Data Processing Agreement
In force from 28 September 2026
Shelly Fleet Manager and Shelly Business Manager – Data Processing Agreement between the Customer (controller) and Shelly Europe Ltd. (processor) under Art. 28 GDPR and the UK GDPR.
1. Parties and scope
This Data Processing Agreement ("DPA") is concluded between the Service Client as defined in the Shelly Fleet Manager General Terms and Conditions (the "Customer", controller) and Shelly Europe Ltd., UIC 202320104, 103 Cherni Vrah Blvd., 1407 Sofia, Bulgaria ("Shelly", processor). It forms an integral part of the Service Agreement and the General Terms and Conditions (Terms, section 3.2 and 9.1).
It applies to all personal data that Shelly processes on behalf of the Customer when providing Shelly Fleet Manager (web platform, Fleet Manager Assistant (FMA) app, APIs) and Shelly Business Manager (the portal where installers design, deploy and run branded portals for their clients, each running on its own Fleet Manager tenant), together the "Service" ("Customer Personal Data"). Annex I describes the processing.
Installers running portals for their own clients. Where the Customer uses the Service to provide services to its own clients (for example an installer running a Business Manager portal for a building owner), the Customer may itself be a processor for those clients. In that case Shelly acts as the Customer's sub-processor under this DPA, and the Customer is responsible for having an agreement with its clients that allows the use of Shelly and its sub-processors.
It does not apply to data for which Shelly is itself the controller: account and billing management, support, the website, marketing, and contacting registered users to understand their problems and improve the Service. For these purposes Shelly uses the name and registration e-mail of the people who registered for the Service with Shelly as an independent controller, as described in the Privacy Policy. Shelly may contact everyone who has an account in the Service – Fleet Manager customers and their users, Business Manager portal users (installers), and the users installers create for their own clients – at the e-mail address used for registration, to understand how they use the Service, ask about problems they face, invite them to short feedback calls or surveys, and improve Shelly's services. These messages are not advertising, and every message includes an easy way to say no to further contact. Saying no does not affect the account; essential service messages (security, billing, changes to the terms) are still sent.
2. Instructions
- Shelly processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's configuration and use of the Service (for example adding devices, users, sites, alert channels and integrations) are the Customer's instructions.
- Shelly informs the Customer immediately if it considers an instruction to infringe the GDPR or other data protection law.
- If EU or Member State law requires Shelly to process data otherwise, Shelly informs the Customer before processing unless the law prohibits it.
3. Confidentiality
Shelly ensures that everyone authorised to process Customer Personal Data is bound by confidentiality, by contract or by law, and has access only where needed to run, support or secure the Service.
4. Security
Shelly implements the technical and organisational measures in Annex II and keeps them appropriate to the risk (Art. 32 GDPR). Shelly may update the measures if the overall level of protection does not go down.
5. Sub-processors
- The Customer gives general authorisation for Shelly to use sub-processors. The current list is in Annex III.
- Shelly informs the Customer of any intended addition or replacement at least 30 days in advance by e-mail to the account administrator and/or on fleet.shelly.com. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot agree, the Customer may terminate the affected Service without penalty.
- Shelly imposes on each sub-processor data protection obligations equivalent to this DPA and remains liable to the Customer for its sub-processors.
- Integrations and notification channels that the Customer connects are not Shelly sub-processors: Slack, Microsoft Teams, Telegram, Twilio (SMS), the Customer's own SMTP server or Gmail / Microsoft 365 account, Amazon Alexa and custom webhooks. These are configured and chosen by the Customer; data sent there is a transfer on the Customer's instruction, not a sub-processing by Shelly.
6. International transfers
Customer Personal Data is hosted in the European Union. Where a sub-processor processes data outside the EEA, Shelly ensures a valid transfer mechanism: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the EU Standard Contractual Clauses (Commission Decision 2021/914), with supplementary measures where needed. Annex III names the safeguard for each sub-processor.
7. Helping the Customer
- Data subject requests. Shelly helps the Customer answer requests (access, rectification, erasure, restriction, portability, objection) using the Service's features – user management, device and location deletion, CSV and report exports, audit export – and, where these are not enough, on request within 10 working days. Requests sent to Shelly directly are forwarded to the Customer without answering them.
- DPIAs and consultations. Shelly provides the information the Customer reasonably needs for its own data protection impact assessment, for example this DPA, its annexes and the Shelly DPIA summary.
- Security and breach duties. Shelly assists with Art. 32–36 GDPR obligations as described in this DPA.
8. Personal data breaches
- Shelly notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
- The notice includes, as far as known: what happened, the categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point. Information may be provided in stages.
- Shelly does not notify supervisory authorities or data subjects about Customer Personal Data on the Customer's behalf unless the Customer asks it to.
9. End of the contract
During the contract, Customer Personal Data is kept for as long as the Customer needs it; the Customer can delete users, devices, sites and measurement data at any time using the Service. When the contract ends, the Customer can export its data for 30 days. On day 30 after termination Shelly automatically deletes the Customer's tenant (application, database, files and identity organisation) and all Customer Personal Data, unless law requires storage. Backups are overwritten under the normal backup cycle within 14 days. Shelly confirms deletion in writing on request.
