This is a courtesy translation. In case of doubt, the German version is authoritative.
This policy covers the Filates app only. The website is covered by the website privacy policy.
1. Controller
The controller for the processing of personal data in connection with the Filates app within the meaning of the General Data Protection Regulation (GDPR) is:
Alexandra Varenhold
c/o TUHH StartUp Port
Harburger Schloßstraße 6-12
21079 Hamburg
Email: datenschutz@varenhold.de
2. Data on your device
The app stores the information you enter locally on your own device by default. That data stays with you. We have no access to it and it is not transmitted to us.
If you delete the app from your device, the locally stored data is removed with it.
3. Data transmitted to us
Only the following data is transmitted to our servers and processed there:
Your chat messages
The content of the messages you send in the chat. Legal basis: Art. 6 (1) (a) GDPR, consent, see section 4.
Your proof of consent
Your reference (a short code), the version of this policy, the time you gave your consent, the language you gave it in, which of the two statements from section 4 you gave, and a random identifier for your app installation. Without this record we could not demonstrate that you consented.
Legal basis: we have to be able to produce this record even after you withdraw your consent. It therefore cannot rest on the consent alone that it evidences. Which legal basis it properly rests on is currently under legal review.
Your push token, once you switch notifications on
A device identifier (a push token). It is the address a notification to your device can be delivered to.
Two further pieces of information reach us with it. First, the fixed text the notification is later meant to show: the app writes that text and sends it in the language you are using the app in, so that our server never has to compose any wording for you. Second, the kind of device you have, iPhone or Android, because delivery would otherwise not take the right route.
All of this is transmitted only from the moment you switch notifications on, not before. If you never switch them on, we receive none of it. If you switch them off again, we delete all of it, as described in section 6. Legal basis: Art. 6 (1) (a) GDPR, consent, see section 6.
Your IP address
Technically unavoidable during transmission, and processed to keep the service running and to prevent abuse. Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in operational security.
No other data is transmitted to us. In particular, the name you enter in the app is not sent to us: it stays on your device. The app contains no analytics, statistics or advertising tools.
When you report a problem to us
You can report a problem to us from the chat. The app opens your mail app and puts your reference into the text, so that we can identify the conversation. Nothing from your messages is included unless you add something yourself. The mail goes to app@varenhold.de and is used only to reply to you.
4. Your consent
Before you use the chat for the first time, the app asks for your consent. Nothing from the chat is transmitted to us before that point: as long as you have not consented, the app sends no chat data to our servers. If you open the full privacy policy at that point, it is loaded from our website, which is covered by the website privacy policy.
You give two separate statements:
- that your chat messages may be stored and processed as described in this policy, and
- that you acknowledge this is purely financial education and does not constitute financial advice (see section 12).
Both statements are required. Without both, the chat cannot start.
Filates is intended for adults. The app is not offered to children.
Your consent is recorded together with the version of this policy and the time, and is then shown as the first entry in your chat history. It therefore stays permanently readable, both to you and to us, so you can always see when and for what you gave consent.
You are given your reference at that point, a short code. Please keep it. It is how you can request deletion of your data after you have removed the app from your device (see section 7). You can also find it at any time in the app under Settings, Privacy.
You may withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR): in the app under Settings, Privacy, with a message in the chat, or with an email to datenschutz@varenhold.de quoting your reference. After a withdrawal we can no longer provide the chat to you.
5. Retention period
Messages and their associated metadata are deleted automatically 90 days after your last message. If you never wrote a message, the same period runs from the time you gave your consent. You do not need to do anything for this to happen.
Everything belonging to your app installation is deleted then, including your proof of consent and your push token from section 3. No separate rule is needed for that: the same deletion clears everything attached to your installation. After that your reference leads nowhere: it can no longer be matched, because there is nothing left to match it to.
6. Push notifications
No notification ever contains the content of your messages, no name, no excerpt and no fragment of the conversation. That holds for both directions there are, and both of them are active now.
To you: active on iPhone. When you switch notifications on, the app transmits a device identifier (a push token) to us, but only from that moment, not before. The notification then tells you that a reply has arrived for you. Its wording is fixed in the app and is the same every time, whatever the reply happens to say. The only other thing sent along is an identifier for the conversation, so that a tap on it lands in the right chat.
It is delivered from our server through Apple Push Notification service (see sections 8 and 9). Apple Distribution International Ltd. receives your device’s push token, the identifier of the conversation and that fixed sentence, and nothing else. The content of your messages is not sent there, so there is nothing there to read. The push token is deleted together with all other data after the period stated in section 5. Legal basis: Art. 6 (1) (a) GDPR, consent.
