Kurskontrolle UG (haftungsbeschränkt)

Jahnstraße 43
41564 Kaarst
Authorized representatives: Dr. Simon Lichte, Kornelius Dridger
Email address: info@maxymetric.com

Overview of Data Processing

The following overview summarizes the types of data processed, the purposes of their processing, and refers to the affected persons.

Types of Data Processed

• Inventory data (e.g., names, addresses)
• Content data (e.g., entries in online forms)
• Contact data (e.g., email, telephone numbers)
• Meta/communication data (e.g., device information, IP addresses)
• Usage data (e.g., visited websites, interest in content, access times)
• Contract data (e.g., contract subject, term, customer category)
• Payment data (e.g., bank details, invoices, payment history)

Categories of Data Subjects

• Business and Contract Partners
• Interested Parties
• Communication Partners
• Customers
• Users (e.g., website visitors, users of online services)

Purposes of Processing

• Provision of Contractual Services and Customer Support
• Contact Requests and Communication
• Security Measures
• Direct Marketing
• Reach Measurement
• Office and Organizational Procedures
• Affiliate Tracking
• Management and Response to Inquiries
• Feedback
• Marketing
• Profiles with User-Related Information
• Provision of Our Online Services and User-Friendliness

Relevant Legal Bases

Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the GDPR regulations, national data protection regulations in your or our country of residence or establishment may apply. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1)(a) GDPR) – The data subject has given their consent to the processing of their personal data for one or more specific purposes.
• Performance of a Contract and Pre-Contractual Inquiries (Art. 6(1)(b) GDPR) – The processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.
• Legal Obligation (Art. 6(1)(c) GDPR) – The processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate Interests (Art. 6(1)(f) GDPR) – The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National Data Protection Regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), which aims to protect against the misuse of personal data during data processing. The BDSG contains specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer and automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for purposes related to employment (§ 26 BDSG), especially regarding the establishment, execution, or termination of employment relationships, as well as the consent of employees. Additionally, data protection laws of the individual federal states may also apply.

Security Measures

In accordance with legal requirements, taking into account the state of the art, the implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying probabilities and severity of threats to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, transmission, securing availability, and segregation of the data. Additionally, we have established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to data security threats. We also consider the protection of personal data during the development or selection of hardware, software, and procedures, in accordance with the principle of data protection by design and by default.

SSL Encryption (HTTPS): To protect the data transmitted via our online offering, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in your browser’s address bar.

Transfer of Personal Data

In the course of processing personal data, it may happen that the data is transferred to other entities, companies, legally independent organizational units, or individuals, or is disclosed to them. Recipients of these data may include service providers tasked with IT duties or providers of services and content integrated into a website. In such cases, we adhere to legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to protect your data.

Data Processing in Third Countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if processing occurs in the context of using third-party services or disclosing or transferring data to other persons, entities, or companies, this is done only in accordance with legal requirements.

Subject to explicit consent or contractual or legally required transmission, we process or allow the data to be processed only in third countries with a recognized level of data protection, contractual obligation through so-called EU Commission standard protection clauses, certifications, or binding internal data protection regulations (Art. 44 to 49 GDPR, EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of Data

The data we process will be deleted in accordance with legal requirements as soon as their consent for processing is revoked or other permissions cease to apply (e.g., if the purpose for processing these data no longer exists or they are not necessary for the purpose).

If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. This means the data will be locked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary to assert, exercise, or defend legal claims or to protect the rights of another natural or legal person.

As part of our data protection information, we may provide users with further information on the deletion and retention of data that is specific to the respective processing processes.

Use of Cookies

Cookies are small text files or other storage markers that store information on end devices and retrieve information from them. For example, they can store the login status in a user account, the contents of a shopping cart in an e-shop, the accessed content, or used functions of an online service. Cookies can also be used for various purposes, such as ensuring the functionality, security, and comfort of online services, as well as creating analyses of visitor flows.

Notes on Consent: We use cookies in compliance with legal regulations. Therefore, we obtain prior consent from users unless legally not required. Consent is not necessary, particularly when storing and retrieving the information, including cookies, is strictly necessary to provide a telemedia service (i.e., our online offering) explicitly requested by the users. The revocable consent is clearly communicated to users and includes information about the specific use of cookies.

Notes on Legal Bases for Data Protection: The legal basis on which we process users’ personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is the given consent. Otherwise, the data processed with the help of cookies is based on our legitimate interests (e.g., a commercial operation of our online offering and improvement of its usability) or, if necessary for fulfilling our contractual obligations, when the use of cookies is required to fulfill our contractual obligations. We clarify the purposes for which cookies are processed in the course of this privacy policy or within our consent and processing procedures.

Storage Duration: The following types of cookies are distinguished concerning the storage duration:

• Temporary Cookies (also: Session Cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes their end device (e.g., browser or mobile application).
• Permanent Cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved, or preferred content can be displayed directly when the user revisits a website. Likewise, the data collected with the help of cookies can be used to measure reach. Unless we provide explicit information to users about the type and duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are permanent and that the storage duration can be up to two years.

General Information on Withdrawal and Objection (Opt-Out): Users can revoke their given consents at any time and object to the processing according to the legal requirements of Art. 21 GDPR (further information on the objection is provided in this privacy policy). Users can also declare their objection via their browser settings.

Further Information on Processing, Procedures, and Services:

• Processing of Cookie Data Based on Consent: We use a cookie consent management procedure through which users’ consents to the use of cookies, or the processing mentioned within the cookie consent management procedure and providers, are obtained, managed, and revoked. The consent declaration is stored to avoid repeating the query and to prove the consent per legal obligations. Storage can occur server-side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies) to attribute the consent to a user or their device. Subject to individual details on the providers of cookie management services, the following notes apply: The duration of storing the consent can be up to two years. A pseudonymous user identifier is created and stored with the consent’s time, information on the scope of the consent (e.g., which categories of cookies and/or service providers), and the browser, system, and used end device.
• ccm19: Cookie Consent Management; Service provider: Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany; Website: https://www.ccm19.de/; Privacy Policy: https://www.ccm19.de/datenschutzerklaerung.html; Further information: A pseudonymous user ID is stored with the consent status.

Business Services

We process data from our contractual and business partners, such as customers and interested parties (collectively referred to as “contractual partners”), in the context of contractual and comparable legal relationships and related measures, as well as in the context of communication with the contractual partners (or pre-contractually), e.g., to respond to inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed services, any update obligations, and remedies for warranty and other performance issues. Additionally, we process the data to protect our rights and for the purposes of administrative tasks and business organization associated with these obligations. Moreover, we process the data based on our legitimate interests in proper and economic business management and in security measures to protect our contractual partners and our business operations from misuse, threats to their data, secrets, information, and rights (e.g., involving telecommunications, transportation, and other support services, subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Within the scope of applicable law, we only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about further forms of processing, e.g., for marketing purposes, within this privacy policy.

We inform contractual partners about the necessary data for the aforementioned purposes before or during data collection, e.g., in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete the data after the expiration of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as they must be retained for legal archiving reasons (e.g., for tax purposes, usually 10 years). Data disclosed to us by the contractual partner as part of an order is deleted in accordance with the order specifications, generally after the end of the order.

If we use third-party providers or platforms to provide our services, the terms and privacy notices of the respective third-party providers or platforms apply in the relationship between users and the providers.

Customer Account: Contractual partners can create an account within our online offering (e.g., customer or user account, “customer account”). If registration of a customer account is required, contractual partners will be informed about this as well as the required information for registration. The customer accounts are not public and cannot be indexed by search engines. During registration, subsequent logins, and usage of the customer account, we store the IP addresses of the customers along with the access times to prove registration and prevent misuse of the customer account.

