Lucid Shopping List
Privacy Policy
Preamble
With the following privacy policy we would like to inform you which types of your personal data (hereinafter also
abbreviated as "data") we process for which purposes and in which scope. The privacy statement applies to all
processing of personal data carried out by us, both in the context of providing our services and in particular
on our websites, in mobile applications and within external online presences, such as our social media profiles
(hereinafter collectively referred to as "online services").
The terms used are not gender-specific.
Last Update: 8. May 2025
Table of contents
Controller
Ulrich Schumacher
Schlesierstr. 2
46244 Bottrop
Germany
E-mail address: info@lucidshoppinglist.com
Overview of processing operations
The following table summarises the types of data processed, the purposes for which they are processed and the
concerned data subjects.
Categories of Processed Data
- Inventory data.
- Payment Data.
- Contact data.
- Content data.
- Contract data.
- Usage data.
- Meta, communication and process data.
- Log data.
Categories of Data Subjects
- Service recipients and clients.
- Users.
- Business and contractual partners.
Purposes of Processing
- Provision of contractual services and fulfillment of contractual obligations.
- Security measures.
- Marketing.
- Provision of our online services and usability.
- Information technology infrastructure.
- Business processes and management procedures.
Relevant legal bases
Relevant legal bases according to the GDPR: In the following, you will find an overview of the
legal basis of the GDPR on which we base the processing of personal data. Please note that in addition to the
provisions of the GDPR, national data protection provisions of your or our country of residence or domicile may
apply. If, in addition, more specific legal bases are applicable in individual cases, we will inform you of
these in the data protection declaration.
- Consent (Article 6 (1) (a) GDPR) - The data subject has given consent to the processing of
his or her personal data for one or more specific purposes.
- Performance of a contract and prior requests (Article 6 (1) (b) GDPR) - Performance of a
contract to which the data subject is party or in order to take steps at the request of the data subject
prior to entering into a contract.
- Legitimate Interests (Article 6 (1) (f) GDPR) - the processing is necessary for the
protection of the legitimate interests of the controller or a third party, provided that the interests,
fundamental rights, and freedoms of the data subject, which require the protection of personal data, do not
prevail.
National data protection regulations in Germany: In addition to the data protection regulations
of the GDPR, national regulations apply to data protection in Germany. This includes in particular the Law on
Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In
particular, the BDSG contains special provisions on the right to access, the right to erase, the right to
object, the processing of special categories of personal data, processing for other purposes and transmission as
well as automated individual decision-making, including profiling. Furthermore, data protection laws of the
individual federal states may apply.
Relevant legal basis according to the Swiss Data Protection Act: If you are located in
Switzerland, we process your data based on the Federal Act on Data Protection (referred to as "Swiss DPA").
Unlike the GDPR, for instance, the Swiss DPA does not generally require that a legal basis for processing
personal data be stated and that the processing of personal data is conducted in good faith, lawfully and
proportionately (Art. 6 para. 1 and 2 of the Swiss DPA). Furthermore, we only collect personal data for a
specific purpose recognizable to the data subject and process it only in a manner compatible with this purpose
(Art. 6 para. 3 of the Swiss DPA).
Reference to the applicability of the GDPR and the Swiss DPA: These privacy policy serves both
to provide information pursuant to the Swiss Federal Act on Data Protection (FADP) and the General Data
Protection Regulation (GDPR). For this reason, we ask you to note that due to the broader spatial application
and comprehensibility, the terms used in the GDPR are applied. In particular, instead of the terms used in the
Swiss FADP such as "processing" of "personal data", "predominant interest", and "particularly sensitive personal
data", the terms used in the GDPR, namely "processing" of "personal data", as well as "legitimate interest" and
"special categories of data" are used. However, the legal meaning of these terms will continue to be determined
according to the Swiss FADP within its scope of application.
Security Precautions
We take appropriate technical and organisational measures in accordance with the legal requirements, taking into
account the state of the art, the costs of implementation and the nature, scope, context and purposes of
processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural
persons, in order to ensure a level of security appropriate to the risk.
The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by
controlling physical and electronic access to the data as well as access to, input, transmission, securing and
separation of the data. In addition, we have established procedures to ensure that data subjects' rights are
respected, that data is erased, and that we are prepared to respond to data threats rapidly. Furthermore, we
take the protection of personal data into account as early as the development or selection of hardware, software
and service providers, in accordance with the principle of privacy by design and privacy by default.
Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data of users
transmitted via our online services from unauthorized access, we employ TLS/SSL encryption technology. Secure
Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the
internet. These technologies encrypt the information that is transferred between the website or app and the
user's browser (or between two servers), thereby safeguarding the data from unauthorized access. TLS, as the
more advanced and secure version of SSL, ensures that all data transmissions conform to the highest security
standards. When a website is secured with an SSL/TLS certificate, this is indicated by the display of HTTPS in
the URL. This serves as an indicator to users that their data is being securely and encryptedly transmitted.
Transmission of Personal Data
In the course of processing personal data, it may happen that this data is transmitted to or disclosed to other
entities, companies, legally independent organizational units, or individuals. Recipients of this data may
include service providers tasked with IT duties or providers of services and content that are integrated into a
website. In such cases, we observe the legal requirements and particularly conclude relevant contracts or
agreements that serve to protect your data with the recipients of your data.
Data Transfer within the Organization: We may transfer personal data to other departments or units within our
organisation or grant them access to it. If the data is shared for administrative purposes, it is based on our
legitimate business and economic interests or occurs if it is necessary to fulfil our contractual obligations or
if the data subjects have given their consent or a legal permission exists.
International data transfers
Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union (EU)
or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or the
disclosure or transfer of data to other individuals, entities, or companies (which becomes apparent either from
the postal address of the respective provider or when explicitly mentioned in the privacy policy regarding data
transfer to third countries), this is always done in accordance with legal requirements.
For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has been recognized
as a secure legal framework by the EU Commission's adequacy decision of July 10, 2023. Additionally, we have
concluded Standard Contractual Clauses with the respective providers, which comply with the EU Commission's
requirements and establish contractual obligations to protect your data.
This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary level of
protection, while the Standard Contractual Clauses act as an additional security measure. Should any changes
occur within the DPF framework, the Standard Contractual Clauses will serve as a reliable fallback option. This
ensures that your data remains adequately protected even in the event of political or legal changes.
For individual service providers, we will inform you whether they are certified under the DPF and if Standard
Contractual Clauses are in place. The list of certified companies and further information about the DPF can be
found on the U.S. Department of Commerce's website at https://www.dataprivacyframework.gov/.
For data transfers to other third countries, appropriate safeguards apply, particularly Standard Contractual
Clauses, explicit consent, or legally required transfers. Information on third-country transfers and applicable
adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.
We will inform you which of our service providers are certified under the Data Privacy Framework as part of our
data protection notices.
Disclosure of Personal Data Abroad: In accordance with the Swiss Data Protection Act (Swiss DPA), we only
disclose personal data abroad when an appropriate level of protection for the affected persons is ensured (Art.
16 Swiss DPA). If the Federal Council has not determined an adequate level of protection (list of states: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html),
we implement alternative security measures.
For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has been recognized
as a secure legal framework by Switzerland's adequacy decision of June 7, 2024. Additionally, we have concluded
Standard Data Protection Clauses with the respective providers, which have been approved by the Federal Data
Protection and Information Commissioner (FDPIC) and establish contractual obligations to protect your data.
This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary level of
protection, while the Standard Data Protection Clauses act as an additional security measure. Should any changes
occur within the DPF framework, the Standard Data Protection Clauses will serve as a reliable fallback option.
This ensures that your data remains adequately protected even in the event of political or legal changes.
For individual service providers, we will inform you whether they are certified under the DPF and if Standard
Data Protection Clauses are in place. The list of certified companies and further information about the DPF can
be found on the U.S. Department of Commerce's website at https://www.dataprivacyframework.gov/.
For data transfers to other third countries, appropriate safeguards apply, including international agreements,
specific guarantees, FDPIC-approved Standard Data Protection Clauses, or internal company data protection
regulations previously recognized by the FDPIC or a competent data protection authority of another country.
Under Art. 16 of the Swiss DPA, exceptions can be made for the disclosure of data abroad if certain conditions
are met, including the consent of the affected person, contract execution, public interest, protection of life
or physical integrity, publicly made data, or data from a legally provided register. Such disclosures always
comply with the legal requirements.
We will inform you which of our service providers are certified under the Data Privacy Framework as part of our
privacy notices.
General Information on Data Retention and Deletion
We delete personal data that we process in accordance with legal regulations as soon as the underlying consents
are revoked or no further legal bases for processing exist. This applies to cases where the original purpose of
processing is no longer applicable or the data is no longer needed. Exceptions to this rule exist if statutory
obligations or special interests require a longer retention or archiving of the data.