You may withdraw that consent at any time, in either of two ways. If you switch notifications off in the app, we delete your push token straight away. If you switch them off in your device settings instead, no notification reaches your device from that moment on; the token itself is deleted the next time you open the app, and at the latest under the deadline in section 5. If you never open the app again, it therefore stays stored until that deadline.
The app does not exist for Android yet. Once it does, delivery to those devices additionally runs through Firebase Cloud Messaging (see sections 8 and 9). Nothing else about this changes, least of all the fact that the notification carries no content.
To the person who replies to you: active as well. So that your message does not sit unnoticed, their device receives a short alert as soon as a message from you arrives. That alert says only that a new message is there. The only thing sent along is an identifier for the conversation, so that a click on it lands in the right chat.
It is delivered through Apple Push Notification service (see sections 8 and 9). The alert is encrypted on top of that, so Apple Distribution International Ltd. cannot read it anyway. Legal basis: Art. 6 (1) (a) GDPR, consent, see section 4. Getting your message to the person who replies to you is the purpose you consented to.
7. Deletion on request
You can request deletion of your data at any time. There are three ways to do it:
- In the chat: simply write to us that you want your data deleted.
- Yourself in the app: under Settings, Privacy you delete your chat data directly and immediately, without having to ask us.
- By email: write to datenschutz@varenhold.de quoting your reference. This still works once the app is no longer on your device.
Important limitation
The app uses no user accounts and no sign-in. Your reference is therefore the only attribute by which your data can still be identified after an uninstall.
If you have deleted the app and no longer have your reference, we cannot match a deletion request to any data. We are then unable to delete anything on request. The data is, however, still deleted automatically after 90 days, see section 5.
8. Where and by whom your data is processed
Hosting
Servers and the database are operated exclusively by the following provider within the EU:
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
Operators of the notification services
Both notifications described in section 6 go through Apple Push Notification service today: the one to you, because the app so far exists for iPhone only, and the one to the person who replies to you, because they work in Safari only. The recipient is therefore the same company in both cases:
Apple Distribution International Ltd.
Hollyhill Industrial Estate
Hollyhill, Cork
That company receives no content from your messages, but it is a recipient in the data protection sense and therefore appears here.
Once the app exists for Android (see section 6), a second operator is added for devices not made by Apple:
Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Transfers to third countries
Your messages and your proof of consent are stored exclusively within the EU.
There is an exception, and it concerns transmission rather than storage: both notifications described in section 6 go through Apple Push Notification service. All that is transmitted is the device identifier (push token), an identifier for the conversation and the fixed, content-free text of the notification, no content from your messages. The alert to the person who replies to you is encrypted on top of that.
The providers named above are companies established in the European Economic Area whose parent companies are established in the United States. A transfer of data to the USA can therefore not be excluded.
Apple Distribution International Ltd. delivers the notification on our behalf and on our instructions, and is our processor within the meaning of Art. 28 GDPR in doing so. The transfer to the United States rests on the European Commission’s adequacy decision on the EU-US Data Privacy Framework. All that is transferred is the device identifier, the identifier of the conversation and the fixed, content-free text of the notification, never the content of your messages.
The same applies to Google Ireland Limited once the app exists for Android and that company is added as a second operator.
9. Disclosure to third parties
Your personal data is not sold, rented or passed on for advertising purposes.
The recipients are exclusively:
- Hetzner Online GmbH as the technical processor for servers and the database (see section 8),
- Apple Distribution International Ltd. for the content-free notifications to you and to the person who replies to you in the chat (see section 6), and
- once the app exists for Android, additionally Google Ireland Limited for the delivery of the notifications to you (see sections 6 and 8).
10. Your rights
As a data subject you have the following rights:
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data, the “right to be forgotten” (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability in a common format (Art. 20 GDPR)
- Withdrawal of your consent at any time with effect for the future (Art. 7 (3) GDPR)
- Objection to processing (Art. 21 GDPR)
To exercise any of these rights, send a message in the chat or an email to datenschutz@varenhold.de quoting your reference. We will respond within 30 days. For deletion requests, please note the limitation in section 7.
11. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 7. OG
20459 Hamburg
Phone: 040 / 428 54 - 40 40
mailbox@datenschutz.hamburg.de
12. Disclaimer
The content of the app is provided for information and educational purposes only. Please note the following:
The app is not a substitute for professional financial or investment advice. Individual financial and investment decisions require a qualified professional.
All assessments are based on your own statements and are intended as personal orientation, not as individual financial recommendations.
Decisions you make on the basis of the app’s content are your own responsibility. No liability is accepted for consequences arising from its use.
You additionally acknowledge this point explicitly before the chat starts (see section 4).
13. Currency of this privacy policy
We reserve the right to amend this privacy policy as necessary to keep it aligned with current legal requirements. The version published here is the one that applies.