Privacy Policy for Geberit Mobile Apps and IoT Services

This Privacy Policy applies to the use of the Geberit mobile apps (“Mobile App(s)”) and Internet of Things services (“IoT Services”), and the services they provide. Use of Mobile Apps and IoT Services requires us to process your personal data when you access certain services. By personal data, we mean any information relating to an identified or identifiable natural person.

2.1 The operator of Mobile Apps and IoT Services and the controller responsible for processing your personal data is Geberit International AG, Schachenstrasse 77, 8645 Rapperswil-Jona, Switzerland (“Geberit”).

2.2 Our data protection officer can be reached by email at dataprotection@geberit.com or at the postal address above for the attention of “The data protection officer”. To contact our data protection officer in confidence, please use DPO@geberit.com.

In each section, you will be informed of the legal basis for processing your data. The legal basis for some of our data processing operations is the contract you have concluded with us. Other data processing is carried out on the basis of our overriding legitimate interest. We will inform you of our overriding legitimate interest separately for each section. If you require further information about our legitimate interest, please contact us using the contact details provided in Section 2. You have the right to object to the processing of your personal data at any time, for reasons related to your particular situation

This section provides further information about what personal data we collect from you and how we process it. The legal basis for some of our data processing is our legitimate interest according to point f) of Article 6(1) of the General Data Protection Regulation (“GDPR”) together with the Protection of Personal Information Act, No 4 of 2013 (“POPI”). If you would like further information about our legitimate interest, please contact us using the details provided in Section 2. You have the right to object at any time to the processing of personal data relating to you, on grounds relating to your particular situation.

4.1 Download of Mobile Apps

When downloading Mobile Apps, certain information is passed on to your chosen online store for mobile applications (so-called apps). As this data is processed exclusively through the respective online store, the handling of this data is beyond our control. For more information, please refer to the terms of use and privacy policy of the respective online store provider.

4.2 Use of Mobile Apps and IoT Services

4.2.1 When you open Mobile Apps for the first time, we ask you to specify the country in which you intend to use it so that we can offer you services in the appropriate language and with the intended functionality. The legal basis for this is our contractual relationship with you pursuant to the “Terms of Use for Geberit Mobile Apps and IoT Services” and point b) of Article 6(1) of the GDPR and paragraph 2 of POPI.

4.2.2 When using Mobile Apps, the backend servers used to provide, for example, user manuals of Geberit products will automatically and temporarily collect information transmitted by your mobile end device in server log files. This data is as follows:

• IP address of the mobile end device sending the request
• Request path and arguments
• Request time
• Operating system of the mobile end device sending the request

The data in these server log files is not analysed in a way that identifies individual persons. In cases where the information listed above contains personal data (in particular the IP address), the legal basis for collecting this data is point (f) of Article 6(1) of the GDPR. The legitimate interest we pursue in collecting this data is to ensure the proper functioning of our Mobile Apps and IoT Services. The logging and analysis of the data also helps us ensuring the security of our IT systems. Your personal data is not processed further. Your personal data is deleted as soon as it is no longer required for the purpose for which it was processed, after 30 days at the latest. If the data is stored for other, similar reasons, your personal data is anonymised and de-identified so that you cannot be associated with or identified from this data.

4.2.3 If the Geberit ID is used for user authentication in Mobile Apps, the following information is stored locally on your mobile end device: unique identifier (“UID”) of the Geberit ID, your name, email address, phone number, and country. The UID is transmitted to a backend server to allow you to reset passwords of password-protected Geberit products. The legal basis is our legitimate interest according to point (f) of Article 6(1) of the GDPR and POPI in the ability to trace back unauthorised manipulations of Geberit products. The data is deleted as soon as it is no longer required for the purpose for which it was processed, generally after 30 years.

4.2.4 When using Mobile Apps, you have the option to voluntarily submit personal data, e.g. by registering your Geberit product, contacting us via email or contact form. This data is used by us to provide our services and handle your requests. This data will be solely collected by the responsible Geberit sales company. The data collection is subject to a separate privacy policy that is accessible on the corresponding Geberit website.