In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for
legal prosecution or protection of the rights of other natural or legal persons, must be archived accordingly.
Our privacy notices contain additional information on the retention and deletion of data specifically applicable
to certain processing processes.
In cases where multiple retention periods or deletion deadlines for a date are specified, the longest period
always prevails.
If a period does not expressly start on a specific date and lasts at least one year, it automatically begins at
the end of the calendar year in which the event triggering the period occurred. In the case of ongoing
contractual relationships in the context of which data is stored, the event triggering the deadline is the time
at which the termination or other termination of the legal relationship takes effect.
Data that is no longer stored for its originally intended purpose but due to legal requirements or other reasons
are processed exclusively for the reasons justifying their retention.
Further information on processing methods, procedures and services used:
- Data Retention and Deletion: The following general deadlines apply for the retention and
archiving according to German law:
- 10 Years - Fiscal Code/Commercial Code - Retention period for books and records, annual financial
statements, inventories, management reports, opening balance sheet as well as the necessary work
instructions and other organisational documents (Section 147 Paragraph 1 No. 1 in conjunction with
Paragraph 3 of the German General Tax Code (AO), Section 14b Paragraph 1 of the German VAT Act
(UStG), Section 257 Paragraph 1 No. 1 in conjunction with Paragraph 4 of the German Commercial Code
(HGB)).
- 8 years - Accounting documents, such as invoices, booking and expense receipts (Section 147
Paragraph 1 No. 4 and 4a in conjunction with Paragraph 3 of the German General Tax Code (AO),
Section 257 Paragraph 1 No. 4 in conjunction with Paragraph 4 of the German Commercial Code (HGB))
- 6 Years - Other business documents: received commercial or business letters, copies of dispatched
commercial or business letters, and other documents to the extent that they are significant for
taxation purposes, for example, hourly wage slips, operating accounting sheets, calculation
documents, price tags, as well as payroll accounting documents, provided they are not already
accounting vouchers and cash register tapes Section (Section 147 Paragraph 1 No. 2, 3, 5 in
conjunction with Paragraph 3 of the German General Tax Code (AO), Section 257 Paragraph 1 No. 2 and
3 in conjunction with Paragraph 4 of the German Commercial Code (HGB)).
- 3 Years - Data required to consider potential warranty and compensation claims or similar
contractual claims and rights, as well as to process related inquiries, based on previous business
experiences and common industry practices, will be stored for the duration of the regular statutory
limitation period of three years. This period begins at the end of the year in which the relevant
contractual transaction took place or the contractual relationship ended in the case of ongoing
contracts (Sections 195, 199 of the German Civil Code).
- Data Retention and Deletion: The following general retention and archiving periods apply
under Swiss law:
- 10 years - Retention period for books and records, annual financial statements, inventories,
management reports, opening balances, accounting vouchers and invoices, as well as all necessary
working instructions and other organizational documents (Article 958f of the Swiss Code of
Obligations (OR)).
- 10 years - Data necessary to consider potential claims for damages or similar contractual claims and
rights, as well as for the processing of related inquiries based on previous business experiences
and usual industry practices, will be stored for the statutory limitation period of ten years,
unless a shorter period of five years is applicable, which is relevant in certain cases (Articles
127, 130 OR). Claims for rent, lease, and interest on capital, as well as other periodic services,
for the delivery of food, for board and lodging, for innkeeper debts, as well as for craftsmanship,
small-scale sales of goods, medical care, professional services by lawyers, legal agents,
procurators, and notaries, and from the employment relationship of employees, expire after five
years (Article 128 OR).
Rights of Data Subjects
Rights of the Data Subjects under the GDPR: As data subject, you are entitled to various rights under the GDPR,
which arise in particular from Articles 15 to 21 of the GDPR:
- Right to Object: You have the right, on grounds arising from your particular situation, to object at
any time to the processing of your personal data which is based on letter (e) or (f) of Article 6(1)
GDPR, including profiling based on those provisions. Where personal data are processed for direct
marketing purposes, you have the right to object at any time to the processing of the personal data
concerning you for the purpose of such marketing, which includes profiling to the extent that it is
related to such direct marketing.
- Right of withdrawal for consents: You have the right to revoke consents at any time.
- Right of access: You have the right to request confirmation as to whether the data in
question will be processed and to be informed of this data and to receive further information and a copy of
the data in accordance with the provisions of the law.
- Right to rectification: You have the right, in accordance with the law, to request the
completion of the data concerning you or the rectification of the incorrect data concerning you.
