EU Data Act User Agreement Community | Home Connect Developer Program

Agreement between data holders and data recipients on making data available at the request of users of connected products and related services (“Agreement”)

1. Parties, Requesting User and Product/Related Service(s)

This agreement on the access to and use of data is made between Home Connect GmbH, Carl-Wery-Straße 34, 81739 Munich, Germany (“HC” or “Data Holder”) and any party that identifies itself as a data recipient within the meaning of the Data Act and declares its assent to the terms of this contract by accepting them in the course of the registration in the Home Connect Developer Portal (“Data Recipient”). HC and Data Recipient are referred to in this Agreement collectively as ‘the Parties’ and individually as ‘the Party’.

2. Requesting User, Product/Related Service(s)

This Agreement is based on the joint assumption of the Parties that the Data Holder is obliged under Article 5 of the Data Act to make data available to the Data Recipient when requested to do so by or on behalf of a person that identifies itself as a user within the meaning of Article 2(12) Data Act and that is a user (within the meaning of Article 2(12) Data Act) of:
1. a connected product within the meaning of the Data Act that is sold under one of the brands of one of the affiliated companies of HC (each a “Product”).
2. the Home Connect App (“Related Service”).
(“Requesting User”). In case of multiple Requesting Users, this Agreement shall apply for each Requesting User and their Data.

3. Basis of the contract

3.1. Quality of the Requesting User and existence of a valid request
3.1.1. Each Party declares that, to the best of their knowledge, the Requesting User is a user (within the meaning of Article 2(12) Data Act) of the Product and Related Service specified in in clause 2.1.
3.1.2. The Data Recipient declares that the Requesting User has requested that the Data Holder makes available to the Data Recipient the Data specified in clause 4.1. Evidence of the request shall be presented to the Data Holder upon request.
3.1.3. The Data Recipient declares that, to the best of their knowledge, the party acting on behalf of the Requesting User has received the necessary authority from the Requesting User to submit this request in accordance with applicable law. Evidence of the authorization shall be presented to the Data Holder.
3.1.4. The Data Recipient declares that, to the best of their knowledge, the request is valid under applicable law, has not been withdrawn and has not expired.
3.2. Eligibility of Data Recipient
3.2.1. The Data Recipient declares that there is a contract in force between them and the Requesting User allowing them to use the Data and that, according to this contract, the Data will be used exclusively for a specific purpose (to be revealed to Data Holder upon Data Holder’s request) that complies with all applicable laws.
3.2.2. The Data Recipient declares that the Data is strictly necessary for fulfilling this purpose.
3.2.3. The Data Recipient declares that it is not designated as a ‘gatekeeper’ pursuant to Article 3 of Regulation (EU) 2022/1925 (“Digital Markets Act”).
3.3. Compliance with data protection law
3.3.1. As far as the Data qualifies as personal data, each Party declares that they comply with the Regulation (EU) 2016/679 and, where relevant, Directive 2002/58/EC.
3.3.2. In particular, when the Requesting User is not the data subject, the Data Holder may only make the Data which are personal data available to the Data Recipient, to the extent permitted under Regulation (EU) 2016/679 and, where relevant, Directive 2002/58/EC.
3.4. Incorrectness of declarations
3.4.1. Any Party that becomes aware that any of its declarations referred to in clauses 3.1 to 3.3 is not, or is no longer, correct, or will no longer remain correct in the foreseeable future, must, without undue delay, notify the other Party, unless the other Party is or ought to be already aware of the fact.
3.4.2. On becoming aware of this situation, the concerned Party must take appropriate action and cure the incorrectness of the declaration, to the extent possible. Depending on the circumstances, this may include notifying the Requesting User or any protected third party who is affected or the temporary suspension of the making available of the Data by the Data Holder or the use of the Data by the Data Recipient, if making the Data available or the use of the Data has become unlawful.
3.4.3. If the situation is not and cannot be cured, this Agreement must terminate mentioning the reasons of termination given by either party to the other
3.4.4. The termination has immediate effect. Where the incorrectness affects only part of the data covered by this Agreement, termination must take effect only for the relevant part.
3.4.5. Effects of termination are governed by clause 9.4.

