# Privacy Notice — MCP Server for ETS

## 1. About MCP Server and this notice

MCP Server for ETS (the **MCP Server**) consists of an add-in for ETS and a
separate local server/dashboard. VK Systems Oy provides support for the product
at **support@vksystems.fi**. This notice describes support and licensee
information handled by VK Systems Oy and relevant product data flows. The
controller for that processing is VK Systems Oy, business ID 3111276-9,
registered at Mahlakuja 9B, 02130 Espoo, Finland. This notice does not make VK Systems Oy the
controller for all processing by users, ETS, providers, clients or other
organizations.

The product does not automatically send app data to VK Systems Oy. Separately,
VK Systems Oy may obtain or download information about MCP Server for ETS
licensees made available by KNX Association (KNXA), solely for performance of
the licence contract between VK Systems Oy and its customer: licence
administration and verification and determining support entitlement within
that purpose. This is a deliberate
receipt from KNXA, not automatic product transmission or telemetry.
VK Systems Oy also receives personal data when a user submits it for support.
ETS, the operating system and other services may have their own processing and
network activity; this notice is not an exhaustive account of it.

## 2. Data processed and where it goes

Depending on the features used, the add-in, server, dashboard, MCP clients and
configured services may process:

- **Project and file data:** project, device, group-address, parameter,
  topology, installation, history, names, comments and host-file content. This
  can include personal data, such as names, room or building labels and device
  locations. Tools expose selected project data and can make changes; ordinary
  project reads and edits are not blocked by the permission switches.
- **Chat and tool data:** messages, prompts, assistant replies, tool definitions,
  calls, arguments, results and activity history. The assistant can execute
  tool changes, not merely suggest them.
- **Bus, device and security data:** bus/device information and, when enabled
  and used, commissioning or security material.
- **Settings, credentials and logs:** settings and credentials are stored
  locally. On Windows, credentials are protected using the current Windows
  user's credential protection; this does not describe copies placed in client
  configuration. Logs may contain exception details, paths, arguments, project
  or personal data, and—when debug logging is enabled—selected project,
  parameter, result or security information.

The Bus operations, Key material and File access switches are off initially
unless saved settings restore them. They are shared within the ETS process, not
isolated by client or project, and do not prompt for every operation.

Chat may use a configured local, cloud or proxy provider. A local MCP
connection does not mean downstream processing stays local: external clients
may forward data to other services. Depending on configuration and use, a
provider may receive user-entered or pasted information, prompts, conversation
history, tool definitions and calls, permitted results, outcome history,
request metadata and the provider credential. A provider, MCP client or other
recipient may retain or further process what it receives under its own terms.

When a provider URL and matching saved credential are configured, the product
automatically makes an authenticated request for the provider's model list. If
chat is configured when the panel opens, it may send a greeting when the panel
is ready. Other provider requests follow user interaction. The product may
also perform network file or KNX operations when those features are used.

The server uses a local broker by default; deliberately exposing it remotely
changes who may reach it. Authentication does not encrypt network traffic.
This is not an exhaustive inventory of network activity by ETS, the operating
system, dependencies or other services.

## 3. Purposes and legal bases

VK Systems Oy processes support contact details, correspondence and materials a
user submits to respond to support requests, investigate reported issues and
resolve support cases.

VK Systems Oy may obtain or download information about MCP Server for ETS
licensees that KNX Association (KNXA) makes available to it as licensor/developer,
solely for performance of the licence contract between VK Systems Oy and its
customer: licence administration and verification and determining support
entitlement within that purpose. This is a deliberate download, not automatic
product transmission.
The specific information KNXA makes available may vary.

For licence administration, verification and support-entitlement checks within
the contractual purpose above, VK Systems Oy relies on GDPR Article 6(1)(f): its legitimate interest in
administering and verifying licensed use and determining support entitlement,
balanced against the rights and freedoms of the people concerned. Article
6(1)(b) applies only where processing is objectively necessary for a contract
with the individual or pre-contractual steps requested by that individual; a
KNXA licence relationship does not by itself establish a contract with each
individual whose information may be made available. For support processing,
Article 6(1)(b) applies only where that same individual-contract necessity test
is met; otherwise VK Systems Oy relies, where appropriate, on its legitimate
interest in effective support and customer communication under Article 6(1)(f).
A person may object to either legitimate-interest processing on grounds relating
to their particular situation (see section 5). Contract necessity does not
automatically cover other people's data included in support material.

These bases describe VK Systems Oy's support and licensee-information processing, not processing carried
out locally by a user or by a configured provider, MCP client or other
organization. The party responsible for that processing must determine its
role and applicable basis. Please do not submit unnecessary personal
information, credentials or security data; redact them from support material
where possible.

## 4. Storage, retention, sharing and diagnostics

Support material received by VK Systems Oy is retained until the support case
is handled and deleted afterwards. Licensee information obtained from KNXA is
retained only as long as necessary for performance of the licence contract and
the licence administration, verification and support-entitlement purposes above.
It is erased when the customer's licence agreement terminates for any reason,
subject to applicable statutory law. Chat transcript and provider context are
held in memory; starting a new chat clears the transcript and provider
context. This does not mean that closing the panel deletes data, or that
providers and clients delete their copies. Settings and credentials persist
locally until changed or removed. User exports and copies, and recipients'
retention, are separate.

Logs rotate by size, not by a stated age limit, and can contain exception
details or project, personal, debug or security information. Debug SDK logging
is off by default; when enabled, selected calls and values may be logged. Check
and redact logs before sharing them. Support submissions may include logs,
transcripts, contact details and personal data within them. VK Systems Oy does
not receive them automatically.

## 5. Rights and complaints

For support or licensee personal data handled by VK Systems Oy, contact
**support@vksystems.fi** to request applicable rights, including access,
rectification, erasure or restriction. Data portability applies only when its
GDPR conditions are met. You may object to processing based on legitimate
interests on grounds relating to your particular situation; VK Systems Oy will
consider the objection under the GDPR. For data handled by an employer,
provider, MCP client or another organization, contact the organization
responsible for that processing. Deleting or changing local data does not
delete copies held by recipients.

You may complain to a supervisory authority. In Finland, the supervisory
authority is the **Office of the Data Protection Ombudsman** (tietosuojavaltuutetun
toimisto); information is available at **tietosuoja.fi**. You may also contact
the competent supervisory authority for your circumstances.

The controller for the processing described in this notice is VK Systems Oy.
Contact for support and privacy requests:

VK Systems Oy  
Business ID: **3111276-9**  
Registered address: **Mahlakuja 9B, 02130 Espoo, Finland**  
**support@vksystems.fi**