Privacy Notice

This Privacy Notice describes how KLAB d.o.o. (Kft.) (the "we", "iMeter") processes the personal data of end-users and customers of the iMeter service, the customer portal, the mobile application and this website (together, the "service").

1. Data controller

KLAB d.o.o. (Kft.)
Petefi Šandora 28, 24321 Mali Iđoš, Serbia
Registry number: 20517697
VAT / PIB: 106026695
info@imeter.hu
+36 20 345 0880

Data Protection Officer (DPO): klevente@klab.rs

2. What data we process

We only collect personal data that is necessary for providing the service, billing and operating the portal and the mobile application:

• Account and login data — your email address, which is your login identifier and the address we send service emails to (account verification, password reset and the notification emails you have enabled); your hashed password (we never store it in readable form); and, where used, your username. We send newsletters only if you have opted in.
• Profile data — your name, your language and display-theme preferences and your notification settings.
• Service data — the customer number(s) that link your account to your apartment(s), and the related building, apartment and service references stored in our system.
• Consumption and billing data — meter readings, reading history, settlement periods, invoices, balances.
• Connected device data — identifiers, status, schedules and configuration of the meters assigned to the account.
• Field actions — meter readings, notes, fault reports and photos that you submit through the mobile application or the portal (for example, a photo of a meter's display). Please photograph only the meter: a photo may also capture its surroundings. When the app reads a value from a meter photo, the recognition runs on your phone — the image is not sent to a third-party recognition service.
• Technical data — IP address, browser/device information, session identifiers, the list of devices signed in to your account (device type and last activity, which you can review and revoke in your account settings) and security event logs.
• Communications — the content of messages sent to our support team and our replies, and enquiries sent through this website's contact form (name, company, email address, phone number, website and message).
• Social sign-in data — if you sign in with your Google or Apple account ("Sign in with Google" / "Sign in with Apple"), we receive from the provider your stable unique identifier, your email address and — where available — your name and profile picture. We store the link between your iMeter account and that provider (the "connected account"). We never receive your Google or Apple password. You can disconnect a connected account at any time in your account security settings.
• Push notification data — if you enable notifications in the mobile application, we store a device push token so that we can deliver notifications through Google Firebase Cloud Messaging and the Apple Push Notification service.
• Usage analytics — only if you consent: how you use the website and the portal (pages visited, clicks, scrolling, session recordings), collected through Microsoft Clarity and Google Analytics. See section 11.

We do not knowingly process special categories of personal data (such as health or religion) and do not knowingly process the data of children under 18.

3. Where your data comes from

• From you — when you register, edit your profile, submit field actions, contact us or use the service.
• From your metering service provider — the company that provides metering or heat-cost allocation for your building and uses iMeter to deliver that service (shown as your provider in the portal and the app). It supplies your customer number, the building and apartment details, the meters assigned to them and billing data.
• From the meters — readings are transmitted automatically by the meters over remote-reading networks, or are recorded or imported by your metering service provider.
• From Google or Apple — if you use social sign-in (see section 2).
• From our systems — technical and security logs generated while you use the service.

4. Purpose and legal basis

5. Who we share your data with

We share your data only with the following recipients and only to the extent necessary:

• your metering service provider, which sees the data of the apartments it manages (readings, field actions and the link between your account and the apartment) in order to deliver and bill its service;
• our processors and service providers (hosting, email delivery, security, analytics) under written contract;
• authorities and courts where required by law;
• professional advisers under a duty of confidentiality (auditors, lawyers).

We do not sell personal data and do not forward it for third-party marketing purposes.

International providers and data transfers. Depending on the features you use, certain data is also processed by the following international providers:

• Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; and Google LLC, United States) — for "Sign in with Google", Firebase Cloud Messaging and, only with your consent, Google Analytics;
• Apple (Apple Distribution International Ltd, Hollyhill Industrial Estate, Cork, Ireland; and Apple Inc., United States) — for "Sign in with Apple" and the Apple Push Notification service;
• Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; and Microsoft Corporation, United States) — for Microsoft Clarity usage analytics, only with your consent;
• Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States) — for Cloudflare Turnstile, a security check we may use on the sign-in and registration pages, which processes your IP address and technical browser signals to tell people from automated bots.

