Privacy Policy

Introduction
Controller
Personal Data
Data Subject
Data Protection Officer
About the Shelly Service
Types of Personal Data That We Process for the Provision of the Service
Website Contact Forms and Inquiry Data
Shelly Fleet Manager Assistant (FMA) Mobile Application
Sub-Processors
Cross-Border Data Transfers
Retention of Data
The Service User's Rights as Data Subject
Information Security Measures
Privacy Policy Updates
Further Information

1. Introduction

Shelly Fleet Manager is a digital service enabling remote access, control, and monitoring of Shelly-branded devices and the appliances they are attached to.

This Privacy Policy applies to personal data processed when using Shelly Fleet Manager, accessible via Android/iOS or at https://fleet.shelly.com/, as well as when interacting with the Shelly Fleet Manager website (including contact forms, trial requests, and partnership inquiries). It is applicable whether used as a subscription-based pre-paid service or otherwise.

When users interact with Shelly Fleet Manager or its website, Shelly Europe Ltd. processes their data as detailed herein, ensuring compliance with applicable data protection laws like the European Union's General Data Protection Regulation (GDPR).

2. Controller

The data controller for Shelly Fleet Manager is:

Shelly Europe Ltd.
UIC: 202320104
Registered Address: 103 Cherni Vruh Blvd., Sofia, 1407, Bulgaria

3. Personal Data

Personal data refers to any information that identifies or could identify a natural person, as defined under GDPR. Examples include: name, identification number, location data, online identifiers, and other factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

4. Data Subject

The data subject under this policy is any registered user of the Shelly Fleet Manager service, categorized as either an Admin User or Account User.

5. Data Protection Officer

For inquiries about the processing of personal data, contact the Data Protection Officer:

Email: dpo@shelly.com

6. About the Shelly Fleet Manager Service

Shelly Fleet Manager provides monitoring and control capabilities for appliances via connected Shelly Devices. Key features include remote operation, power consumption measurements, schedule and mode configurations.

The service is accessible via mobile devices, laptops, and tablets. Shelly Devices are linked to only one account. The Admin User can share device data at their discretion.

7. Types of Personal Data That We Process for the Provision of the Service

7.1 Account Data

We process data such as:

Email addresses
Usernames
Passwords (encrypted)
Account ID
Language preferences and time zone
Customer support history and interactions

Purpose: Ensure secure service access, communication, and support.

Legal Basis: Performance of the contract (Art. 6(1)(b) GDPR).

7.2 Device Data & Service Usage

Collected data includes:

Shelly device identifiers (e.g., SSID, IP address, MAC address)
Configuration data from Shelly Devices (e.g., schedules, timers, operational modes)
Terminal device information (IP addresses, OS version, browser type)
Network and server credentials

Purpose: Enable device control, user interaction tracking, and system diagnostics.

Legal Basis: Performance of the contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

7.3 Data Processed with Explicit Consent

Includes personalized marketing emails and push notifications. Users can withdraw consent anytime via their account settings.

Legal Basis: Consent (Art. 6(1)(a) GDPR).

7.4 Data Processed Based on Legitimate Interest

Data processed for:

Fraud prevention and security monitoring
Monitoring service functionality and performance
Responding to and defending against legal claims

Legal Basis: Legitimate interest (Art. 6(1)(f) GDPR).

8. Website Contact Forms and Inquiry Data

When you submit a trial request, reseller partnership inquiry, or other contact form on our website, we collect and process the following personal data:

Name and email address
Company name and website (if provided)
Country (for reseller inquiries)
Use case description or business description
Fleet size (for trial requests)
Referral source (if provided)
IP address — collected for anti-spam and rate-limiting purposes
Timestamp of submission

Purpose: To process your inquiry, follow up with relevant information about Shelly Fleet Manager, prevent spam and abuse, and evaluate potential partnerships.

Legal Basis: Legitimate interest in responding to business inquiries and preventing abuse (Art. 6(1)(f) GDPR). Where your inquiry relates to entering into a contract for the Service, the legal basis is also pre-contractual measures at your request (Art. 6(1)(b) GDPR).

Form submissions are stored on our servers and forwarded to our sales team via email for follow-up. IP addresses are used solely for rate-limiting and are not shared with third parties.

9. Shelly Fleet Manager Assistant (FMA) Mobile Application

The Shelly Fleet Manager Assistant (FMA) is a companion mobile application that facilitates device provisioning and integration with the Shelly Fleet Manager platform.

The FMA app authenticates users via a token-based mechanism linked to their Fleet Manager account. The app does not independently store personal data on the user's device beyond the authentication token required for its operation. Any data transmitted through the app is processed in accordance with the same terms described in this Privacy Policy for the Fleet Manager service.

Legal Basis: Performance of the contract (Art. 6(1)(b) GDPR).

10. Sub-Processors

We engage the following third-party service providers (sub-processors) to assist with data processing in connection with the Shelly Fleet Manager service and website:

Provider	Purpose	Location
Google Cloud Platform (GCP)	Infrastructure hosting, data storage, and computing services for the Fleet Manager platform	EU (Belgium/Netherlands data regions)
Brevo (formerly Sendinblue)	Transactional email delivery (SMTP relay) for form submission notifications and service communications	EU (France)

All sub-processors are bound by Data Processing Agreements (DPAs) ensuring GDPR-compliant data handling. Data processed by sub-processors is limited to what is strictly necessary for the purpose described.

11. Cross-Border Data Transfers

Your personal data is processed primarily in Bulgaria (EU). For service providers located outside the EU/EEA, we ensure compliance with GDPR by implementing appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved by the European Commission, particularly for providers in regions like the United States.

12. Retention of Data

Data retention depends on the processing ground:

Contractual obligations: Data is retained while the account is active and for a reasonable period thereafter.
Consent: Data is deleted upon withdrawal of consent.
Legitimate interest: Data is retained for the duration of the specific purpose.
Legal compliance: Data is retained per statutory requirements and regulations.
Website contact forms: Trial requests, reseller inquiries, and related form submissions (including associated IP addresses) are retained for a maximum of 24 months from the date of submission. If no contractual relationship is established within this period, the data is deleted.

Data may be retained longer if linked to unresolved legal disputes or where required by applicable law.

13. The Service User's Rights as Data Subject

Under the GDPR, you have the following rights regarding your personal data:

13.1 Right to Access (Art. 15 GDPR)

You may request a copy of your personal data free of charge.

13.2 Right to Rectification (Art. 16 GDPR)

You may correct inaccurate information through your account settings or by contacting support.

13.3 Right to Erasure — Right to Be Forgotten (Art. 17 GDPR)

You may request deletion of your personal data under applicable conditions. You can delete your account and associated data via account settings.

13.4 Right to Restriction of Processing (Art. 18 GDPR)

You may request temporary restriction of data processing in certain situations.

13.5 Right to Data Portability (Art. 20 GDPR)

You may request your data in a machine-readable format for transfer to another service.

13.6 Right to Object (Art. 21 GDPR)

You may object to data processing based on legitimate interest or direct marketing.

13.7 Right to File a Complaint

You have the right to file a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at: dpo@shelly.com

14. Information Security Measures

We prioritize the security and confidentiality of your data by implementing advanced encryption, regular audits, and comprehensive technical and organizational safeguards in accordance with industry best practices. While no system is entirely impenetrable, we strive for maximum data protection.

15. Privacy Policy Updates

This Privacy Policy may be updated to reflect service changes, legal developments, or compliance requirements. Users are notified of material changes via email or on the platform. Updates are effective upon publishing.

16. Further Information

For questions about this Privacy Policy or data processing, contact us at: