Privacy Policy of the SPINNAX App

This application collects personal data from its users.

This document includes a section on privacy rights specifically for consumers from California.

This document can be printed for record-keeping purposes using the “Print” command in your browser.

Provider and Data Controller:

Spinnax GmbH
Haldenhofstraße 12
78351 Bodman-Ludwigshafen
Germany

Provider’s Email Address: info@spinnax.com

Types of Data Collected:

The personal data that this application processes, either independently or through third parties, includes: email; usage data; first name; last name; weight; stance; age; height; cookie; geographic location; Contact permissions; camera permissions; permissions to access precise location (continuous); permissions to access approximate location (continuous); phone permissions; sensor permissions; motion sensor permissions; phone number.

Full details for each type of personal data processed are provided in the designated sections of this privacy policy or, where applicable, through explanatory texts displayed before the data is collected.

Personal data may be voluntarily provided by the user or, in the case of usage data, automatically collected when this application is used.

Unless otherwise stated, the provision of all data requested by this application is mandatory. If the user refuses to provide the data, this may result in the application being unable to provide its services to the user. In cases where this application explicitly states that the provision of personal data is voluntary, users may choose not to provide such data without any impact on the availability or functionality of the service.

Users who are unsure which personal data is mandatory can contact the provider.

Any use of cookies—or other tracking tools—by this application or third-party providers employed through this app is intended to deliver the service requested by the user and for any other purposes described in this document and, if applicable, in the cookie policy

Users are responsible for any personal data of third parties collected, published, or shared through this application and confirm that they have obtained consent to transmit any third party’s personal data to this application.

Type and Location of Data Processing:

Processing Methods

The provider processes user data properly and takes appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of data.
Data processing is carried out using computers or IT-based systems according to organizational procedures and methods specifically designed for the stated purposes. In addition to the data controller, other internal personnel (human resources, sales, marketing, legal department, system administrators) or external parties—if necessary, appointed by the controller as data processors (such as technical service providers, delivery companies, hosting providers, IT companies, or communications agencies)—may operate this application and have access to the data. An up-to-date list of these parties can be requested from the provider at any time.

Legal Basis for Processing

The provider may process users’ personal data only if one of the following conditions applies:

Users have given their consent for one or more specific purposes. Note: In some jurisdictions, the provider may be allowed to process personal data until the user objects to such processing (“opt-out”), without relying on consent or any other legal basis listed below. However, this does not apply if the processing of personal data is subject to European data protection law.
The data collection is necessary for the performance of a contract with the user and/or for pre-contractual measures related to it.
The processing is necessary for compliance with a legal obligation to which the provider is subject.
The processing is related to a task carried out in the public interest or in the exercise of official authority vested in the provider.
The processing is necessary to protect the legitimate interests of the provider or a third party.

In any case, the provider is happy to provide information about the specific legal basis on which the processing is based, in particular whether the provision of personal data is a legal or contractual obligation or a requirement for concluding a contract.

Location

The data is processed at the provider’s premises and at any other locations where the parties involved in data processing are situated.

Depending on the user’s location, data transfers may involve transferring the user’s data to a country other than their own. To learn more about the location where the transmitted data is processed, users can consult the section with detailed information on the processing of personal data.

When more comprehensive standards apply, the following also applies:

Users also have the right to be informed about the legal basis for transferring data to a country outside the European Union or to an international organization governed by public international law or established by two or more countries, such as the UN, as well as about the safeguards adopted by the provider to protect their data.

If such a transfer takes place, users can find out more by reviewing the relevant sections of this document or by contacting the provider using the information provided in the contact section.

Data Retention Period

Personal data is processed and stored for as long as required for the purpose for which it was collected.

Therefore, the following applies:

Personal data collected for the purpose of fulfilling a contract between the provider and the user will be stored until the contract has been fully performed.
Personal data collected to protect the legitimate interests of the provider will be retained for as long as necessary to fulfill these purposes. Users can obtain more information about the provider’s legitimate interests in the relevant sections of this document or by contacting the provider directly.

Furthermore, the provider may retain personal data for a longer period if the user has consented to such processing, as long as the consent is not withdrawn. Additionally, the provider may be required to retain personal data for a longer period if necessary to comply with a legal obligation or by order of an authority.

After the retention period expires, personal data will be deleted. Therefore, the right to access, the right to erasure, the right to rectification, and the right to data portability cannot be exercised once the retention period has ended.

