This privacy policy explains how we collect and use your personal data, cookies and similar technologies. It also describes your rights towards us and how you can exercise them. We only process personal data in accordance with this privacy policy and the General Data Protection Regulation (EU 2016/679, "GDPR").
Last updated: 2nd October 2026
1.1 ComfortID is a pilot service operated by Stockholm Exergi AB, corporate identity number 556016-9095, 115 77 Stockholm, customer service and switchboard number: +46 (0) 2031 3151, ("Stockholm Exergi", "ComfortID", "we", "us"). ComfortID is not a separate legal entity; Stockholm Exergi AB is the controller of the processing described in this policy. Contact details are given in Section 12. Data Protection Officer is Stefan Färnström at dataskydd@stockholmexergi.se
1.2 Building administrators or property owners decide which buildings and apartments take part in the pilot and invite residents. The pilot is performed in cooperation with Kungliga Tekniska Högskolan och RISE.
You may choose to give us your personal data. This includes information submitted when you visit our website, use our Services (including our web application and mobile apps) or if you contact us (collectively referred to as “Services” in this privacy policy).
We will process the following categories of personal data that you give us:
2.1 When you create a trial account: name and company email address.
2.2 When you create a user account: your name and email address (needed for login and invitations). You may add a phone number. For business customers we also process company name, office address and VAT-number.
2.3 Comfort profile (optional): age, gender, height and weight. We use these details only to personalize the thermal comfort model that controls heating in your home (see Section 5). All fields are voluntary. You can leave them empty, change them or delete them at any time in your account, and the basic Services work without them.
2.4 Comfort ratings and settings: your feedback on how you perceive the indoor climate (for example "too cold" or "too warm"), together with the time and the room or zone it relates to, as well as your preferred temperature range, away temperature and manual temperature requests. Giving comfort ratings is voluntary.
2.5 When you subscribe to our newsletter: name and email address.
2.6 When you send us a job application: name, email address, records to evaluate your suitability for the position, your CV and cover letter, as well as other personal data as may be relevant for the specific application.
2.7 If you contact us: we may ask for additional personal data other than as informed above, in order to assist you.
2.8 Your email address is necessary to create and manage an account. All other data in 2.2 to 2.4 (phone number, age, gender, height, weight, comfort ratings) is voluntary.
We will process the following categories of personal data that we collect:
3.1 To administer payments and invoice you: name, email address and phone number of the contact person as well as your company name, office address and VAT-number.
3.2 To manage the customer or supplier relationship: name, email address and company name.
3.3 Building and device data: when thermostats and sensors are installed in your home or building, we process room or zone temperature, humidity, thermostat settings and valve positions, battery and connectivity status, heating energy use, and information derived from these data such as comfort scores and whether a room or home appears to be occupied or vacant (automatic vacancy detection). Because such data can be linked to a specific home and its residents, we treat it as personal data.
3.4 Data about you from your building administrator: if a building administrator or property owner invites you to use the Services, they give us your email address (and possibly name and the zone you are linked to). We use it to send you the invitation and to set up your access in collaboration with the dedicated building administrator.
3.5 Technical and security data: IP-address, WiFi SSID, device and browser information, app version, time stamps and log entries when you use our website or apps, as well as a record of administrative actions performed in the Services.
3.6 Location (mobile apps, optional): if you allow location access, the app uses a geofence, i.e. a virtual boundary around your home, to detect when you leave or arrive and to switch between home and away heating. Your location is not tracked: we do not record or store movement or location history. Only the resulting entry/exit of geofences event or status is sent to our servers, and the geofence is evaluated on the device. Location access only starts after you grant permission and you can withdraw it at any time in your device settings.
4.1 Strictly necessary cookies. We use cookies and similar technologies that are necessary to provide the Services you request, for example to keep you logged in and to protect forms against misuse. These do not require your consent.
4.2 Analytics and other tracking. We may use analytics and similar tracking technologies to understand how our website and Services are used and to improve them, for example which pages are visited and how often, and technical information about the device and browser. Such technologies, other than those that are strictly necessary, are only used if you have given your consent, which you can give or withdraw at any time via mail to support@comfortid.org. Information collected this way is not used to identify you personally or to build advertising profiles, and we do not sell it.
