Tado

From Wiki IoT
Jump to: navigation, search
Nature Real
ID Name tado° Smart Thermostat
Provider tado° GmbH
Description Smart thermostat which uses consumer's phone's location, checks the weather forecast and keeps in mind the features of the building in order to optimally regulate the temperature.
Country Germany
Release Date 12.05.2015 (date of the analysis)
Link https://www.tado.com/de-en/, https://support.tado.com/hc/en-gb
Topics
Correlated texts https://www.tado.com/de-en/, https://support.tado.com/hc/en-gb

Notes

tado° is a consumer-oriented (“When these General Terms and Conditions refer to "consumers", these are deemed to be natural persons placing orders that cannot be attributed to commercial, independent or freelance activity”), always-on (“In order to use the full range of functions offered by the applications of the Supplier, a working, always-on Internet connection must be available at the place of installation”) Smart Thermostat. As a thermostat, it has a potential impact on real world.


Components:

  1. thermostat (hardware): you can see the current temperature and set or alter the setpoint temperature; it is compatible with almost all manufacturers and systems (list of manufacturers provided); it is connected to the Internet via your Internet access at home (through a device – the tado° Bridge – plugged into your router; the Bridge and the thermostat are communicating inside your house via a wireless radio connection); “[i]n order to use the full range of functions offered by the applications of the Supplier, a working, always-on Internet connection must be available at the place of installation”; “[y]our home network must be configured such that tado° will automatically get an IP address (DHCP) once connected”; if your Internet connection goes down, you can't remotely control the temperature, but you can still control it via the Smart Thermostat.
  2. embedded software: it is subject to auto updates if the device is connected to the Internet; there is no EULA concerning it;
  3. “service”:
    1. tado° server: “[t]he Smart Thermostat and your mobile devices are connected via our secure cloud server”; “[t]he Supplier's server infrastructure is the central link between the applications and from the applications to the devices”; “[t]he tado° servers are all located in Europe and have the following [security] certificates: SOC 1/SSAE 16/ISAE 3402, FISMA Moderate, PCI DSS Level 1, ISO 27001, FIPS 140-2”; “[w]e have a multiple redundant server setup, so a crash is extremely unlikely. Nevertheless, should our service be interrupted, we will receive a message within minutes so that we can resolve the problem. In case the connection to the server is lost, tado° will remain in the mode that was previously set. For example, if tado° was in Sleep mode, it will remain in this mode. Of course, you can press the Home button on the Generation one tado° box at any time to heat your house up to your preset home temperature. If you have the new Smart Thermostat you can still change the temperature by switching to manual mode and afterwards setting your desired temperature”.
    2. web app (tado.com/login): “[t]he Smart Thermostat and your mobile devices are connected via our secure cloud server”;“[t]he Supplier's server infrastructure is the central link between the applications and from the applications to the devices”; on the web app you can find a report of the temperature at home and the heating times, and also information about how much you have spent today; on the website it is stated that all the functions of the mobile app are also accessible through the web app.
    3. mobile app: it tells the smart thermostat where you are, always displays the temperature at home and lets you change the settings or switching to manual mode remotely; “[t]he Smart Thermostat and your mobile devices are connected via our secure cloud server”; “[t]he Supplier's server infrastructure is the central link between the applications and from the applications to the devices”; on the mobile app you can find a report of the temperature at home and the heating times, and also information about how much you have spent today; “[t]he mobile apps are made available through the various stores for mobile applications (iOS App Store, Android Play Store, Windows Store, etc.)”; “[i]n order to use all the features of the mobile applications a mobile data connection is required"; the mobile apps are currently available for iOS from version 7.0 (iPad2 and iPhone 4 or more recent), Android from version 2.3.3, Windows Phone 8.1 or above; “[i]f you have no network coverage [on your mobile phone] then tado° will maintain the status it had from before the connection was lost. tado° automatically resumes its normal functions once you have network coverage again".
    4. tado° Care: a free additional service designed to prevent heating system breakdowns and offer immediate help in case of malfunctions (it also offers a boiler check later in summer, notified to the consumer via the tado° App).