4. Making the Data available

4.1. Data covered by the Agreement
4.1.1. The data covered by this Agreement consists of the readily available Product Data or Related Service Data within the meaning of the Data Act identified in the request made by the Requesting User in accordance with Article 5 of the Data Act, and includes both non-personal and personal data (“Data”).
4.1.2. The Data are listed in the Developer Portal (available at: https://developer.home-connect.com/eu_data_act).
4.1.3. If, during this Agreement, other data than those specified in the Developer Portal (available at: https://developer.home-connect.com/eu_data_act) must be made available to the User, the Developer Portal and related services will be amended accordingly.
4.2. Data characteristics and access arrangements
4.2.1. The Data Holder must make the Data available to the Data Recipient, with at least the same quality as it becomes available to the Data Holder, and in any case in a comprehensive, structured, commonly used and machine-readable format as well as the relevant metadata necessary to interpret and use those data.
4.2.2. The Data Holder must make the Data available to the Data Recipient, with at least the same quality as it becomes available to the Data Holder, and in any case in a comprehensive, structured, commonly used and machine-readable format as well as the relevant metadata necessary to interpret and use those data.
4.2.3. The Data Recipient must receive access to the Data (a) easily and securely; (b) without undue delay; where relevant and technically feasible, continuously and in real-time, if it the Data Recipient requests such access. However, the continuous and real-time availability of the Data depends on other factors (e.g., the Product's Wi-Fi connection, Internet connection, availability of APIs, etc.). For technical reasons, there is always a certain amount of latency due to the various transmission processes.
4.2.4. In order to meet the requirements of clauses 4.2.1 and 4.2.2, the Data Holder provides the Data via the REST API provided as part of the Home Connect Developer Program. Further information on the technical requirements and the relevant service quality can be found at: https://developer.home-connect.com/eu_data_act.
4.2.5. If the Data is made available in conformity with the specifications in the Developer Portal (available at: https://developer.home-connect.com/eu_data_act) and if it appears that the agreed specifications are insufficient to meet the requirements referred to in clauses 4.2.1 and 4.2.2, the Parties undertake to enter into negotiations in good faith and adapt the specifications so that they meet the agreed requirements.
4.3. Feedback loops
4.3.1. If the Data Recipient identifies an incident related to clause 4.1 on the Data covered by the Agreement or to clauses 4.2.1 or 4.2.2 or of technical requirements and the relevant service quality (available at: https://developer.home-connect.com/eu_data_act), and if the Data Recipient notifies the Data Holder with a detailed description of the incident, the Data Holder and the User must cooperate in good faith to identify the reason of the incident.
4.3.2. If the incident was caused by a failure of the Data Holder to comply with their obligations, they must remedy the breach within a reasonable period of time.
4.4. Unilateral changes by the Data Holders
4.4.1. The Data Holder may unilaterally change the specifications of the Data characteristics or the access arrangements stated in the technical requirements and the relevant service quality (available at: https://developer.home-connect.com/eu_data_act), if this is objectively justified by the normal conduct of business of the Data Holder, for example by a technical modification due to an immediate security vulnerability in the line of the products or related services or a change in the Data Holder’s infrastructure. Any change must meet the requirements of clauses 4.2.1 or 4.2.2.
4.4.2. The Data Holder should give notice of the change to the Data Recipient through the Developer Portal or by e-mail generally two (2) weeks before the change takes effect.
4.4.3. A shorter notice period may suffice:
1. where the change does not negatively affect data access and use by the Data Recipient; or
2. where such notice would be impossible or unreasonable in the circumstances, such as where immediate changes are required because of a security vulnerability that has just been detected.

