and other diagnostic data.

When you access the Service through a mobile device, we may collect information such as the type of mobile device, unique device ID, IP address, mobile operating system, mobile browser type and other diagnostic data.

We may also collect information your browser sends whenever you visit our website or when you access the Service through a mobile device. For cookies and similar technologies, see our Cookie policy.

How we use your personal data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including monitoring usage and operating the Application.
• To manage your Account and give you access to functionality available to registered users.
• For the performance of a contract relating to products or services you have purchased or any other contract with us through the Service.
• To contact you by email, telephone, SMS or other electronic communication regarding updates, security notices, support or information about functionalities, products or contracted services, where necessary or reasonable.
• To provide news and offers about goods, services and events similar to those you have purchased or enquired about, unless you have opted out.
• To manage your requests to us (sales, support, demos, careers).
• For business transfers such as a merger, divestiture, restructuring, reorganisation, dissolution or sale of assets, where Personal Data held about Service users may be among the assets transferred.
• For other purposes such as data analysis, identifying usage trends, measuring promotional effectiveness and improving our Service, products, services, marketing and your experience.

Legal bases (EEA and UK)

Where the General Data Protection Regulation (GDPR) or UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract, legitimate interests (for example operating and securing the Service, B2B marketing to existing customers), compliance with a legal obligation, and consent where required (for example certain cookies or marketing sign-ups). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Sharing your personal data

We may share your personal data in the following situations:

• With Service Providers who assist us in operating the Service, hosting, analytics, email delivery, CRM, payment processing or customer support, subject to appropriate contractual safeguards.
• For business transfers in connection with, or during negotiations of, any merger, sale of Company assets, financing or acquisition.
• With Affiliates, requiring them to honour this Privacy Policy.
• With business partners to offer certain products, services or promotions, where you have chosen to participate.
• With other users when you share personal data or interact in public areas of the Service, where such information may be visible to others.
• With your consent for any other purpose you have agreed to.
• With authorities where required by law or to protect rights, safety and security as described below.

A current list of subprocessors used for RoomAlyzer customer data is available to customers under our Terms and data processing agreement.

Retention of your personal data

We retain Personal Data only for as long as necessary for the purposes set out in this Privacy Policy, including to comply with legal obligations, resolve disputes and enforce agreements.

Usage Data is generally retained for a shorter period, except where used to strengthen security or improve functionality, or where we are legally required to retain it longer.

Transfer of your personal data

Your information, including Personal Data, is processed at the Company's offices and in other places where parties involved in processing are located. Data may be transferred to (and maintained on) systems outside your country where data protection laws may differ.

For customer data in RoomAlyzer, we offer EU data residency by default. Where transfers outside the European Economic Area occur, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms, unless an adequacy decision applies.

Your consent to this Privacy Policy followed by your submission of information represents your agreement to such transfer where applicable. We take steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.

Disclosure of your personal data

Business transactions

If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different privacy policy.

Law enforcement and other legal requirements

Under certain circumstances, the Company may be required to disclose your Personal Data if required by law or in response to valid requests by public authorities (for example a court or government agency). We may disclose Personal Data where we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Security of your personal data

The security of your Personal Data is important to us. We use commercially acceptable technical and organisational measures, including encryption in transit and at rest for the Application, access controls and regular security testing. No method of transmission over the Internet or electronic storage is 100% secure; we cannot guarantee absolute security. Further detail is in our Security page and customer documentation.

Your privacy rights

Depending on where you live, you may have rights to access, rectify, erase, restrict or object to processing, data portability and to lodge a complaint with a supervisory authority. If you are an end user of a customer's RoomAlyzer deployment, please contact that customer first; we assist our customers in responding to data subject requests as processor.

To exercise rights relating to data we control directly (for example website accounts, marketing or sales enquiries), contact us using the details below. We may need to verify your identity before responding.

Children's privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under 13. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under 13 without verification of parental consent, we take steps to remove that information from our servers.

Where we rely on consent as a legal basis and your country requires consent from a parent, we may require parental consent before we collect and use that information.

Links to other websites

Our Service may contain links to websites not operated by us. If you click a third-party link, you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of third-party sites or services.

Changes to this privacy policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Where appropriate, we may also notify you by email or through a prominent notice in the Service before changes take effect.

You are advised to review this Privacy Policy periodically. Changes are effective when posted on this page.

Contact us

If you have questions about this Privacy Policy or our use of your personal data, contact us:

• Email: info@iot-fabrikken.com (general and privacy enquiries)
• Product support: support@iot-fabrikken.com
• Phone: +45 71 71 80 90
• Post: IoT Fabrikken ApS, Brønsager 1, 4000 Roskilde, Denmark