FAQ can be found at https://support.tado.com/hc/en-gb.

Contact form (which the consumer can use e.g. to ask information about his personal data collected by tado° GmbH) can be found at: https://support.tado.com/hc/en-gb/requests/new.


In the Terms and Conditions we can find this clause, which shows how tado° GmbH takes care of consumers: “The laws of the Federal Republic of Germany to the exclusion of the UN Convention on the Sale of Goods (CISG) shall apply exclusively, including to cross- border deliveries. If the Customer is a consumer, the mandatory consumer protection legislation valid in the country in which the Customer has his habitual residence shall apply in addition, provided that it offers more comprehensive protection.”

Contractual characteristics

Links to Terms&Conditions: Terms and Conditions: https://www.tado.com/gb/terms-and-conditions; Privacy Policy: https://www.tado.com/gb/privacy-policies

Date of Terms&Conditions: 12.05.2015

1. Is the consumer allowed to modify the software and/or hardware without retaliation? No
However, the retaliation seems to be limited to tado° GmbH's absence of liability in case of damages following the software and hardware modification by the consumer. Mere modification seems not to entail remote blocking of the device.

“[T]he Supplier shall not be liable for damage to terminal equipment of third parties connected to the terminals of the Supplier or damage to the terminal devices of the Supplier, as well as devices that are not fit for use, when this is attributable to false or incomplete information provided by the Customer at the time of the compatibility check or failure to observe the instructions of the Supplier.”

“[T]he Supplier shall not accept any liability for damage to equipment connected to terminal devices unless the damage is demonstrably attributable to the operation of one of the terminal devices of the Supplier. The burden of proof lies with the Customer. If no proof is available due to the actions of the Customer (e.g. if the Customer carries out a repair himself), the liability of the Supplier shall be excluded” (incompetence trap).

2. Does the provider reserve to himself the right to modify/delete his own content?
We must verify if the Reports available through the apps must be deleted by the Supplier. Terms and Conditions say nothing, and even the website doesn't seem to contain information about. Request for information has been addressed to tado° GmbH - through the contact form available on the website - on the 10th of June 2015: we are still waiting for an answer.
3. Does the provider reserve to himself the right to modify/delete consumer content?
“The personal data supplied by the Customer, order data and operating data provided by the terminal equipment shall be stored electronically by the Supplier.”

Nothing is said in the Terms and Conditions, but on the website it is stated that “tado° only stores the minimum data required to intelligently control your heating system and deletes all unnecessary data”. - - > But this can be seen as a beneficial behavior for consumer's information security. Moreover, the website also states – in answer to the question “tado° uses a signal from my smartphone to control my heating based on my presence or absence. Does that mean tado° always knows where I am?” – “tado° does not know exactly where you are – it merely calculates how far you are from home. This data is then analysed anonymously and encrypted before being transferred to control your heating. Once this is done, the data is deleted immediately.”

Considering that Reports on the temperature at home and the heating times, and also information about how much you have spent are available through the Apps, we must verify if this other information which is deleted or anonymised is really necessary for the consumer.

4. Is the title on software explicitly transferred to the consumer?
“The subject matter of the contract is the use of software applications and terminal devices of the Supplier for smart control of heating [...]. Applications of the Supplier - hereinafter referred to as "apps" - include both web-based applications and mobile applications.” --> It therefore seems that the embedded software is considered part of the terminal device, no distinction is made: thus, what applies for the hardware component should apply also for the software component.
5. Is the title on hardware explicitly transferred to the consumer?
“Where the Customer rents the devices […] [t]he Supplier reserves the right to charge monthly fees for one year in advance”. “Where the Customer rents the devices, they shall remain the property of the Supplier. After termination of the contractual relationship, the Customer must return the devices to the Supplier at his own expense and at his risk. ”

“When the Customer purchases the devices [...]”. “Where the Customer purchases the devices, the Supplier shall retain title them until they have been paid for in full.”

“The Customer shall be entitled to purchase the devices instead of renting them at any time”.

6. Is the consumer forbidden from reselling the device?
“Where the terminal devices of the Supplier are purchased through third parties, the contract between the Customer and the Supplier shall only come into effect when the Customer registers with the Supplier using one of the apps of the Supplier.”