- Right to Erasure and Right to Restriction of Processing: In accordance with the statutory
provisions, you have the right to demand that the relevant data be erased immediately or, alternatively, to
demand that the processing of the data be restricted in accordance with the statutory provisions.
- Right to data portability: You have the right to receive data concerning you which you have
provided to us in a structured, common and machine-readable format in accordance with the legal
requirements, or to request its transmission to another controller.
- Complaint to the supervisory authority: In accordance with the law and without prejudice to
any other administrative or judicial remedy, you also have the right to lodge a complaint with a data
protection supervisory authority, in particular a supervisory authority in the Member State where you
habitually reside, the supervisory authority of your place of work or the place of the alleged infringement,
if you consider that the processing of personal data concerning you infringes the GDPR.
Rights of the data subjects under the Swiss DPA:
As the data subject, you have the following rights in accordance with the provisions of the Swiss DPA:
- Right to information: You have the right to request confirmation as to whether personal
data concerning you are being processed, and to receive the information necessary for you to assert your
rights under the Swiss DPA and to ensure transparent data processing.
- Right to data release or transfer: You have the right to request the release of your
personal data, which you have provided to us, in a common electronic format, as well as its transfer to
another data controller, provided this does not require disproportionate effort.
- Right to rectification: You have the right to request the rectification of inaccurate
personal data concerning you.
- Right to object, deletion, and destruction: You have the right to object to the processing
of your data, as well as to request that personal data concerning you be deleted or destroyed.
Use of online platforms for listing and sales purposes
We offer our services on online platforms operated by other service providers. In addition to our privacy policy,
the privacy policies of the respective platforms apply. This is particularly true with regard to the payment
process and the methods used on the platforms for performance measuring and behaviour-related marketing.
- Processed data types: Inventory data (For example, the full name, residential address,
contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history);
Contact data (e.g. postal and email addresses or phone numbers); Contract data (e.g. contract object,
duration, customer category); Usage data (e.g. page views and duration of visit, click paths, intensity and
frequency of use, types of devices and operating systems used, interactions with content and features).
Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved
parties).
- Data subjects: Service recipients and clients. Business and contractual partners.
- Purposes of processing: Provision of contractual services and fulfillment of contractual
obligations; Marketing. Business processes and management procedures.
- Retention and deletion: Deletion in accordance with the information provided in the section
"General Information on Data Retention and Deletion".
- Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b)
GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Provision of online services and web hosting
We process user data in order to be able to provide them with our online services. For this purpose, we process
the IP address of the user, which is necessary to transmit the content and functions of our online services to
the user's browser or terminal device.
- Processed data types: Usage data (e.g. page views and duration of visit, click paths,
intensity and frequency of use, types of devices and operating systems used, interactions with content and
features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers,
involved parties); Log data (e.g. log files concerning logins or data retrieval or access times.). Content
data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such
as details of authorship or the time of creation.).
- Data subjects: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of our online services and usability; Information
technology infrastructure (Operation and provision of information systems and technical devices, such as
computers, servers, etc.)). Security measures.
- Retention and deletion: Deletion in accordance with the information provided in the section
"General Information on Data Retention and Deletion".
- Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
- Hosting.com: Web hosting and e-mail services; Service provider: A2
Hosting, LLC
PO Box 2998
Ann Arbor, MI 48106; Website: https://hosting.com/. Privacy Policy: https://hosting.com/about/policies/.
- Provision of online offer on rented hosting space: For the provision of our online
services, we use storage space, computing capacity and software that we rent or otherwise obtain from a
corresponding server provider (also referred to as a "web hoster"); Legal
Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
- Collection of Access Data and Log Files: Access to our online service is logged in the form
of so-called "server log files". Server log files may include the address and name of the accessed web pages
and files, date and time of access, transferred data volumes, notification of successful retrieval, browser
type along with version, the user's operating system, referrer URL (the previously visited page), and
typically IP addresses and the requesting provider. The server log files can be used for security purposes,
e.g., to prevent server overload (especially in the case of abusive attacks, known as DDoS attacks), and to
ensure server load management and stability; Legal Basis: Legitimate
Interests (Article 6 (1) (f) GDPR). Retention period: Log file information is
stored for a maximum period of 30 days and then deleted or anonymized. Data, the further storage of which is
necessary for evidence purposes, are excluded from deletion until the respective incident has been finally
clarified.