10. Audits
Shelly makes available the information needed to demonstrate compliance with Art. 28 GDPR. The Customer may audit Shelly, including by an independent auditor bound by confidentiality, once per year or after a personal data breach, with at least 30 days' notice, during business hours and without access to other customers' data. Shelly may first answer by providing documentation, certifications or audit reports. Each party bears its own costs unless the audit reveals a material breach by Shelly.
11. Customer duties
- The Customer is responsible for the lawfulness of its processing, including a legal basis and informing the people concerned – for example employees whose actions are logged, tenants or residents in monitored buildings, and people entered as site or emergency contacts.
- The Customer decides whether monitoring of occupancy, door and motion sensors or energy use in homes or workplaces is proportionate and carries out any DPIA it requires.
- The Customer keeps its users' credentials safe, assigns roles on a need-to-know basis and enables multi-factor authentication where available.
12. UK GDPR
Where the Customer is subject to the UK GDPR, references to the GDPR include the UK GDPR and the Data Protection Act 2018, and references to the supervisory authority include the Information Commissioner's Office. Hosting in the EEA is covered by the UK adequacy regulations for the EEA. For sub-processors outside the UK and EEA, the International Data Transfer Addendum to the EU SCCs applies.
13. Liability, term and precedence
Liability follows the Terms, except where the GDPR provides otherwise. This DPA lasts as long as Shelly processes Customer Personal Data. If it conflicts with the Terms on data protection, this DPA prevails.
Annex I – Description of the processing
| Item | Description |
|---|---|
| Subject matter | Providing Shelly Fleet Manager: remote monitoring, control, alerting and reporting for fleets of Shelly devices, including the FMA app and APIs. |
| Duration | The term of the Service Agreement plus the deletion period in section 9. |
| Nature and purpose | Hosting, storing, displaying, analysing (energy reports, baselines, alerts), sending notifications, logging for security and audit, deploying and styling Business Manager portals (including with the AI template editor), support on the Customer's request. |
| Data subjects | The Customer's users (employees, contractors, installers); Business Manager portal users; the clients of an installer and their users; people entered as site owners, tenants, facility managers or emergency contacts; recipients of alerts; occupants of monitored buildings whose presence or energy use can be inferred from device data. |
| Categories of data | User data: name, e-mail, role, organisation, profile picture, login and session data, preferences, quiet hours, push tokens. Activity data: audit log (user, action, device, time, IP address), alert acknowledgements and notes, dashboard activity. Site data: location names, postal addresses, coordinates, floor/room, opening hours, primary and emergency contacts (name, phone, e-mail). Device data: device IDs and MAC-based identifiers, device names, configuration and status, Wi-Fi network name (SSID) and local IP, encrypted device passwords, Bluetooth sensor addresses. Measurement data: energy, power, voltage, current per device and phase; door, motion, occupancy and other sensor events; consumption baselines. Notification data: channel settings, recipient e-mail addresses and phone numbers, message content. Business Manager data: portal accounts, projects and client company names, branding assets and uploaded images, AI template editor conversations, activity and usage reports, feedback submissions. |
| Special categories | Not intended. Presence patterns can indirectly reveal habits, and – if the Customer monitors e.g. assisted living – health-related circumstances. The Customer must assess this. |
| Retention | As long as the Customer needs the data; the Customer can delete it at any time. All Customer Personal Data is deleted automatically 30 days after the contract ends (section 9). Short technical limits apply regardless: device status 24 h, device event log 30 days, raw energy 31 days (after roll-up), audit log 90/180/730 days by category, reports 30 days. |
| Location of processing | EU – Google Cloud, Belgium (europe-west1). |
Annex II – Technical and organisational measures
| Area | Measures |
|---|---|
| Encryption in transit | All web and API traffic over HTTPS (TLS via Traefik / Caddy with Let's Encrypt certificates). Devices connect over secure WebSocket (wss) with mutual TLS using a Fleet Manager root CA. |
| Encryption at rest | Device web passwords, integration secrets and OAuth tokens are encrypted with AES-256-GCM (key derived with scrypt from a server secret). Google Cloud encrypts all disks at rest by default (Google-managed keys). |
| Access control – users | Identity managed by a self-hosted Zitadel instance (OpenID Connect). Passwords hashed with bcrypt (cost 12). Account lockout after 10 wrong passwords / 5 wrong one-time codes. Passkeys and MFA available. |
| Access control – roles | Role-based access: admin, manager, editor, installer, operator, automation admin, auditor, viewer. Every request is checked against the user's role and organisation. |
| Tenant separation | Each customer runs in its own application container, own network, own database and database user, and own cache key space. Rows are also scoped by organisation id. |
| Rate limiting and abuse protection | Login endpoints limited (10/min, burst 30); API calls limited per user and method (240/min, 30/min for heavy calls); per-route HTTP limits. |