On the website it is stated: “[y]ou could leave tado° at your old home for the next tenant. In this case you have to ask the landlord if he / she would like to leave tado° installed in the home and transfer the costs to the next tenant.”

7. Is the consumer forbidden from transferring the account?
8. Is there an explicit prohibition to use the device in combination with a third party service?
9. Are there explicit duration boundaries to consumer’s enjoyment of the device?
10. Are there explicit duration boundaries to consumer’s enjoyment of the service?
“The Supplier shall inform the Customers of any necessary maintenance work [on the Supplier's server infrastructure] in a timely manner.”

“Where the terminal devices of the Supplier are purchased through third parties, the contract between the Customer and the Supplier shall only come into effect when the Customer registers with the Supplier using one of the apps of the Supplier.”

“The Supplier reserves the right to interrupt access to the software and the unrestricted use of the applications of the Supplier to the extent this is necessary for compelling reasons, e.g. due to necessary maintenance of servers, programs or the necessary infrastructure, unauthorised data or computer access, or in order to eliminate unforeseen vulnerabilities.” - - > Safety wins on usability, and usability in the long term wins on current usability.

There are no termination terms explicitly stated in the Terms and Conditions, whose subject matter is “the use of software applications and terminal devices of the Supplier”: this means that the contract between the Supplier and the Customer is of indeterminate duration. Therefore, taking inspiration from the contract law principle ius libertatis non debet infringi and from the letter (g) of the Annex of the DIRECTIVE 93/13/EEC on unfair terms in consumer contracts, the contract can be terminated by the Supplier at any time, provided that the consumer is informed with reasonable notice.

11. Are there explicit terms and conditions allowing the consumer to access (view only) his data?
On the website it is stated that on the web/mobile app you can find a report of the temperature at home and the heating times, and also information about how much you have spent today.

The Privacy Policy states: [Y]ou have the right to receive information about the personal data we store on you free of charge and at any time. Under the relevant statutory provisions you also have the right to demand rectification, deletion or blocking of the data concerned. We will always endeavour to respond to any information request from you as soon as possible.”

Contact form can be found at https://support.tado.com/hc/en-gb.

But pay attention to the fact that on the website it is stated – in answer to the question “Is it secure to have my temperature and heating data processed and stored on the tado° server?” – that “tado° only stores the minimum data required to intelligently control your heating system and deletes all unnecessary data”. - - > But this can be seen as a beneficial behavior for consumer's information security. Moreover, the website also states – in answer to the question “tado° uses a signal from my smartphone to control my heating based on my presence or absence. Does that mean tado° always knows where I am?” – “tado° does not know exactly where you are – it merely calculates how far you are from home. This data is then analysed anonymously and encrypted before being transferred to control your heating. Once this is done, the data is deleted immediately.”

12. Are there explicit terms and conditions allowing the consumer to delete his data?
“[Y]ou have the right to receive information about the personal data we store on you free of charge and at any time. Under the relevant statutory provisions you also have the right to demand rectification, deletion or blocking of the data concerned. We will always endeavour to respond to any information request from you as soon as possible.”
13. Are there explicit terms and conditions allowing the consumer to export (with proprietary format) his data?
On the website it is stated that on the web/mobile app you can find a report of the temperature at home and the heating times, and also information about how much you have spent today. But we must verify if this data can be exported out of the app.
14. Are there explicit terms and conditions allowing the consumer to export (with open format) his data?
On the website it is stated that on the web/mobile app you can find a report of the temperature at home and the heating times, and also information about how much you have spent today. But, even if would be possible to export the Reports, it should be verified in which format this is possible.
15. Does the provider reserve to himself the right to unilaterally modify terms and conditions?
Terms and Conditions apply “in the version valid at the time the contract was concluded”.