When customers have terminated their customer account, the data related to the customer account will be deleted unless retention is necessary for legal reasons. It is the customers’ responsibility to secure their data upon termination of the customer account.

Offering Software and Platform Services: We process the data of our users, registered and any test users (hereinafter collectively referred to as “users”), to provide our contractual services and based on legitimate interests to ensure the security of our offering and to further develop it. The required information is marked as such in the context of the order, purchase, or comparable contract conclusion and includes the information required for service provision and billing as well as contact information for any necessary consultations.

Types of Processed Data:

• Inventory data (e.g., names, addresses)
• Payment data (e.g., bank details, invoices, payment history)
• Contact data (e.g., email, phone numbers)
• Contract data (e.g., contract subject, duration, customer category)
• Usage data (e.g., visited websites, interest in content, access times)
• Meta/communication data (e.g., device information, IP addresses)

Affected Persons: Customers, interested parties, business, and contractual partners.

Purposes of Processing:

• Provision of contractual services and customer service
• Security measures
• Contact inquiries and communication
• Office and organizational procedures
• Management and response to inquiries

Legal Bases:

• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)

Provision of the Online Offer and Web Hosting

To provide our online offer securely and efficiently, we utilize the services of one or more web hosting providers, from whose servers (or servers they manage) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space, and database services, as well as security services and technical maintenance services.

The data processed in the context of providing the hosting offer can include all information related to the users of our online offer, which arises during usage and communication. This regularly includes the IP address, which is necessary to deliver the contents of online offers to browsers, and all entries made within our online offer or on websites.

Email Sending and Hosting: The web hosting services we use also include the sending, receiving, and storing of emails. For these purposes, the addresses of recipients and senders, as well as other information regarding email transmission (e.g., the involved providers) and the contents of the respective emails, are processed. The aforementioned data can also be processed for SPAM detection purposes. Please note that emails on the internet are generally not sent in encrypted form. Although emails are usually encrypted during transport, they are not encrypted on the servers from which they are sent and received (unless an end-to-end encryption method is used). Therefore, we cannot take responsibility for the transmission path of the emails between the sender and the receipt on our server.

Collection of Access Data and Log Files: We (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the retrieved web pages and files, date and time of retrieval, transferred data volumes, messages about successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider.

The server log files can be used for security purposes, e.g., to avoid server overload (especially in the case of abusive attacks, known as DDoS attacks) and to ensure server load and stability.

Types of Processed Data:

• Content data (e.g., entries in online forms)
• Usage data (e.g., visited web pages, interest in content, access times)
• Meta/communication data (e.g., device information, IP addresses)

Affected Persons: Users (e.g., website visitors, users of online services).

Purposes of Processing:

• Provision of our online offer and user-friendliness.

Legal Bases:

• Legitimate interests (Art. 6(1)(f) GDPR).

Used Services and Service Providers:

• STRATO: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacities); Service provider: STRATO AG, Pascalstraße 10, 10587 Berlin, Germany; Website: https://www.strato.de; Privacy Policy: https://www.strato.de/datenschutz; Data Processing Agreement: concluded with the provider.
• Contabo: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacities); Service provider: Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany; Website: https://contabo.com; Privacy Policy: https://contabo.com/de/legal/privacy; Data Processing Agreement: concluded with the provider.

Special Notes on Applications (Apps)

We process the data of our application users as necessary to provide them with the application and its functionalities, monitor its security, and further develop it. We may also contact users in compliance with legal regulations if communication is required for the administration or use of the application. Additionally, we refer to the data processing information provided in this privacy policy regarding the processing of users’ data.

Legal Bases: The processing of data required to provide the application’s functionalities serves to fulfill contractual obligations. This applies also when providing the functions requires user permissions (e.g., enabling device functions). If the data processing is not necessary for providing the application’s functionalities but serves the security of the application or our business interests (e.g., collecting data for optimization or security purposes), it is based on our legitimate interests. If users are expressly asked for their consent to process their data, the processing of the data covered by the consent is based on that consent.