5. Protection of trade secrets

To the extent the Data include data which is protected as trade secrets (“Trade Secrets” as defined in the Trade Secrets Directive (EU) 2016/943), held by the Data Holder or another Trade Secret Holder (“Trade Secret Holder” as defined in said Directive) the following applies:
5.1. Applicability of trade secret arrangements
5.1.1. The protective measures agreed on clauses 5.2 and 5.3 of this Agreement, as well as the related rights agreed in clause 5.4 , apply exclusively to Data or metadata included in the Data to be made available by the Data Holder to the Data Recipient, which are identified by HC as Trade Secrets.
5.1.2. The Data protected as Trade Secrets and the identity of the Trade Secret Holder(s) are set out in the Developer Portal (quality (available at: https://developer.home-connect.com/eu_data_act).
5.1.3. If, during this Agreement, new data is made available to the Data Recipient that is protected as Trade Secrets, the Developer Portal (quality (available at: https://developer.home-connect.com/eu_data_act) will be amended accordingly by HC. HC will inform Data Recipient through the Developer Portal or by e-mail of such amendment.
5.1.4. The obligations set out in clauses 5.2 and 5.3 remain in effect after any termination of the Agreement, unless otherwise agreed by the Parties.
5.2. Protective measures taken by the Data Recipient
5.2.1. The Data Recipient must apply the protective measures set out in in the Developer Portal (quality (available at: https://developer.home-connect.com/eu_data_act) (“Data Recipient’s Protection Measures”).
5.2.2. If the Data Recipient is permitted in this Agreement and in the agreement concluded by the Data Recipient with the User to make Data protected as trade secrets available to a third party, the Data Recipient must inform the Data Holder without undue delay of the fact that Data protected as trade secrets have been or will be made available to a third party, specify the Data in question, and give the Data Holder the identity, place of establishment and contact details of the third party.
5.2.3. In order to verify if and to what extent the Data Recipient has implemented and is maintaining the Data Recipient’s Protection Measures, the Data Recipient agrees to either (i) annually obtain, at Data Recipient’s expense, a security conformity assessment audit report from an independent third party chosen by the Data Recipient, or (ii) to annually allow, at Data Holder’s expense, a security conformity assessment audit from an independent third party chosen by the Data Holder, subject to such independent third party having signed a confidentiality agreement as provided by the Data Recipient. Such security audit report must demonstrate Data Recipient’s compliance with clauses 5 and the Developer Portal (quality (available at: https://developer.home-connect.com/eu_data_act) as applicable at that time. The results of the audit reports will be submitted to both Parties without undue delay.
5.2.4. HC may choose between (i) and (ii). If a Party deems the security audit report obtained at the other party’s expense is not correct, they retain the right to obtain security audit report from another independent third party at their own expense. If this right is exercised, both independent third-party auditors, together with Parties, will discuss any difference between those two reports and aim to resolve any pending matters while observing good faith.
5.3. Protective measures taken by the Trade Secret Holder
5.3.1. The Data Holder may apply the measures agreed in the Developer Portal (quality (available at: https://developer.home-connect.com/eu_data_act) to preserve the confidentiality of the Data protected as trade secrets (“Data Holder’s Protection Measures”).
5.3.2. The Data Holder may also add unilaterally appropriate technical and organizational protection measures, if they do not negatively affect the access and use of the Data by the Data Recipient under this Agreement.
5.3.3. The Data Recipient undertakes not to alter or remove the Data Holder’s protection measures nor the measures taken in accordance with clause 5.3.2, unless otherwise agreed by the Parties.
5.4. Obligation to share and right to refuse, withhold or terminate
5.4.1. Where the identified Data Recipient’s Protection Measures and the Data Holder’s Protection Measures do not materially suffice to adequately protect a particular Data protected as trade secret, the Data Holder may, by giving notice to the Data Recipient with a detailed description of the inadequacy of the measures:
1. unilaterally increase the protection measures regarding the specific identified Trade Secret in question, provided this increase is compatible with their obligations under this Agreement and does not negatively affect the Data Recipient; or
2. request that additional protection measures be agreed. If there is no agreement on the necessary additional measures after a reasonable period of time and if the need of such measures is duly substantiated, e.g. in a security audit report, the Data Holder may suspend the sharing of the specific Data in question. In such case, the Data Holder must give notice to the Data Recipient and the competent authority designated under Article 37 of the Data Act. The notice must be duly substantiated, indicate which measures have not been agreed, and be given in writing without undue delay. The Data Holder must continue to share any Data protected as trade secrets other than these specific Data.
5.4.2. If, in exceptional circumstances, the Data Holder is able to demonstrate that it is highly likely to suffer serious economic damage from disclosure of a particular Data protected as trade secret to the Data Recipient despite the Data Recipient’s Protection Measures and the Data Holder’s Protection Measures having been implemented, the Data Holder may refuse or suspend sharing the specific Data in question.
They may do this only if they give duly substantiated notice to the Data Recipient and the competent authority designated under Article 37 of the Data Act.
However, the Data Holder must continue to share any Data protected as trade secrets other than those specific Data.
5.4.3. If the Data Recipient fails to implement and maintain their Data Recipient’s Protection Measures and if this failure is duly substantiated by the Data Holder, e.g. in a security audit report, the Data Holder is entitled to withhold or suspend the sharing of the specific Identified Trade Secrets, until the Data Recipient has resolved the incident.
In this case, the Data Holder must, without undue delay, give duly substantiated notice in writing to the Data Recipient and to the competent authority designated pursuant to Article 37 of the Data Act.
5.4.4. Clause 5.4.1 does not entitle the Data Holder to terminate this Agreement.
5.4.5. Clauses 5.4.2 and 5.4.3 entitle the Data Holder to terminate this Agreement only with regard to the specific identified Trade Secrets, and if:
1. all the conditions of clause 5.4.2 respectively 5.4.3 have been met;
2. no resolution has been found by Parties after a reasonable period of time, despite an attempt to find an amicable solution, including after intervention by the competent authority designated under Article 37 of the Data Act; and
3. the Data Recipient has not been awarded by a competent court with court decision obliging the Data Holder to make the Data available and there is no pending court proceedings for such a decision.