4.2.4 When using Mobile Apps, you have the option to voluntarily submit personal data, e.g. by registering your Geberit product or by contacting us via email or contact form. This data is used by us to provide our services and handle your requests. This data will be solely collected by the responsible Geberit sales company. The data collection is subject to a separate privacy policy that is accessible on the corresponding Geberit website.
If you are logged in with your Geberit ID, the data stored therein may be used to pre-fill forms. This processing takes place on the basis of the contract that you concluded with us when the Geberit ID was created.
You may also request a check whether your Geberit product is already registered. For this check, the serial number of your Geberit product will be transmitted to Geberit. This data transmission is based on your consent. You may withdraw your consent at any time with effect for the future by deleting your Geberit product in the Mobile App and then adding it again. Doing so will also automatically delete the registration status of the Geberit product in your app.

4.2.5 Service technicians commissioned by Geberit companies or representatives of Geberit companies’ customer service can retrieve technical data from your Geberit product via Mobile Apps and IoT Services in the course of service work and transmit the data to Geberit. This technical data comprises device data, statistical and diagnostic data such as model, article number, serial number (only in case of IoT Services), manufacturing date, installation date, firmware version, device settings, profile settings, meter readings from the device components, error codes, and event logs (e.g., errors, descaling events, flush events). This can be done on site by a service technician via Mobile Apps or, if initiated by you, remotely by a customer service representative via IoT Services. We need this data to provide you with our services on the basis of our contractual relationship and to improve our range of products and services as well as their functions and performance features through anonymised data analyses based on our legitimate interests. In the case of IoT services, the data is either deleted or completely anonymised as soon as it is no longer required for the purpose for which it was processed, usually after two years.

4.2.6 When using IoT Services, personal data associated with you or your Geberit ID is also collected for the purpose of the efficient handling of a service request and subsequent provision of service and support of compatible Geberit Connect and Geberit AquaClean products (e.g., remote configuration, maintenance, troubleshooting and fault clearance). This data will be solely collected by the responsible Geberit sales company.

4.2.7 If you configure the Geberit Gateway via Mobile Apps and the Geberit Gateway is permanently connected to the internet (e.g. via Ethernet or WLAN), you have the option of activating and using Geberit Cloud Services. This involves the regular transmission of the technical data listed in Section 4.2.5 to Geberit for the purpose of improving our range of products and services, as well as their functions and performance features, through anonymised data analyses. Activation of Geberit Cloud Services is voluntary and must be initiated by you via Mobile Apps (opt-in). The legal basis for this is your consent. You can revoke your consent at any time with effect for the future by deactivating Geberit Cloud Services in Mobile Apps. The data is then either deleted or completely anonymised as soon as it is no longer required for the purpose for which it was processed, usually after two years.

4.2.8 If Geberit Cloud Services are activated according to 4.2.7, you also have the option of activating notifications to be notified of important events related to the Geberit Gateway. For this purpose, your Geberit ID is linked to the serial number of the Geberit Gateway so that email notifications can be sent to the email address stored under the corresponding Geberit ID. The notifications are optional and must be activated by you via Mobile Apps (opt-in). The legal basis for this is your consent. You can revoke your consent at any time with effect for the future by deactivating notifications in Mobile Apps. The link will then be removed again and you will no longer receive notifications.

4.2.9 When you connect a Geberit product to Mobile Apps, we may ask you for permission to use device data from your Geberit product (opt-in). This device data is the technical data listed in Section 4.2.5 in completely anonymised form. The purpose of collecting this data is to improve our range of products and services, as well as their functions and performance features, through data analyses. The legal basis for this is your consent. The consent applies separately for each device and, in the case of the Geberit Gateway, also for the Geberit products connected to the gateway. You can revoke your consent at any time with effect for the future by deactivating the ‘Send device data’ setting in Mobile Apps. The collected data will be deleted as soon as it is no longer required for the purpose for which it was processed.