- E-mail Sending and Hosting: The web hosting services we use also include sending, receiving
and storing e-mails. For these purposes, the addresses of the recipients and senders, as well as other
information relating to the sending of e-mails (e.g. the providers involved) and the contents of the
respective e-mails are processed. The above data may also be processed for SPAM detection purposes. Please
note that e-mails on the Internet are generally not sent in encrypted form. As a rule, e-mails are encrypted
during transport, but not on the servers from which they are sent and received (unless a so-called
end-to-end encryption method is used). We can therefore accept no responsibility for the transmission path
of e-mails between the sender and reception on our server; Legal Basis:
Legitimate Interests (Article 6 (1) (f) GDPR).
Special Notes on Applications (Apps)
We process the data of the users of our application to the extent necessary to provide the users with the
application and its functionalities, to monitor its security and to develop it further. Furthermore, we may
contact users in compliance with the statutory provisions if communication is necessary for the purposes of
administration or use of the application. In addition, we refer to the data protection information in this
privacy policy with regard to the processing of user data.
Legal basis: The processing of data necessary for the provision of the functionalities of the
application serves to fulfil contractual obligations. This also applies if the provision of the functions
requires user authorisation (e.g. release of device functions). If the processing of data is not necessary for
the provision of the functionalities of the application, but serves the security of the application or our
business interests (e.g. collection of data for the purpose of optimising the application or security purposes),
it is carried out on the basis of our legitimate interests. If users are expressly requested to give their
consent to the processing of their data, the data covered by the consent is processed on the basis of the
consent.
- Processed data types: Inventory data (For example, the full name, residential address,
contact information, customer number, etc.); Usage data (e.g. page views and duration of visit, click paths,
intensity and frequency of use, types of devices and operating systems used, interactions with content and
features). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers,
involved parties).
- Data subjects: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of contractual services and fulfillment of contractual
obligations; Security measures. Provision of our online services and usability.
- Retention and deletion: Deletion in accordance with the information provided in the section
"General Information on Data Retention and Deletion".
- Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b)
GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
- Device authorizations for access to functions and data: The use of certain functions of our
application may require access to the camera and the stored recordings of the users. By default, these
authorizations must be granted by the user and can be revoked at any time in the settings of the respective
devices. The exact procedure for controlling app permissions may depend on the user's device and software.
Users can contact us if they require further explanation. We would like to point out that the refusal or
revocation of the respective authorizations can affect the functionality of our application.
Purchase of applications via Appstores
The purchase of our apps is done via special online platforms operated by other service providers (so-called
"appstores"). In this context, the data protection notices of the respective appstores apply in addition to our
data protection notices. This applies in particular with regard to the methods used on the platforms for
webanalytics and for interest-related marketing as well as possible costs.
- Processed data types: Inventory data (For example, the full name, residential address,
contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history);
Contact data (e.g. postal and email addresses or phone numbers); Contract data (e.g. contract object,
duration, customer category); Usage data (e.g. page views and duration of visit, click paths, intensity and
frequency of use, types of devices and operating systems used, interactions with content and features).
Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved
parties).
- Data subjects: Service recipients and clients. Users (e.g. website visitors, users of
online services).
- Purposes of processing: Provision of contractual services and fulfillment of contractual
obligations; Marketing. Provision of our online services and usability.
- Retention and deletion: Deletion in accordance with the information provided in the section
"General Information on Data Retention and Deletion".
- Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Plugins and embedded functions and content
Within our online services, we integrate functional and content elements that are obtained from the servers of
their respective providers (hereinafter referred to as "third-party providers"). These may, for example, be
graphics, videos or city maps (hereinafter uniformly referred to as "Content").
The integration always presupposes that the third-party providers of this content process the IP address of the
user, since they could not send the content to their browser without the IP address. The IP address is therefore
required for the presentation of these contents or functions. We strive to use only those contents, whose
respective offerers use the IP address only for the distribution of the contents. Third parties may also use
so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes.
The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The
pseudonymous information may also be stored in cookies on the user's device and may include technical
information about the browser and operating system, referring websites, visit times and other information about
the use of our website, as well as may be linked to such information from other sources.
- Processed data types: Usage data (e.g. page views and duration of visit, click paths,
intensity and frequency of use, types of devices and operating systems used, interactions with content and
features). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers,
involved parties).
- Data subjects: Users (e.g. website visitors, users of online services).
- Purposes of processing: Provision of our online services and usability.
- Retention and deletion: Deletion in accordance with the information provided in the section
"General Information on Data Retention and Deletion". Storage of cookies for up to 2 years (Unless otherwise
stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
- Legal Basis: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1)
(f) GDPR).