6. Use of the Data and sharing with third parties

6.1. Permissible use by Data Recipient
6.1.1. The Data Recipient represents and warrants to process the data made available to them under the Agreement only for the purposes and under the conditions agreed with the Requesting User.
6.1.2. The Data Recipient represents and warrants to erase the Data when they are no longer necessary for the agreed purpose, unless otherwise agreed with the Requesting User in relation to Data that are nonpersonal data.
6.2. Sharing of Data with third parties
6.2.1. The Data Recipient represents and warrants not make the Data available to another third party, unless it is contractually agreed with the Requesting User, compatible with any protection measures agreed with the Data Holder and compatible with applicable EU or national law.
6.2.2. The Data Recipient must in any case not make the Data they receive available to an undertaking designated as a gatekeeper under Article 3 of Regulation (EU) 2022/1925 (Digital Markets Act).
6.2.3. Where the Data Recipient is permitted to make data available to a third party, the Data Recipient represents and warrants to take appropriate contractual, technical and organizational measures to make sure that:
1. (if applicable) the third party applies at least the same protection measures as the Data Recipient must apply under clause 5.2 and respects the protection measures taken by the Data Holder under clause 5.3;
2. the third party uses the Data exclusively in a way compatible with clause 6.1 and 6.3;
3. the Data Holder has at least the same remedies against the third party as against the Data Recipient for use or disclosure of data prohibited under clause 6.3.
6.2.4. Notwithstanding clauses 6.2.1 and6.2.2, the Data Recipient may use processing services, e.g. cloud computing services (including infrastructure as a service, platform as a service and software as a service), hosting services, or similar services to achieve, for their own account and under their own responsibility, the agreed purposes under clause 6.1. The third parties may also use such services to achieve, for their own account and under their own responsibility, the purposes for which the Data is shared with them. Data Recipient shall remain liable for the acts and omissions of such third party as if it is their own act or omission.
6.3. Unauthorized use or sharing of data
6.3.1. The Data Recipient must not:
1. (for the purposes of obtaining data) provide false information to the Data Holder, deploy deceptive or coercive means or abuse gaps in the Data Holder’s technical infrastructure designed to protect the Data;
2. fail to maintain the contractual technical or organizational measures agreed under clause 5.2 and 5.3;
3. alter or remove, without the agreement of the Data Holder, technical protection measures applied by the Data Holder to prevent unauthorized access to the Data and to ensure compliance with this Agreement;
4. use the data they received for unauthorized purposes, in violation of clause 6.1;
5. use the Data to develop a product that competes with the Product, nor share the Data with a third party for that purpose;
6. use the Data to derive insights about the economic situation, assets and production methods of the Data Holder, or their use of the Data;
7. use the Data in a manner that adversely impacts the security of the Product or any Related Service;
8. notwithstanding Article 22(2) points (a) and (c) of the GDPR, use Data for the profiling of natural persons, unless this is necessary to provide the service requested by the Requesting User; or
9. disclose the data to another third party unlawfully or in violation of clauses 6.2.1 or 6.2.2.
If the Data Recipient does any of these things, this constitutes a material breach of this Agreement.
6.3.2. Without prejudice to other remedies available to the Data Holder in accordance with this Agreement or applicable law, the Data Recipient must comply, without undue delay, with requests by the Data Holder or the Requesting User to:
1. inform the Requesting User of the unauthorized use or disclosure of the Data and measures taken to put an end to this;
2. erase the data made available by the Data Holder under this Agreement, or obtained in an unauthorized or abusive manner, and any copies of it;
3. compensate the Data Holder, the Requesting User or protected other third party for any harm suffered from the unauthorized use or disclosure; and
4. end the production, offering, placing on the market or use of goods, derivative data or services produced on the basis of knowledge obtained through this data, or the importation, export or storage of infringing goods for those purposes and; destroy any infringing goods, if (i) there is a serious risk that the unlawful use of the Data will cause significant harm to the Data Holder, trade secret holder or User, or (ii) where this measure would not be disproportionate, given the interests of the Data Holder, trade secret holder or User.

