Gigaset Professional – EU Data Act (Regulation (EU) 2023/2854) and the handling of usage data from our products

As a manufacturer of DECT and IP-based telecommunications solutions, we take the responsible handling of data very seriously and welcome the objectives of the EU Data Act to strengthen transparency, user rights, and fair data access within the European Union.

Below, we would like to provide you with an overview of how we comply with the requirements of the regulation.

Gigaset Professional product categories

The Gigaset Professional portfolio includes three main product categories:

• DECT IP systems with single- and multicells
• DECT handsets
• Deskphones

As network equipment all devices are connected to the Internet and send information to the Gigaset Support server. In addition, there is data that is stored directly on the devices themselves.

Below you find a list of the type of data that is sent to the Gigaset support server and that is stored on the devices for each product category.

The server is located in Germany. Hosting & data access is managed only by Gigaset Technologies GmbH in accordance with European data protection law (GDPR – General Data Protection Regulation).

Gigaset Redirect and Provisioning Environment (GRAPE)

The Gigaset Redirect And Provisioning Environment (GRAPE) enables secure zero-touch device deployment. As a reseller, you may remotely manage your clients and their devices.
Users may set up redirection rules and create provisioning templates – anytime, from anywhere.

Reasons for transferring data from the product to the product server

Once the device is connected to the Internet, it automatically contacts the Gigaset Support server to make it easier for you to configure the devices and to enable communication with Internet services. Data transfer is mandatory as the basis for patching thus fulfilling the legal obligation to make security patches available. The system sends information when it is started and then usually once a day. These transmissions can be event-based and can therefore occur at higher frequencies.

Access of data

Data can be accessed by the user through the Gigaset support server or for data stored on the device itself accessed via the device UI and/or the web UI. There is an existing diagnostic file for each product that can be downloaded by the user through the web UI.

Deletion of data

All data on the device can be deleted by resetting it to factory settings. If your device is registered by you or your installer on GRAPE, the data can be deleted by you or your installer via the GRAPE web-interface.

DECT IP systems

The system sends the following information to the support server:

• Part-number

• MAC address

• Own IP address on the LAN

• Device name
• Software version
• Number of registered handsets
• Number of connected base stations
• Number of connected DECT managers
• License information

On the support server, this information is linked to the existing device-specific information:

• MAC address and factory generated MAC password

The following data is stored locally on the device:

• Call logs
• Device settings
• License information

• Phonebook: Local, central

• Syslog

• Statistics

• Incidents

• Diagnostics

• DECT Measurements

DECT handsets

The device sends the following information to the support server:

• Serial number / item number / IPUI

• Device name

• Software version

• Hardware version

The following data is stored locally on the device:

• IPUI
• Device type
• Software version
• Call logs
• Device settings
• SUOTA (Software Update Over The Air)

• Auto-provisioning version

Desk phones

The device sends the following information to the support server:

• MAC address
• Software version
• Connected Extension Modules

The following data is stored locally on the device:

• MAC address
• Software version
• Connected Extension Modules
• Device settings
• Call logs
• Directory
• Syslog
• Memory information
• Diagnostics (e.g. SIP trace, PCAP trace, action URL)

Gigaset Redirect and Provisioning Environment

Device related data:
All data transfer depends on user configuration of provisioning web services.
We store following data provided by the user:

• Provisioning profiles
• Setting definition for given devices
• Files: Custom XML / Default values / Music on hold / Customization of frontend of the device

We store and present provisioning logs – device request initiated by device with server response (request headers, response headers, response body)

• By default, provisioning log time-to-live is set to 1 day

We process IP addresses in order to identify geographical location and build statistic pages for portal admin based on those data.

User related data (similar to GDPR):
Data which customer provided and has already access to in profile and company page.

Customer data base related fields:

• Country
• Created_at
• Email
• First_name
• Last_name
• Mobile_number
• Phone_number
• Salutation
• Username

Company data base related fields:

• Bank_name
• Bic
• City
• Country
• Created_at
• Delivery_city
• Delivery_country
• Delivery_postal_code
• Delivery_street
• Email
• IBAN
• Last_login_at
• Name
• Phone_number
• Postal_code
• Street
• VAT
• Website

User activity log – we track and present to the user action performed by user on our portal.

We store various anonymized data for monitoring purposes.

Gigaset.net

• Provisioning logs
• WAN IP addresses (anonymous)
• Business metrics data:
  • User agent
  • Firmware version
  • Country
  • Internet provider
  • Number of registered handsets

  • Number of Bases

  • Number of DECT managers

  • Local IP address