Terms of Use

Terms of Use

Last updated: 25 October 2026

1. Scope

These Terms apply to the use of cunnect.keyless – a middleware solution between RoomRaccoon PMS and Loxone for the automated creation and management of digital access codes for hotel rooms.

2. Description of Services

cunnect.keyless automatically processes booking data to generate and manage access codes („keycodes“).

• Booking ID
• Room name
• Booking period
• Guest email address
• Keycode

Additional data transmitted via PMS (e.g. name, phone number, billing address) is not stored and is discarded immediately.

Keycodes are accessible via the cunnect web portal by the customer, and optionally by guests through a self-service portal. Guests may view their keycode no earlier than 24 hours before check-in. Keycodes are only active on the Loxone system during the booked stay (check-in to check-out time).

All stored data – including keycodes – is automatically deleted two weeks after departure.

3. Access Rights

Customers can view, manage, or manually delete active keycodes through the cunnect web portal. Optional guest access may be enabled.

4. Fees and Contract Duration

• Monthly usage fee: €60
• Termination: In text form, with one month’s notice to the end of a calendar month
• Immediate termination possible in case of abuse or misuse (no refund, unless mandatory statutory claims require otherwise)

5. Liability

No liability is assumed for the following circumstances to the extent they do not result from a breach of duty for which we are responsible. Mandatory liability, including for intent, gross negligence or injury to life, body or health, remains unaffected:

• Technical disruptions beyond our control
• Misuse of access codes by hotel guests

6. Data Protection & DPA

Personal data is processed in accordance with the GDPR. These Terms incorporate the General Data Processing Agreement (DPA), which is binding for all customers.

7. Amendments

cunnect GmbH may provide a new version of these Terms. Changes will be communicated in good time; existing contracts will only be changed in accordance with the agreement and applicable law.

Law and language

The provisions in the general contractual framework above apply to governing law, language and jurisdiction. Mandatory statutory protections remain unaffected.

Data Processing Agreement (DPA)

Last updated: 25 October 2026

1. Parties to the Agreement

Controller: The respective hotel customer using cunnect.keyless
Processor: cunnect GmbH, provider of cunnect.keyless

2. Subject of Processing

This agreement governs the processing of personal data by cunnect.keyless on behalf of the Controller. cunnect.keyless acts as a middleware between RoomRaccoon PMS and Loxone for the automated generation of digital access codes for hotel rooms.

3. Nature, Purpose and Duration of Processing

• Purpose: Creation and management of digital keycodes for booked rooms
• Data processed: Booking ID, room name, booking period, guest email address, keycode
• Data not processed: Guest name, phone number, billing address (discarded immediately)
• Retention: Data is stored until two weeks after the guest’s departure date

The keycodes are made accessible to the Controller via the cunnect web portal. Guests may optionally view their keycodes through a self-service portal (by providing booking ID and email address) no earlier than 24 hours before check-in.

Keycodes are only active on the customer’s Loxone system during the booked period (from check-in to check-out time).

4. Categories of Data Subjects

Hotel guests who have made bookings

5. Obligations of the Processor

• Process data exclusively under documented instructions from the Controller
• Ensure confidentiality of all personnel
• Store data (including keycodes) securely and encrypted
• Assist the Controller with data subject requests
• Notify the Controller of any personal data breaches
• Delete all data (including keycodes) after the defined retention period
• Refrain from processing for any purposes beyond those agreed upon

6. Sub-processors

Currently used sub-processor: AWS (European data centers). Additional sub-processors will only be used with prior notice to the Controller.

7. Technical and Organizational Measures (TOMs)

• Data encryption (AES-256)
• Role-based access controls
• Hosting within the EU
• Access logging and auditing
• Regular backups and monitoring

8. Termination

All personal data, including keycodes, will be permanently deleted no later than two weeks after guest departure.

9. Applicability

This DPA applies uniformly to all cunnect.keyless customers. The current version is publicly available in this section. The DPA forms part of the business relationship where validly incorporated; publication alone does not replace the required conclusion of a contract.