7. Compensation for providing data access

7.1. The Data is provided by Data Holder to Data Recipient free of charge.
7.2. HC reserves the right to charge for the provision of the Data in the future.

8. Date of application and duration

This Agreement takes effect upon acceptance by Data Recipient in the Developer Portal and is concluded for an indeterminate period of time subject to any grounds for expiry or termination under this Agreement.

9. Liability

9.1. The Data Holder shall be liable to Data Recipient, without limitation, in the case of deliberate action, gross negligence and fraudulently concealed defects for any damage caused by the Data Holder or its legal representatives or agents.
9.2. In the case of slight negligence, the Data Holder shall be liable to Data Recipient, without limitation, for any injury to life, limb or health. Beyond this, the Data Holder shall be liable to Data Recipient only insofar as the Data Holder has violated an integral contractual obligation, this being an obligation whose fulfilment actually enables the proper performance of this Agreement in the first place and the abidance by which the Data Recipient, as contractual partner, may regularly rely on. In such cases, liability shall be limited to compensation for damages which the Data Holder foresaw or could be reasonably expected to have foreseen at the time of conclusion of this Agreement as a result of its non-performance.
9.3. The liability of the Data Holder in accordance with the provisions of applicable product liability law shall remain unaffected by the above provisions.

10. Termination

10.1. Automatic termination
Irrespective of the contract period agreed under clause 8, this Agreement terminates:
10.1.1. upon the destruction of the Product or permanent discontinuation of the Related Service, or when the Product or Related Service loses its capacity to generate the Data in an irreversible manner; or
10.1.2. upon the User losing ownership of the Product or when the User’s rights with regard to the Product under a rental, lease or similar agreement or the Data Recipient’s rights with regard to the related service come to an end; or
10.1.3. when both Parties so agree.
10.2. Termination by Data Recipient
The Data Recipient may terminate the Agreement at any time during the contract period by giving the Data Holder a notice of one (1) month to the end of the month. The Data Recipient must notify the Requesting User that the Agreement has been terminated.
10.3. Termination for cause
10.3.1. In the case of a non-performance by a Party, the other Party shall have the remedies to terminate the Agreement with immediate effect without penalty, by giving notice to the other Party, if:
1. the other Party’s non-performance is fundamental; or
2. in the case of non-performance which is not fundamental, the aggrieved Party has given a notice fixing a reasonable period of time to remedy the nonperformance and the period has lapsed without the other Party performing; or
3. (if applicable), provided that all conditions set out in clause 5.4.5 are met, in cases described in 5.4.2 or 5.4.3.
10.4. Effects of termination
10.4.1. Termination of this Agreement releases both Parties from their obligation to effect and to receive future performance but does not affect the rights and liabilities that have accrued up to the time of termination.
10.4.2. Termination does not affect any provision in this Agreement which is to operate even after the Agreement has come to an end, in particular clause 13.1on confidentiality, clause 6, clause 5.1 on trade secrets and clause 15 on applicable law and place of jurisdiction.

11. Suspension

The Data Holder can suspend the sharing of Data with the Data Recipient until the Data Recipient complies with their obligations, by giving a duly substantiated notice to the Data Recipient without undue delay:
1. if the non-performance of Data Recipient’s obligations is fundamental; or
2. (if applicable) provided that all other conditions set out in clause 5.4.3 are met, in cases described in clause 5.4.3.