“Where the terminal devices of the Supplier are purchased through third parties, the contract between the Customer and the Supplier shall only come into effect when the Customer registers with the Supplier using one of the apps of the Supplier.” - - > Can we state that this is a browse-wrap consent? We should verify if those Terms and Conditions are only displayed at https://www.tado.com/gb/terms-and-conditions or if they appear at the first login to the web app and/or during the mobile app download: when you create a new account for the web app (https://my.tado.com/webapp/#/account/create-account/), it is stated “By clicking Create account, you accept general terms and conditions and the privacy policy of tado°”, with a link to the pages containing them.

“The Supplier shall be entitled to change these General Terms and Conditions unilaterally - insofar as they form an integral part of the contract with the Customer and if this is necessary to eliminate a subsequent disturbance to the equilibrium of the contract or to adapt the contract to the changing legal or technological conditions. The Supplier shall notify the Customer accordingly about any changes to the provisions of the contract and provide the Customer with the content of the amended provisions. The amendment shall become an integral part of the contract, if the Customer does not object to the inclusion of the amended provisions within six weeks of receipt of notification of change either in writing or electronic form.” - - > This clause seems to be respectful of the Annex to the DIRECTIVE 93/13/EEC on unfair terms in consumer contracts, whose paragraph 1 letter (j) states: “enabling the seller or supplier to alter the terms of the contract unilaterally without a valid reason which is specified in the contract”; indeed, paragraph 2 letter (b): “Subparagraph (j) is also without hindrance to terms under which a seller or supplier reserves the right to alter unilaterally the conditions of a contract of indeterminate duration, provided that he is required to inform the consumer with reasonable notice and that the consumer is free to dissolve the contract”.

16. Does the provider reserve to himself the right to unilaterally modify the software?
The website speaks about “automatic updates”. Terms and Conditions say: “The Supplier shall inform the Customers of any necessary maintenance work [on the Supplier's server infrastructure] in a timely manner.”

“The Supplier reserves the right to interrupt access to the software and the unrestricted use of the applications of the Supplier to the extent this is necessary for compelling reasons, e.g. due to necessary maintenance of servers, programs or the necessary infrastructure, unauthorised data or computer access, or in order to eliminate unforeseen vulnerabilities.”

On the website it is stated: “Firmware updates are linked to the hardware version. For all functions which are supported by a given hardware version we will release unlimited automatic updates. There are no differences in renting or buying regarding this.”

Technical characteristics

1. Which is the duration of the provider role?
“The Smart Thermostat and your mobile devices are connected via our secure cloud server".“The Supplier's server infrastructure is the central link between the applications and from the applications to the devices". “The Supplier shall inform the Customers of any necessary maintenance work [on the Supplier's server infrastructure] in a timely manner.”

“The Supplier shall only be liable for damage other than injury to life, body or health to the extent that they are the result of intent or gross negligence or culpable breach of material contractual obligations, i.e. obligations, which are essential for the proper performance of the contract and the fulfillment of which the client may routinely rely upon, by the Supplier or his vicarious agents”.

“The Supplier reserves the right to interrupt access to the software and the unrestricted use of the applications of the Supplier to the extent this is necessary for compelling reasons, e.g. due to necessary maintenance of servers, programs or the necessary infrastructure, unauthorised data or computer access, or in order to eliminate unforeseen vulnerabilities.”

There are no termination terms explicitly stated in the Terms and Conditions, whose subject matter is “the use of software applications and terminal devices of the Supplier”: this means that the contract between the Supplier and the Customer is of indeterminate duration. Therefore, taking inspiration from the contract law principle ius libertatis non debet infringi and from the letter (g) of the Annex of the DIRECTIVE 93/13/EEC on unfair terms in consumer contracts, the contract can be terminated by the Supplier at any time, provided that the consumer is informed with reasonable notice.

On the website it is stated: “Does the system send data to a server while in use? Controlling the heating system while including weather forecast and building characteristics needs a high degree of computing capacity that exceeds regular computers and phones. Therefore some data is securely transmitted between Connector Kit and our powerful servers which perform these calculations.”

On the website it is stated: “Firmware updates are linked to the hardware version. For all functions which are supported by a given hardware version we will release unlimited automatic updates. There are no differences in renting or buying regarding this.”