Further information on processing methods, procedures and services used:
- Google Fonts (Provision on own server): Provision of font files for the purpose of a
user-friendly presentation of our online services; Service provider: The Google Fonts are
hosted on our server, no data is transmitted to Google; Legal Basis:
Legitimate Interests (Article 6 (1) (f) GDPR).
Changes and Updates
We kindly ask you to inform yourself regularly about the contents of our data protection declaration. We will
adjust the privacy policy as changes in our data processing practices make this necessary. We will inform you as
soon as the changes require your cooperation (e.g. consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, we ask you
to note that addresses may change over time and to verify the information before contacting us.
Terminology and Definitions
In this section, you will find an overview of the terminology used in this privacy policy. Where the terminology
is legally defined, their legal definitions apply. The following explanations, however, are primarily intended
to aid understanding.
- Contact data: Contact details are essential information that enables communication with
individuals or organizations. They include, among others, phone numbers, postal addresses, and email
addresses, as well as means of communication like social media handles and instant messaging identifiers.
- Content data: Content data comprise information generated in the process of creating,
editing, and publishing content of all types. This category of data may include texts, images, videos, audio
files, and other multimedia content published across various platforms and media. Content data are not
limited to the content itself but also include metadata providing information about the content, such as
tags, descriptions, authorship details, and publication dates.
- Contract data: Contract data are specific details pertaining to the formalisation of an
agreement between two or more parties. They document the terms under which services or products are
provided, exchanged, or sold. This category of data is essential for managing and fulfilling contractual
obligations and includes both the identification of the contracting parties and the specific terms and
conditions of the agreement. Contract data may encompass the start and end dates of the contract, the nature
of the agreed-upon services or products, pricing arrangements, payment terms, termination rights, extension
options, and special conditions or clauses. They serve as the legal foundation for the relationship between
the parties and are crucial for clarifying rights and duties, enforcing claims, and resolving disputes.
- Controller: "Controller" means the natural or legal person, public authority, agency or
other body which, alone or jointly with others, determines the purposes and means of the processing of
personal data.
- Inventory data: Inventory data encompass essential information required for the
identification and management of contractual partners, user accounts, profiles, and similar assignments.
These data may include, among others, personal and demographic details such as names, contact information
(addresses, phone numbers, email addresses), birth dates, and specific identifiers (user IDs). Inventory
data form the foundation for any formal interaction between individuals and services, facilities, or
systems, by enabling unique assignment and communication.
- Log data: Protocol data, or log data, refer to information regarding events or activities
that have been logged within a system or network. These data typically include details such as timestamps,
IP addresses, user actions, error messages, and other specifics about the usage or operation of a system.
Protocol data is often used for analyzing system issues, monitoring security, or generating performance
reports.
- Meta, communication and process data: Meta-, communication, and procedural data are
categories that contain information about how data is processed, transmitted, and managed. Meta-data, also
known as data about data, include information that describes the context, origin, and structure of other
data. They can include details about file size, creation date, the author of a document, and modification
histories. Communication data capture the exchange of information between users across various channels,
such as email traffic, call logs, messages in social networks, and chat histories, including the involved
parties, timestamps, and transmission paths. Procedural data describe the processes and operations within
systems or organisations, including workflow documentations, logs of transactions and activities, and audit
logs used for tracking and verifying procedures.
- Payment Data: Payment data comprise all information necessary for processing payment
transactions between buyers and sellers. This data is crucial for e-commerce, online banking, and any other
form of financial transaction. It includes details such as credit card numbers, bank account information,
payment amounts, transaction dates, verification numbers, and billing information. Payment data may also
contain information on payment status, chargebacks, authorizations, and fees.
- Personal Data: "personal data" means any information relating to an identified or
identifiable natural person ("data subject"); an identifiable natural person is one who can be identified,
directly or indirectly, in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural person.
- Processing: The term "processing" covers a wide range and practically every handling of
data, be it collection, evaluation, storage, transmission or erasure.
- Usage data: Usage data refer to information that captures how users interact with digital
products, services, or platforms. These data encompass a wide range of information that demonstrates how
users utilise applications, which features they prefer, how long they spend on specific pages, and through
what paths they navigate an application. Usage data can also include the frequency of use, timestamps of
activities, IP addresses, device information, and location data. They are particularly valuable for
analysing user behaviour, optimising user experiences, personalising content, and improving products or
services. Furthermore, usage data play a crucial role in identifying trends, preferences, and potential
problem areas within digital offerings