4.3 Transparency and changes. The tools actually in use, their purposes, the data collected and the retention periods are listed in Section 4.5. If we introduce a new tool or a new purpose, we will update this policy first and ask for your consent before it is activated.
4.4 Browser settings. You can also adjust your web browser settings to not accept cookies or to indicate when a cookie is used. Please note that by disabling cookies, some features on our website might not work as intended.
4.5 Tools currently in use: At the time of the last update, we do not use any web analytics or other non-essential tracking tools on our website or in our apps.
4.6 Social media is used for marketing purposes such as www.youtube.com.
5.1 We use your personal data to be able to provide our Services and fulfill our commitments towards you. We process personal data based on the following legal grounds.
| Purpose of the Processing | Personal Data Categories | Legal Basis for the Processing | Storage Period |
|---|---|---|---|
| Manage your user account. | Name, email address and phone number of the contact person as well as your office address. | Fulfill our contractual obligations towards you (Art. 6(1)(b)). | As long as you are a customer, and one year after. |
| Provide heating control and comfort optimization (including manual requests, away mode and vacancy detection). | Building and device data (3.3), your temperature settings (2.4). | Performance of the terms of use you accept at registration (Art. 6(1)(b)). | Raw data: [36 months]; thereafter aggregated or anonymized. Deleted with the account, subject to Section 5.2. |
| Switch between home and away mode (geofence). | Home/away status derived from geofence events (3.6). | Your consent (Art. 6(1)(a)), given through the device location permission. You can withdraw it at any time. | Current status only; no location history. |
| Personalize the comfort model with your comfort profile and ratings. | Age, gender, height, weight (2.3), comfort ratings (2.4). | Your consent (Art. 6(1)(a)); to the extent body measurements are regarded as health data, your explicit consent (Art. 9(2)(a)). You can withdraw consent at any time; withdrawal does not affect earlier processing. | Until you withdraw consent or delete your profile, or the account is closed. |
| Provide support services. | Name, email address and phone number of the contact person. | Fulfill our contractual obligations towards you (Art. 6(1)(b)). | As long as necessary to provide the support, and one year after. |
| Invite residents and set up access on behalf of a building administrator. | Email address, name and zone assignment (3.4). | Legitimate interest (Art. 6(1)(f)) in providing the Services to the building and its residents. | Until the invitation is accepted or [x days]; account data thereafter as above. |
| Send you our newsletter and provide updates and other information regarding our Services. | Name and email address. | Your consent (Art. 6(1)(a))[ or, for existing customers, legitimate interest]. | As long as we send out such information, unless you unsubscribe. |
| If you contact us. | Name, email address and phone number of the contact person. | Legitimate interest in answering your request (Art. 6(1)(f)), or contractual obligations if you are a customer. | As long as is necessary to assist you. |
| Operate, secure and troubleshoot the Services. | Technical and security data (3.5). | Legitimate interest in security and stability (Art. 6(1)(f)). | [5 days/months] |
| Improve our website and understand how it is used (only if analytics is active, see Section 4). | Analytics data as described in Section 4.5. | Your consent (Art. 6(1)(a)). | As stated in Section 4.5. |
| Administer customer relationship, including order and payment processing. | Name, email address and phone number of the contact person. | Fulfill our contractual obligations towards you, and a legal obligation (Art. 6(1)(b), (c)). | 7 years after creation due to book keeping legislation. |
| Manage your job application or application to a specific job position. | Name, email address and phone number as well as other personal data provided by you. | Legitimate interest (Art. 6(1)(f)), and consent if stored longer. | Until the position has been filled. Subject to your explicit consent, we may ask to store it for a longer period. |
5.2 Your personal data will be deleted by us when the processing is no longer necessary for the purposes stated above, except if required by applicable laws. In such case, we keep the data only as long as necessary or mandated by law for such purpose, such as for book keeping purposes.
5.3 Where legitimate interest is the legal basis, you have the right to object (see Section 8).
5.4 No automated decisions with legal or similar effects. Our Services calculate heating schedules and temperature trajectories automatically from your settings, ratings and sensor data. These calculations do not produce legal effects concerning you or similarly significantly affect you. You can always override them by manual temperature requests, and you can ask us for information about how they work.
5.5 We may use data in anonymized or aggregated form (no longer relating to an identifiable person) for research and to improve our models.
