- Home
- Privacy
About this site
Privacy
Who is responsible for personal data on shelly.guide, what is processed and why, how long it is kept, and your rights.
Updated: November 2026
Version 2026-11-09
Who is responsible
Data controller. Shelly Europe Ltd., 51 Cherni Vrah Blvd., building 3, floor 2 and 3, Sofia, Bulgaria, UIC 202320104. Data protection contact: Shelly Europe Ltd.'s Data Protection Officer, dpo@shelly.com.
Shelly Europe decides why and how personal data on shelly.guide is processed: in the CRM, the newsletter and its sign-up, course certificates, demo kits and vouchers.
Data processor. shelly.guide is owned and run by Falster IoT ApS, CVR 44106485, Østrigsvej 42, 4800 Nykøbing F, Denmark — hello@shelly.guide. Falster IoT processes personal data only on Shelly Europe’s behalf and on its instructions, under the data processing agreement that is part of the contract between Falster IoT and Shelly.
You can write to either. A request that reaches Falster IoT about your rights is passed on to Shelly Europe and answered.
The short version
Reading the guides collects nothing about you. The site sets no cookies, loads nothing from Google, Facebook or an advertising network, and its page counter is cookieless (below). Personal data is processed only when you give it to us — a newsletter sign-up, a demo-kit registration, a course — or when Shelly’s sales team records a business contact in its CRM.
What is processed, why, and on what basis
| What | Why | Legal basis (GDPR art. 6(1)) | |
|---|---|---|---|
| Newsletter | E-mail address; name and company if you give them; language; the topics you chose; when and with which consent text you signed up and confirmed; a one-way hash of your IP address (not the address); whether mails were delivered, opened or clicked, and unsubscribes | To send the e-mails you chose, to prove that you asked for them, and to stop abuse of the form | Your consent (a) for the e-mails. Legitimate interest (f) for the record of the consent and the abuse protection |
| Sign-up confirmation | The same, plus a one-time link | Double opt-in: nothing is a yes until you press “Confirm” | Consent (a) |
| Course certificates | Name, company, e-mail, the course (type, date, place, leader), whether you attended, the certificate number, whether and when it was sent; for installers on Shelly’s installer portal, the installer code and badge level | To issue and send your certificate, to be able to send it again, and to record the course on the installer portal | Legitimate interest (f) in documenting the training Shelly gives |
| CRM | Business contacts at wholesalers, distributors, electricians and other customers: name, job title, company, e-mail, phone, language, notes on meetings and calls, follow-ups, consents and their source; installer code and badge for installers on the portal | Shelly’s sales work with its business customers in the Nordics | Legitimate interest (f) in B2B customer relations |
| Demo kits and vouchers | As on the campaign’s own privacy page (name, company and CVR, e-mail, phone, the chosen store, a delivery address if you ask for delivery, the two ticks, times; a hashed IP address) | To run the campaign | As on the campaign page: legitimate interest (f), and consent (a) for marketing. The campaign pages name Shelly Europe as the controller |
| Admin accounts | Shelly staff and course leaders who sign in: name, e-mail, roles; an audit log of what was done (without personal data about others) | Access control and accountability | Legitimate interest (f) |
| Page statistics | Nothing that identifies you — see Page statistics below | Which guides are read | Not personal data as described |
You are never required to sign up for a newsletter to get a certificate, a demo kit or anything else. A course certificate mail is a service mail: it carries no marketing, and mentions the newsletter only in one neutral line that is the same for everybody.
