GDPR and your data

Last updated: August 2026

This page explains what happens to personal data when we design, install and service a smart home for you. It is about the service relationship, not about browsing this website.

For the website itself, see the Privacy Policy.

  1. Who is responsible

    Pinout Limited, a private limited company registered in the Republic of Cyprus under number HE 446523, registered office Evripidou 12A, Agia Zoni, 3031 Limassol, Cyprus. We are the controller of the data described below, and you can reach us at info@pinout.cloud about anything on this page.

    We have not appointed a data protection officer, and Article 37 GDPR does not require one: we can reach a system only after its owner switches access on, and in practice only while we are in a meeting with them, so nothing we do amounts to regular, systematic, large-scale monitoring.

  2. Where we decide and where you decide

    We are the controller of your contact details, the address of the property, our correspondence with you and our invoicing records. For the data held inside your own system, which we see during a servicing session, we act as a processor on your instructions: that data is yours, and we handle it only to deal with the matter you reported.

  3. What stays in your home

    Your smart home runs locally. The following never reaches us in normal operation:

    • sensor readings and occupancy history
    • camera streams
    • schedules, scene history and the state of every device

    It is not collected as telemetry or analytics, it is not passed to anyone, and it is not used to train anything. We do not run a cloud account that your system reports into.

  4. What we do hold, and for how long

    • Your name, contact details and the address of the property — to perform the contract and to attend. Kept for the term of the contract, then the statutory limitation period.
    • Invoices and payment records — because the law requires it. Kept six years from the end of the tax year.
    • The composition of your system — to support it and to honour the warranty. Kept for the term of the contract.
    • Servicing correspondence and fault history — to diagnose recurring faults. Kept for the term of the contract, then the statutory limitation period.
    • Remote access logs — so that you can audit what was done. Kept for the term of the contract.

  5. Our legal grounds

    • Performing our contract with you — Article 6(1)(b): your details, the composition of your system, servicing correspondence.
    • A legal obligation — Article 6(1)(c): invoices and payment records.
    • Legitimate interests — Article 6(1)(f): session logs, so that we are accountable to you and you can check what was done.
    • Your consent — a remote session, or a photograph used outside the job record. You may withdraw it at any time, and withdrawing it affects nothing else.

  6. How we connect

    We hold no standing means of reaching your system. A servicing session runs over SSH and can be opened only after you press "allow outside access" in your smart home interface — until you do, we cannot connect at all. Switching it back off is your action too: no reason needed, no notice to us. Every session is logged with its date, duration and purpose, and the log is yours on request. We install no permanent access, no hidden account, and no component that would let us connect without your knowledge.

    Cloud access you use to reach your own home from an app is a different thing. That is a Nabu Casa subscription you hold yourself, its own privacy notice covers what it holds, and it is not the route we use for servicing.

  7. Who else sees it

    • Our engineers and any subcontractor we send to your home, all bound by the same confidentiality obligation in their contract with us. We remain responsible to you for them.
    • Nobody else at the property: not a developer, a management company, a concierge, a first-line engineer, a neighbour or another resident.
    • An authority, but only where a court order, a lawful request or a statutory obligation requires it. We tell you unless we are prohibited from saying so, and we disclose no more than the request requires.

  8. Transfers outside the EEA

    We do not transfer your personal data outside the European Economic Area. A servicing session is an SSH connection from Cyprus into your own home, and nothing is copied out of it. A cloud subscription you take yourself is your contract with that provider, and any transfer it makes is governed by its terms, not ours.

  9. Your rights

    You may ask us for:

    • a copy of the data we hold about you
    • its correction
    • its erasure, where no statutory obligation requires us to keep it
    • its transfer to you in a portable form
    • restriction of processing, or objection to processing we base on legitimate interests

    Write to info@pinout.cloud and we answer within one month. If our answer does not satisfy you, you may complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, and you may also go to court.

  10. Automated decisions

    We take no decision about you by automated means, and we do not profile you.

  11. If something goes wrong

    Where a personal data breach affects you, we tell you without undue delay and in any event within 72 hours of becoming aware of it, say what happened and what data was affected, and say what we are doing about it.

  12. Clients who have signed an agreement

    Everything above is also a contractual commitment: Annex 1 of our framework agreement makes it binding on us. Where this page and that annex differ, the annex governs — a page we can edit is not allowed to cut down what we signed.