2. Is the branded hardware necessary for product usability?
3. Is the branded software necessary for product usability?
“The Supplier reserves the right to interrupt access to the software and the unrestricted use of the applications of the Supplier to the extent this is necessary for compelling reasons, e.g. due to necessary maintenance of servers, programs or the necessary infrastructure, unauthorised data or computer access, or in order to eliminate unforeseen vulnerabilities.”
4. Is the branded "service" necessary for product usability?
“The Smart Thermostat and your mobile devices are connected via our secure cloud server.”. “The Supplier's server infrastructure is the central link between the applications and from the applications to the devices.”

“As soon as you have a new mobile phone, you download the tado° app again, log on and continue to use tado° like before. Your user is then automatically logged out from the other phone.”

5. Do the device's administration rights belong to the product provider?
“The Supplier reserves the right to interrupt access to the software and the unrestricted use of the applications of the Supplier to the extent this is necessary for compelling reasons, e.g. due to necessary maintenance of servers, programs or the necessary infrastructure, unauthorised data or computer access, or in order to eliminate unforeseen vulnerabilities.”
6. Which possibilities does the consumer have to dispose of his data?
On the website it is stated that on the web/mobile app you can find a report of the temperature at home and the heating times, and also information about how much you have spent today: but we have to verify is it is possible to export the reports, and in which format.

“The personal data supplied by the Customer, order data and operating data provided by the terminal equipment shall be stored electronically by the Supplier.”

“[T]he Supplier stores usage and operational data generated by the terminal equipment of the Supplier (such as temperature data, presence and absence times, movement to and from the household, selected settings, devices used)”.

“[Y]ou have the right to receive information about the personal data we store on you free of charge and at any time. Under the relevant statutory provisions you also have the right to demand rectification, deletion or blocking of the data concerned. We will always endeavour to respond to any information request from you as soon as possible.”

On the website it is stated: “You can uninstall tado° at any time as easily as you installed it. […] Then you can take your tado° with you and install it in your new home. Alternatively you could leave tado° at your old home for the next tenant. […] In this case we will organise a new tado° for your next home.”

“As soon as you have a new mobile phone, you download the tado° app again, log on and continue to use tado° like before. Your user is then automatically logged out from the other phone.” “As well as using the smartphone app, can I access all tado° functions via the internet, for instance if I have lost my phone or want to block the app? Yes [...]” - - > This means that to remotely disconnect a mobile phone from the mobile app, the consumer has to log in on another phone or to block the mobile app through the web app.

Usability

1. Can the consumer enjoy the product for an unlimited period?
There are no termination terms explicitly stated in the Terms and Conditions, whose subject matter is “the use of software applications and terminal devices of the Supplier”: this means that the contract between the Supplier and the Customer is of indeterminate duration. Therefore, taking inspiration from the contract law principle ius libertatis non debet infringi and from the letter (g) of the Annex of the DIRECTIVE 93/13/EEC on unfair terms in consumer contracts, the contract can be terminated by the Supplier at any time, provided that the consumer is informed with reasonable notice.

Therefore, if we answer affirmatively to Question TC4 – which seems really probable, considering that “[t]he Smart Thermostat and your mobile devices are connected via our secure cloud server”, and that “[t]he Supplier's server infrastructure is the central link between the applications and from the applications to the devices”the consumer is subject at any time – even if with a reasonable notice – to the possibility of not being able anymore to enjoy the product.

On the website it is stated: “Firmware updates are linked to the hardware version. For all functions which are supported by a given hardware version we will release unlimited automatic updates. There are no differences in renting or buying regarding this.”

2. Can the consumer sell the device?
3. Can the consumer transfer the account?
4. Can the consumer delete his data?
5. Can the consumer delete his account?
6. Can the consumer use his data?
7. Can the consumer use the HW and SW in combination with third party SRV?
8. Can the consumer use the HW and SRV in combination with third party SW?
9. Can the consumer use the SW and SRV in combination with third party HW?
10. Can the consumer use the HW in combination with third party SW and SRV?
11. Can the consumer use the SW in combination with third party HW and SRV?
12. Can the consumer use the SRV in combination with third party HW and SW?

[[Category:{{{topics}}}]]