This may involve a transfer of data outside the European Union to a provider in the United States, carried out on the basis of the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (SCCs). Their own processing is governed by their respective policies: Google Privacy Policy, Apple Privacy Policy, Microsoft Privacy Statement, Cloudflare Privacy Policy.

6. Retention periods

• Customer account and service data — for the duration of the contract and for as long as claims may be brought in connection with it, or until you delete your account (see section 7).
• Registrations whose email address is not confirmed — deleted automatically after 24 hours.
• Mobile application sign-ins and push tokens — removed when you sign out or revoke the device, and automatically after 90 days without use.
• Billing and accounting records — for the retention period required by applicable law (typically 8–10 years).
• Consumption, metering and field-action records (including submitted photos) — for as long as needed for billing, possible dispute resolution and statutory reporting.
• Security and access logs — generally 12 months, unless a security incident justifies extending this.
• Customer support correspondence and contact-form enquiries — for as long as needed to handle the enquiry, and typically no longer than 3 years after it is closed.
• Usage analytics — according to the retention settings of Microsoft Clarity and Google Analytics.

7. Deleting your account

You can delete your account yourself at any time:

• in the mobile application: Account → Settings → Security → Delete account;
• in the customer portal: account settings → Profile → Delete account;
• or by writing to klevente@klab.rs from the email address registered to your account.

If your account has a password, you will be asked to confirm it. Deletion takes effect immediately and cannot be undone: we erase your name, username, email address, password and notification settings, remove your connected Google/Apple accounts and push tokens, and sign you out on every device. A minimal record without your name or contact details remains so that historical records — for example, who submitted a reading — stay consistent.

The meter readings and billing data of your apartment belong to the property and its metering service, not to your account: they remain with your metering service provider, which may need them for billing and to meet its legal obligations. Deleting your account does not end your service contract with your metering service provider.

8. Your rights

In relation to your personal data, you may exercise the following rights at any time and free of charge:

• access to your own data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure ("right to be forgotten"), where permitted by law — see also section 7;
• restriction of processing;
• objection to processing based on legitimate interests;
• data portability for the data you have provided;
• withdrawal of consent at any time (without affecting the lawfulness of prior processing);
• lodging a complaint with a data protection supervisory authority — in Hungary: Hungarian National Authority for Data Protection and Freedom of Information (NAIH) — https://naih.hu; in Serbia, where we are established: Commissioner for Information of Public Importance and Personal Data Protection (Serbia) — https://www.poverenik.rs.

To exercise your rights, write to klevente@klab.rs. We respond within one month and may ask for reasonable proof of identity.

9. Required data and automated decisions

To create and use a resident account you need an email address with a password (or a Google/Apple sign-in) and at least one valid customer number; without them we cannot provide the portal and the mobile application. Your name, the phone number and website in the contact form, push notifications and usage analytics are optional.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Readings you submit through a field action are checked by a person before they are applied.

10. Security

We use technical and organisational measures appropriate to the risk: encrypted transmission (HTTPS/TLS), access control, audit log, regular backups, continuous monitoring. No system is completely secure: should we become aware of a data protection incident affecting you, we will inform you and the supervisory authority as required by law.

11. Cookies and similar technologies

The website and the customer portal use strictly necessary cookies, which they need to work and which do not require consent, and — only if you consent — analytics cookies. When you first visit, a banner asks for your choice; you can change it at any time through the "Cookie settings" link in the footer (in the portal, also through the floating cookie button). Withdrawing consent stops analytics from loading.

A "…" in a name stands for a prefix or suffix that varies by site. The mobile application does not use cookies: it keeps your sign-in token in your phone's secure storage and your app preferences in its local storage.

12. Changes to this notice

We may update this Privacy Notice from time to time. We will notify you about material changes through the portal or by email where appropriate. The "Last updated" date above always indicates the most recent change.