| Logging and audit | Audit log of logins, device commands, device add/delete, rate-limit events, permission changes and credential reveals (with justification), with retention by category. |
| Secrets handling | Secrets passed as environment variables to containers; credential reveal requires a written justification and is audited. |
| Availability and backups | Daily backup of the identity database kept 14 days; fleet database backed up before every update. Container restart policies; log rotation. |
| Data minimisation | Device IP addresses at onboarding stored only as a hash; website analytics without cookies (daily pseudonymous hash); Wi-Fi passwords sent to the device over Bluetooth only, never to the server. |
| Erasure | Deleting a user (in Zitadel) triggers an automatic erasure cascade: assignments, tokens, push tokens, inbox, preferences removed; name anonymised in audit and alert history. |
| Hardening | Containers run with no-new-privileges; cache (Redis) protected with ACL users and not written to disk; open-source code reviewed through merge requests. |
| Organisational | Access to production servers limited to named engineers with SSH keys; staff bound by confidentiality; incident procedure (document 06). |
Annex III – Sub-processors
| Sub-processor | What for | Personal data | Location | Safeguard |
|---|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd. / Google LLC) | Hosting: virtual machines, disks and networking for all Fleet Manager stacks (application, databases, identity service) | All personal data in the Service | EU – Belgium (europe-west1) | Google Cloud DPA; SCCs + EU-US Data Privacy Framework for any access from outside the EU |
| Google Firebase Cloud Messaging (Google LLC) | Push notifications to the Fleet Manager Assistant (FMA) app; iOS delivery is passed on to Apple Push Notification service | Push token, device platform, notification title/text (may include device and location names) | USA / global | Google DPA; EU-US Data Privacy Framework; SCCs |
| Anthropic PBC | Business Manager AI template editor: turns the installer's chat requests into portal design and template changes | Chat messages, uploaded images and logos, template settings; any names the user types into the chat | USA | Anthropic commercial terms and DPA with SCCs; API data not used for model training |
| Apple Inc. (Apple Push Notification service, via FCM) | Delivering push notifications to iPhones | Push token, notification text | USA | Apple terms; EU-US Data Privacy Framework |
| OpenStreetMap Foundation (Nominatim) | Turning site addresses into map coordinates and back (geocoding) | Location addresses and coordinates entered for sites (not linked to a person by the Service) | United Kingdom | UK adequacy decision |
| CARTO / OpenFreeMap (map tiles) | Map background shown in the web app; loaded directly by the user's browser | User's IP address and requested map area | EU (CARTO: Spain); OpenFreeMap as fallback | Provider terms; only IP address and requested map area |
E-mail: All e-mails from Fleet Manager and Business Manager (account verification, password reset, one-time codes, Business Manager feedback) are sent through Shelly's own mail server (mail.shelly.cloud), which Shelly runs on Google Cloud in Belgium. No separate e-mail provider is used. Alert e-mails go out through the SMTP server or Gmail / Microsoft 365 account that the Customer configures.
Optional integration – not active:
| Recipient | What for | Personal data | Location | Safeguard |
|---|---|---|---|---|
| Amazon (Alexa Smart Properties) | Shelly Fleet Manager Skill for Alexa Smart Properties – NOT AVAILABLE YET. Only if a Customer enables it in future: the Skill passes device names and states requested by voice between Fleet Manager and the Customer's Alexa Smart Properties account. | Device and location names, device states, voice requests handled by Amazon under the Customer's own Amazon agreement | Amazon's locations (incl. USA) | Enabled only on the Customer's instruction. Shelly will update this annex and notify Customers at least 30 days before the Skill is launched. |
| Stripe Payments Europe Ltd. | Card payments for Business Manager projects – configured but NOT USED while Business Manager is free | Billing contact, payment details (held by Stripe, not Shelly) | EU (Ireland); Stripe Inc. USA | Stripe DPA; SCCs / DPF. Shelly will update this annex before charging for Business Manager. |
Services that receive no personal data (listed for transparency):
| Service | Use |
|---|---|
| Electricity Maps (api.electricitymap.org) | Grid carbon intensity by zone – only the zone code is sent |
| ENTSO-E Transparency Platform | Day-ahead electricity prices – no personal data sent |
| Let's Encrypt | TLS certificates – only domain names |
| GeoNames (download.geonames.org) | Place-name data downloaded offline – nothing sent |
| Shelly CDN (control.shelly.cloud) | Device pictures and logo in e-mails – loaded by the recipient's mail client (IP address visible to Shelly) |
Customer-chosen channels and integrations: Slack, Microsoft Teams, Telegram, Twilio (SMS), the Customer's own SMTP server or Gmail / Microsoft 365 account, Amazon Alexa and custom webhooks. These are configured and chosen by the Customer; data sent there is a transfer on the Customer's instruction, not a sub-processing by Shelly.
Acceptance
The Customer accepts this DPA by ticking the box when creating an account in Shelly Fleet Manager or Shelly Business Manager, or by signing the subscription form. It applies from that moment. Version of 28 September 2026.