Types of Processed Data:

• Inventory data (e.g., names, addresses)
• Meta/communication data (e.g., device information, IP addresses)
• Payment data (e.g., bank details, invoices, payment history)
• Contract data (e.g., contract subject, duration, customer category)

Affected Persons: Users (e.g., website visitors, users of online services).

Purposes of Processing:

• Provision of contractual services and customer service.

Legal Bases:

• Consent (Art. 6(1)(a) GDPR)
• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)

Additional Notes on Processing Procedures, Methods, and Services:

• Commercial Use: We process the data of our application users, including registered and potential test users (collectively referred to as “users”), to provide our contractual services and based on legitimate interests to ensure the application’s security and further development. The required information is identified as such within the context of usage, order, purchase, or comparable contract conclusion and may include the information needed for service provision and billing, as well as contact information for any necessary consultations.
• Storage of a Universal and Unique Identifier (UUID): The application stores a so-called universally unique identifier (UUID) for analyzing usage and functionality and storing user settings. This identifier is generated upon installation (it is not linked to the device, thus not a device identifier in this sense), remains stored between application launches and updates, and is deleted when users remove the application from their device.
• Device Permissions for Access to Functions and Data: Using our application or its functionalities may require user permissions to access specific device functions or data stored on or accessible via the device. By default, these permissions must be granted by users and can be revoked at any time in the respective device settings. The exact procedure for controlling app permissions may depend on the device and the user’s software. Users can contact us for clarification if needed. Please note that denial or revocation of permissions may affect the application’s functionality.
• No Location Tracking or Movement Profiles: Location data is used only occasionally and not to create a location history or movement profile of the devices or their users.

Acquisition of Applications through App Stores

The acquisition of our application is carried out via specific online platforms operated by other service providers (so-called “App Stores”). In this context, in addition to our privacy notices, the privacy notices of the respective App Stores also apply. This is particularly relevant regarding the procedures used on these platforms for reach measurement and interest-based marketing, as well as any potential costs.

Types of Processed Data:

• Inventory data (e.g., names, addresses)
• Payment data (e.g., bank details, invoices, payment history)
• Contact data (e.g., email, phone numbers)
• Contract data (e.g., contract subject, duration, customer category)
• Usage data (e.g., visited websites, interest in content, access times)
• Meta/communication data (e.g., device information, IP addresses)

Affected Persons: Customers

Purposes of Processing:

• Provision of contractual services and customer service

Legal Bases:

• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)

Additional Notes on Processing Procedures, Methods, and Services:

• Apple App Store: App and software sales platform; Service provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Website: https://www.apple.com/de/ios/app-store/; Privacy Policy: https://www.apple.com/legal/privacy/de-ww/.

Registration, Login, and User Account

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account based on contractual obligations. The data processed includes login information (username, password, and an email address).

In the course of using our registration and login functions, as well as using the user account, we store the IP address and the time of each user action. This storage is based on our legitimate interests as well as those of the users in protecting against misuse and other unauthorized use. These data are generally not disclosed to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about operations relevant to their user account, such as technical changes.

Types of Processed Data:

• Inventory data (e.g., names, addresses)
• Contact data (e.g., email, phone numbers)
• Content data (e.g., entries in online forms)
• Meta/communication data (e.g., device information, IP addresses)

Affected Persons: Users (e.g., website visitors, users of online services)

Purposes of Processing:

• Provision of contractual services and customer service
• Security measures
• Management and response to inquiries

Legal Bases:

• Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)

Additional Notes on Processing Procedures, Methods, and Services:

• Registration with Real Names: Due to the nature of our community, we ask users to use our service only with their real names. The use of pseudonyms is not allowed.
• Deletion of Data after Termination: If users have terminated their user account, their data related to the user account will be deleted unless there is a legal permission, obligation, or consent from the users to retain it.
• No Obligation to Retain Data: It is the responsibility of the users to secure their data before the end of the contract upon termination. We are entitled to irretrievably delete all user data stored during the contract period.