4.3 Analytic data

4.3.1 When using Mobile Apps, your chosen online store for apps and/or operating system provider may collect usage and diagnostics data such as, e.g., frequency of Mobile Apps usage and information on Mobile Apps crashes and provide it to us in aggregated and anonymised form. The collection of such data is governed by the terms of use and privacy policy of the online store and/or operating system provider and is thus beyond our control. The legal basis for viewing and evaluating this data on our side is a legitimate interest in the analysis, optimisation and economic operation of Mobile Apps.

4.3.2 When using Mobile Apps, we may ask you for permission to collect app usage data (opt-in). This includes information such as the type of your mobile device, the version and language of your operating system, the screen resolution, the time of access, and various usage data, such as data on the use of specific features of Mobile Apps and the type and condition of the connected Geberit products. We do not collect any personal data; instead, we only gather anonymised information that cannot be traced back to the user. We use this data to improve the functions and performance features of Mobile Apps and our products, as well as to resolve any malfunctions. The legal basis for processing this data is your consent. You can revoke your consent at any time with effect for the future by deactivating the ‘Send app usage data’ setting in Mobile Apps. The collected data will be deleted as soon as it is no longer required for the purpose for which it was processed, usually after two years.

4.4 Mobile Apps also use or link to one or more of the following tools and technologies

4.4.1 movingimage video hosting for functional movies

Functional movies for selected Geberit products are provided in Mobile Apps. These functional movies can assist you in the maintenance and care of your Geberit product. The video files are hosted on servers of a third-party service called movingimage (movingimage EVP GmbH, Tempelhofer Ufer 1, 10961 Berlin Germany) and from there they are downloaded to your mobile end device when you open the videos in Mobile Apps. During this process, certain information such as your IP address may be stored in the server log files of movingimage, which is beyond our control. More information can be found in the privacy policy of movingimage (please refer to https://www.movingimage.com/gtc/privacy-policy-of-movingimage-evp-gmbh/).

4.4.2 Geberit tools and web calculators in the Geberit Pro Mobile App

The Geberit Pro Mobile App embeds Geberit tools and web calculators such as, e.g., the SilentPanel Assistant and a tool for the determination of pipe diameters. The usage of these tools is governed by a separate privacy policy. More information can be found in the cookie settings banner that appears automatically when launching one of the tools in the Geberit Pro Mobile App.

Personal data is stored only locally on your mobile end device. Geberit has no access to this data and does not forward it to third parties. This may differ when using the Geberit ID, so please note the relevant data protection information of the Geberit ID.

As a data subject you have the right to access your personal data, have them corrected or deleted, restrict their processing or object to their processing.

Since we do not have access to your personal data on your local device, you can exercise these rights yourself by adjusting or deleting your information in Mobile Apps.

If you have any questions, please send us a written request using the contact details specified above or send an email to the following address: dataprotection@geberit.com.

If you would like to request the erasure of your data, simply email us at dataprotection@geberit.com. Generally speaking, we erase or anonymise your personal data as soon as it is no longer needed for the purposes for which we collected or used it in accordance with the sections above. If data needs to be retained for legal reasons, it will be blocked. This means that it will no longer be available for further processing. If you require further information regarding our erasure and retention periods, please contact us using the details provided above.

Your personal data will only be processed for purposes other than those described if a legal provision requires this course of action or if you have given your consent to the changed purpose of the data processing. In cases of further processing for purposes other than those for which we originally collected the data, we will notify you of these other purposes prior to the data being processed further, and will provide you with all other information that relates to this.

We do not use any automated processing systems for coming to specific decisions – including profiling.

The current version of this privacy policy is always available in Mobile Apps (typically under the “Information” or “More” menu items).

Version: October 2025

Changes compared with the previous version of this document (June 2025):

• Sections 4.2.3 and 4.2.4: Added information regarding the Geberit ID and data transfer