6.1 We share your personal data with the following recipients to provide our Services and perform our contractual obligations towards you:
| Recipient (service name) | Region for processing | Transfer mechanism | Services provided |
|---|---|---|---|
| Amazon Web Services (AWS), Amazon RDS and related infrastructure services | EU (North). Access by AWS entities outside the EU/EEA cannot be fully excluded. | Data processing agreement; EU-U.S. Data Privacy Framework (AWS is certified) and/or EU Commission Standard Contractual Clauses | Database hosting and storage |
| Ionos | EU | Processing of emails | Sending invitations, notifications and newsletters |
| The Things Industries | Europe | Personal information is not provided, but the devices installed in your residence are addressed | Transmission of sensor and thermostat messages |
| Your building administrator or property owner | Your Premises | Own responsibility / agreement with us | Access to building-level information and, as far as necessary for managing the building, to zone information. [Specify exactly which resident data (contact details, comfort scores, occupancy) the administrator can see.] |
6.2 Our processors are bound by contract and by law to use personal data only for the purposes for which it is shared. We take all reasonable legal, technical, and organizational measures to ensure that your personal data is treated securely and with an adequate level of protection.
6.3 If we are required by law or you have agreed to it, we will disclose necessary personal data to authorities such as the police, tax agencies or other authorities. An example of legally required sharing is for the purposes of anti-money laundering and counter-terrorist financing.
6.4 In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets. If we or substantially all of our assets are acquired by a third party, personal data about our customers may be disclosed and transferred.
7.1 Our primary database (Amazon RDS) is hosted by AWS in the EU, in Stockholm, and personal data is stored and processed there. Because AWS belongs to a group headquartered in the United States, access from outside the EU/EEA cannot be fully excluded. In that case we rely on the EU-U.S. Data Privacy Framework (AWS is certified) and/or the EU Commission’s Standard Contractual Clauses. You can request a copy of the safeguards using the contact details below.
Under the GDPR you have the following rights. You can exercise them by contacting us (Section 12); we will answer within one month. We may need to verify your identity first. Exercising your rights is free of charge.
8.1 Access. You have the right to receive confirmation whether we process personal data about you and a copy of that data and further information about the processing.
8.2 Rectification. You have the right to have inaccurate or incomplete data corrected. Please keep your account updated at all times.
8.3 Erasure. You have the right to have your personal data deleted where the legal conditions are met, for example if the data is no longer necessary or you withdraw your consent. We may have to keep some data (for example invoices) as required by law.
8.4 Restriction. You have the right to ask us to restrict processing in certain cases, for example while we verify the accuracy of data you contest.
8.5 Data portability. For data you have provided to us and that we process based on consent or contract, you have the right to receive it in a structured, commonly used, machine-readable format or have it transferred to another provider.
8.6 Objection. You have the right to object at any time to processing based on our legitimate interests. You can also object at any time to direct marketing.
8.7 Withdrawal of consent. Where processing is based on consent (for example your comfort profile, newsletter or analytics cookies), you can withdraw it at any time, as easily as you gave it.
8.8 Complaints. If you are displeased with our processing of personal data, please contact us first. You can also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, phone +46 8 657 61 00, email imy@imy.se, or with the data protection authority in the EU member state where you live or work.
We use appropriate technical and organizational security measures to ensure that your personal data is not misused, lost or unlawfully accessed. Users can only see data of the buildings and zones to which a building administrator has explicitly assigned them; users who are not assigned have no access. We only give access to personal data to those employees who require it to provide the Services. [Add only what is true, e.g. encryption in transit and at rest, logging of administrative actions]
Our Services are not directed at children under [9] and we do not knowingly collect personal data from them.
11.1 We may occasionally update this privacy policy. If we make significant changes, we will notify you of the changes through our Services or through other means, such as email. Where a change requires your consent (for example a new analytics tool), we will ask for it before the change takes effect.
11.2 We encourage you to periodically review this privacy policy for the latest information on our privacy practices.
If you have any questions regarding our processing of your personal data, or any question, complaint or claim, please contact us at:
ComfortID, a pilot service of Stockholm Exergi AB
115 77 Stockholm
E-mail: info@comfortid.org
www.ComfortID.org