12. Excused Performance

12.1. A Party’s non-performance is excused if it is due to an impediment beyond its control and that that Party could not reasonably have been expected to take the impediment into account at the time of the conclusion of this Agreement, or to have avoided or overcome the impediment or its consequences.
12.2. Where the impediment is only temporary the excuse has effect for the period during which the impediment exists.

13. Changes to the Agreement

13.1. HC shall have the right to change the Agreement. Editorial changes to the Agreement, i.e. changes which do not affect the contractual relationship such as the correction of typing errors, will be made without notifying Data Recipients.
13.2. HC shall give Data Recipients advance notice by email of any changes to the Agreement which affect the contractual relationship as a rule at least six weeks before the date on which the change takes effect. Such notice will also include information on Data Recipient’s right to reject the changes and the resulting consequences. In case the Data Recipient does not reject the changes, consent to the changes shall be deemed as granted and the changed Agreement will become effective on the date on which the change takes effect. In case the Data Recipient rejects the changes, HC shall have the right to terminate Data Recipient’s contract on the date on which the change takes effect.

14. Confidentiality

14.1. "Confidential Information" means any and all non-public information, whether in oral, written, electronic, or other form, that is designated as confidential or alike or that, given the nature of the information or circumstances surrounding its disclosure, should reasonably be understood to be confidential.
14.2. Both Parties agree to take all reasonable measures to store securely Confidential Information and not to make such information available to any third party, unless
1. one of the Parties is under a legal obligation to or make available the relevant information e.g. in order to comply with the obligation to provide information showing that there has been no discrimination in accordance with Article 8(3) of the Data Act,
2. it is necessary for one of the Parties to make the relevant information available in order to fulfil their obligations under this Agreement,
3. the Confidential Information becomes publicly available through no fault of the receiving party;
4. the Confidential Information Is independently developed by the receiving party without use of the disclosing party's Confidential Information;
5. the Confidential Information is rightfully obtained by the receiving party from a third party without breach of any obligation of confidentiality;
6. the Confidential Information is already known to the receiving party prior to disclosure by the disclosing party, as evidenced by written records; or
7. one of the Parties has obtained the prior consent of the other Party or the party providing the confidential information or affected by its disclosure.
14.3. In any case, the Data Holder may disclose or make available such information to the Requesting User as is necessary for the Data Holder to demonstrate compliance with its obligations (i) in respect of the Data Recipient under Article 5 of the Data Act or (ii) resulting from a contract made with the Requesting User under Article 4(6) of the Data Act.
14.4. These confidentiality obligations remain applicable after the termination of the Agreement for a period of two (2) years.
14.5. These confidentiality obligations do not remove any more stringent obligations under (i) the Regulation (EU) 2016/679 (GDPR), (ii) the provisions implementing Directive 2002/58/EC or Directive (EU) 2016/943, or (iii) any other EU or Member State law (iv) (if applicable) clause 6 of this Agreement.

15. Interpretation

15.1. This Agreement is concluded by the Parties against the background of the Parties’ rights and obligations under the Data Act. Any provision in this Agreement must be interpreted so as to comply with the Data Act and other EU law or national legislation adopted in accordance with EU law as well as any applicable national law that is compatible with EU law and cannot be derogated from by agreement.
15.2. If any gap or ambiguity in this contract cannot be resolved in the way referred to by clause 15.1, this Agreement must be interpreted in the light of the rules of interpretation provided for by the applicable law (see clause 16.2).

16. Final Provisions

16.1. Should any provision of this Agreement or a provision later on included in this Agreement be or become ineffective, unenforceable or void as a whole or in a part, or should a gap in this Agreement become evident, this shall not affect the validity of the remaining provisions. The parties hereto shall replace the ineffective, unenforceable or void provision with a lawful and enforceable provision that reflects the business purpose of the ineffective, unenforceable or void provision. The parties shall similarly add a necessary appropriate provision where such a provision is missing.
16.2. This Agreement is exclusively governed by the laws of the Federal Republic of Germany with the exclusion of any conflict of laws provisions. The UN Convention on the International Sales of Goods shall not apply. Munich, Germany shall be the exclusive place of jurisdiction.
Version: September 2025

Home Connect Developer Program