10. Additional duties and audit rights

The Controller is responsible for lawful provision of data, the applicable legal bases and informing data subjects. Processing instructions must be documented. If cunnect GmbH considers an instruction to infringe data protection law, it will inform the Controller without undue delay. Legally required processing will be communicated in advance where legally permissible.

Taking into account the nature of processing and available information, cunnect GmbH assists the Controller with data security, data subject requests, notification and handling of personal data breaches and any required data protection impact assessments. Personal data breaches of which it becomes aware will be reported to the Controller without undue delay.

cunnect GmbH provides information necessary to demonstrate compliance with Article 28 GDPR and allows relevant audits, including inspections, by the Controller or its appointed auditor. Contractual coordination of an audit must not exclude these statutory rights.

General authorisation to appoint further processors requires prior information about changes and an opportunity to object. Further processors must be bound by corresponding data protection duties. The responsibility of cunnect GmbH under Article 28 GDPR remains unaffected.

After processing services end, remaining personal data will be returned or deleted at the Controller’s choice, and existing copies deleted unless retention is legally required. Any requested return must be coordinated before the normal deletion period expires. The deletion rule for individual bookings stated above continues to apply.

Privacy Policy

Last updated: 25 October 2026

1. Controller

The data controller under GDPR is the respective hotel using cunnect.keyless. cunnect.keyless acts solely as a data processor in accordance with Article 28 GDPR.

2. Data Processed

• Booking ID
• Room name
• Booking period
• Guest email address
• Keycode

Other booking data (e.g. guest name, phone number, billing address) is not stored or further processed and is discarded immediately upon receipt.

3. Retention Period

All personal data – including keycodes – is automatically deleted two weeks after the departure date.

4. Purpose of Processing

The purpose of data processing is to provide and manage digital access codes for hotel room access. Keycodes are only active on the hotel’s Loxone system for the booked duration. Guests may optionally view their keycode 24 hours before arrival through the self-service portal, using their booking ID and email address.

5. Legal Basis

Data processing is carried out on behalf of the hotel pursuant to Article 6(1)(b) and (f) GDPR. The cooperation is based on the general Data Processing Agreement (DPA).

6. Data Security & Hosting

• All data is stored in encrypted form
• Servers are located exclusively within the EU
• Access is restricted to authorized personnel only
• No sharing for unrelated purposes; agreed sub-processors are used under the DPA. International processing is additionally subject to Articles 44 et seq. GDPR.

7. Data Subject Rights

Requests related to data subject rights (e.g. access, deletion) must be addressed to the respective hotel. cunnect.keyless will support the Controller upon request.

8. Amendments

These product-specific privacy provisions are updated when processing changes. General information is available in our privacy policy.

Terms of use for cunnect.metrics

Last updated: 25 October 2026

1. Scope and service

cunnect.metrics provides anonymised technical operating data from automation and energy-management projects to manufacturers and system providers. These data can support analysis of actual operating states, load profiles and technical interactions, and the development of products and services.

2. Data scope and delivery

Product groups, data points, measurement periods, update intervals, transfer formats and any analysis are specified in the offer or contract. Provision is limited to the agreed datasets and access methods. It does not create an entitlement to all available project data or a particular number of data points.

3. Usage rights and anonymity

Data may be used for the agreed analysis, development and service purposes. The extent and limits of internal use, sharing, publication or further exploitation depend on the usage rights granted. Third-party rights and contractual confidentiality obligations must be respected.

Attempts to identify individuals from the anonymised data provided or deliberately link those data with personal information are not permitted. Credentials may only be used within the agreed authorisation group.

4. Data quality and interpretation

Field data reflect specific usage and operating conditions. Their significance and comparability depend on factors including data selection, measurement environment, measurement period and equipment condition. Analysis requires professional interpretation. General representativeness for all equipment or a particular commercial or technical outcome is only owed where expressly agreed.

5. Charges, duration and support

Prices, usage duration, termination and any agreed access and support services depend on the relevant offer and contract. Statutory provisions apply in addition. New or extended analysis and datasets are coordinated in line with the agreed scope.