How long it is kept
| Kept | |
|---|---|
| Unconfirmed sign-up | The confirmation link works for 7 days; a sign-up never confirmed is deleted a day after the link expired. Once confirmed, the address, name and company leave the sign-up record (they are on the contact); the proof stays |
| Newsletter consent | Until you unsubscribe. The record that you consented — and that you withdrew — is kept for 3 years after the withdrawal as proof. An address that bounced, complained or asked to be forgotten is kept only as a one-way hash, so that no import adds it again |
| Course certificates | At most 10 years after the certificate was issued — a certificate is documentation of training |
| CRM | As long as the business relationship lasts. A contact with no activity for 3 years is anonymised. Deleting a contact anonymises it at once |
| Demo kits and vouchers | As on the campaign page: a delivery address and phone number at most 30 days after delivery; everything at most 24 months after registration |
| Mail delivery logs at Resend | 30 days (e-mail content, metadata, delivery status, events, logs and metrics) |
Who processes it for us
| Sub-processor | What it does | Where the data is | Transfer basis |
|---|---|---|---|
| Supabase (Supabase Inc.) | Database and file storage (CRM, sign-ups, courses, certificates, templates, demo kits) | EU — AWS eu-west-1 (Ireland) | Stored in the EU. Support access from outside the EU: Supabase’s DPA with the EU Standard Contractual Clauses |
| Vercel (Vercel Inc.) | Hosting; runs the site’s server functions; cookieless page statistics | Pages are served from Vercel’s global network. The server functions — everything that reads or writes personal data — run in Dublin, Ireland, beside the database and the mail service | EU–US Data Privacy Framework (Vercel is certified) and/or the SCCs in Vercel’s DPA |
| Resend (Plus Five Five Inc.) | Sends the newsletter, the confirmation mail, the certificate mail and the demo-kit mails | Sending domains news.shelly.guide and send.shelly.guide in region eu-west-1 (Ireland). The company and its account data are in the USA |
SCCs in Resend’s DPA (and the DPF if Resend is certified) |
| GitHub (GitHub Inc., Microsoft) | The site’s source code. Only if personal data is there: the page editor writes the editing staff member’s name and e-mail into each commit. No CRM, newsletter or course data is stored in GitHub | USA | EU–US Data Privacy Framework (Microsoft is certified) and the SCCs in GitHub’s DPA |
Nothing is sold, rented or given to advertisers. Inside Shelly, the Nordic sales team and course leaders see what their role needs; a store sees a demo-kit voucher as described on the campaign page.
Your rights
You can ask to see the data about you, have it corrected or deleted, restrict its processing, object to processing based on legitimate interest, and get it in a machine-readable form. Consent can be withdrawn at any time — every newsletter has a one-click unsubscribe link, and withdrawing does not affect anything done before. Write to Shelly Europe Ltd.'s Data Protection Officer at dpo@shelly.com, or to hello@shelly.guide.
You can complain to a data protection authority: the Bulgarian Commission for Personal Data Protection, which is Shelly Europe’s supervisory authority, or the authority in the EU or EEA country where you live or work — for example Datatilsynet in Denmark, IMY in Sweden, Datatilsynet in Norway or Tietosuojavaltuutetun toimisto in Finland.
Cookies
None. Not for analytics, not for preferences, not for advertising. Nothing this site stores survives your visit, because nothing is stored.
What loads with a page
Fonts are served from this domain. They are not requested from Google Fonts, so loading a page tells Google nothing about you.
Videos are not loaded until you ask for one. Each video on this site shows a still image and a play button. YouTube is contacted only when you press play — at which point you are watching a YouTube video, and YouTube’s own privacy terms apply to it. Every video also carries a plain link to its page on YouTube, so you can decide to go there instead.
Page statistics
This site uses Vercel Web Analytics to count which guides get read. It is worth being precise about what that means, because most analytics products would require a banner and this one does not:
- No cookies are set, and nothing is written to your browser.
- You are not identified. Visitors are counted using a hash derived from the incoming request — the IP address and the browser’s user agent. The IP address itself is not stored.
- The hash is reset every 24 hours, so the same person visiting on two consecutive days is counted as two visitors, not one.
- It does not follow you. The hash is specific to this site. It cannot be used to recognise you anywhere else.
What comes out of it is a list of which pages were read and roughly where in the world the readers were. It is used to decide which guides to write next.
Questions
About your personal data: Shelly Europe Ltd.'s Data Protection Officer, dpo@shelly.com. About the site itself: Falster IoT ApS, hello@shelly.guide. If this page and the site ever disagree, the site is the bug.