6. Privacy and statutory rights

The service concerns anonymised operating data. Where personal data are processed before anonymisation or for a particular additional service, the necessary legal basis, responsibilities and any processing on behalf of a customer must be defined separately. The Keyless DPA does not automatically apply to cunnect.metrics. Statutory warranty rights and mandatory liability rules remain unaffected.

Product description · Support · Privacy policy

Terms of use for cunnect.bridge

Last updated: 25 October 2026

1. Scope and service

cunnect.bridge provides structured, bidirectional integration of BACnet/IP systems with a Loxone environment. It enables agreed data points to be read and written, for example for visualisation, control logic and energy management.

The agreed integration concept and scope determine which systems, BACnet objects, data points and functions are included. This does not establish blanket compatibility with every device, protocol variant or future software version.

2. Technical requirements

Implementation requires information about the existing BACnet/IP and Loxone environment and authorised technical access. Network connections, released data points and permissions must suit the agreed use. Rights relating to third-party systems and software must be respected.

3. Configuration and system operation

Write access, setpoints and automation functions must be coordinated with the relevant equipment and professionally checked before production use. Responsibilities for installation, approval, documentation and ongoing operation depend on the contract. Integration alone does not replace the equipment’s intended protective or safety functions.

Changes to devices, data-point lists, networks or software versions may require integration to be checked or adapted again. The scope of such changes will be agreed separately.

4. Data and permissions

Data may only be used within the agreed scope and with the necessary permissions. Credentials must be kept confidential. Integrating equipment does not create additional rights in third-party software or third-party data.

5. Charges, duration and support

Prices, delivery model, duration, termination and any maintenance or support services depend on the relevant offer and contract. Statutory provisions apply in addition. This page does not create unagreed flat-rate prices or service guarantees.

6. Privacy and statutory rights

Where integration or remote assistance involves processing personal data on a customer’s behalf, the necessary data protection agreements will be concluded separately. The Keyless DPA does not automatically apply to cunnect.bridge. Statutory warranty rights and the mandatory liability rules described in the general framework remain unaffected.

Product description · Support · Privacy policy

Terms of use for cunnect.sensory

Last updated: 25 October 2026

1. Scope and service

cunnect.sensory is a mobile sensor solution for additional data collection in existing buildings and equipment. Measurement points can be temporary or permanent, capturing temperature, humidity, CO₂, states or other agreed measurements. The sensor concept determines which measurements and devices are used in a particular project.

2. Measurement concept and operating conditions

The relevant offer or measurement concept specifies locations, duration, transmission methods, analysis and technical device characteristics. Not every device captures every measurement listed. Information needed about the building, installation location, power supply and communication options must be provided.

3. Device operation

Devices must be used for the agreed purpose and in accordance with the relevant operating instructions. Installation, location and environmental conditions can influence measurement results. Changes to measurement points or device configurations must be coordinated where they affect the agreed data collection.

Provision, ownership, maintenance and any return of equipment depend on the relevant contract. These arrangements do not create additional replacement or support services without a separate agreement.

4. Measurement data and analysis

Measurements support analysis of comfort, energy use, operating states and deviations. Results must be assessed in the context of the measurement setup, period and equipment condition. They do not automatically replace a professional inspection, legally required evidence or a separately agreed expert assessment.

Access, data scope, export options and usage rights depend on the agreement. Sharing third-party data requires the necessary permissions.

5. Charges, duration and support

Prices, project or usage duration, termination and any support services are set out in the offer and contract. Statutory provisions apply in addition. Specific energy savings or analysis outcomes are only owed where expressly agreed.

6. Privacy and statutory rights

Where measurements can be linked to people, for example through use or occupancy information, applicable data protection requirements must be respected. Any necessary processing on behalf of a customer is agreed separately; the Keyless DPA does not apply automatically. Statutory warranty rights and mandatory liability rules remain unaffected.

Product description · Support · Privacy policy