Purposes of Processing:

Personal data about the user is collected so that the provider can deliver the service and, in addition, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of the user or third parties), and detect malicious or fraudulent activities. Furthermore, data is collected for the following purposes: managing contacts and sending messages, monitoring infrastructure, analytics, location-based interactions, device permissions for accessing personal data and contacting the user, optimizing and distributing data traffic, tag management, and displaying content from external platforms.

Users can find more detailed information about these processing purposes and the personal data used for each purpose in the section “Detailed Information on the Processing of Personal Data” of this document.

Device Permissions for Accessing Personal Data

Depending on the device used by the user, this application may request certain permissions that allow access to the user’s device data as described below.

By default, these access permissions must be granted by the user before the corresponding information can be accessed. Consent once given can be withdrawn by the user at any time. To revoke these consents, users can check their device settings or contact the owner’s support using the contact information provided in this document.

The exact procedure for reviewing app permissions may depend on the user’s device and software.

Please note that revoking such permissions may affect the proper functioning of this application.

If the user grants any of the permissions listed below, the corresponding personal data may be processed by this application (i.e., accessed, modified, or deleted).

Permission to Access Precise Location (Continuous)

This is required to access the user’s precise device location. This application may collect, use, and share the user’s location data to provide location-based services.

Permission to Access Approximate Location (Continuous)

This is required to access the user’s approximate device location. This application may collect, use, and share the user’s location data to provide location-based services.

Motion Sensor Permission

Used to access the device’s motion sensors to track user activities such as step counting, flights of stairs climbed, and type of movement (walking, cycling, etc.).

Camera Permission

Required to access the camera or to capture images and videos using the device.

Contacts Permission

Required to access contacts and profiles on the user’s device, including the ability to modify entries.

Health Data Read Permission

Allows reading the user’s health data.

Sensor Permission

Used to access data from sensors that users employ to track body metrics, such as heart rate.

Phone Permission

Used to access a variety of typical phone functions. For example, it allows read access to the “phone status,” meaning it can access the device’s phone number, current mobile network information, or the status of ongoing calls.

Detailed Information on the Processing of Personal Data

Personal data is collected for the following purposes through the use of the following services:

Analytics

The services listed in this section allow the provider to monitor and analyze traffic as well as track user behavior.

MixPanel (MixPanel)

MixPanel is an analytics service provided by Mixpanel Inc.

Personal data processed: Cookie; usage data.

Processing location: United States

Category of personal information collected under CCPA: Internet data.

Under the CCPA, the processing constitutes a “sale.” In addition to the information provided in this clause, users can find details about how to opt out of the sale in the section on California consumer rights.

Device Permissions for Accessing Personal Data

This application requests certain consents from users that allow access to the user’s device data as described below.

Device Permissions for Accessing Personal Data (This Application)

This application requests certain consents from users that allow access to the user’s device data as described in this document.

Personal data processed: Permission to access precise location (continuous); permission to access approximate location (continuous); motion sensor permission; camera permission; contacts permission; health data read permission; sensor permission; phone permission.

Category of personal information collected under CCPA: biometric data; internet data; geolocation data.

Under the CCPA, the processing constitutes a “sale.” In addition to the information provided in this clause, users can find details on how to opt out of the sale in the section on California consumer rights.

Contacting the User

Phone Contact (This Application)

Users who have provided their phone number may be contacted for commercial or promotional purposes related to this application, as well as to handle support requests.

Personal data processed:

Phone number.

Category of personal information collected under CCPA: Identifiers.

Mailing List or Newsletter (This Application)

By signing up for the mailing list or newsletter, the user’s email address is added to the contact list of individuals who may receive emails with commercial or promotional information related to this application. Additionally, your email address may be added to this list if you registered for this application or after making a purchase.

Personal data processed:
Email; last name; phone number; first name.

Category of personal information collected under CCPA: Identifiers.

Location-Based Interactions

Geolocation (This Application)

This application may collect, use, and share the user’s location data to provide location-based services.

Most browsers and devices are set by default to have this feature disabled.

This application may access the user’s location data if explicit permission has been granted.

Personal data processed: Geographic location.

Category of personal information collected under CCPA: Geolocation data.

Managing Contacts and Sending Messages

These types of services allow managing a database of email contacts, phone numbers, or any other contact information to communicate with the user.

The services may also collect data on the date and time a message was read by the user, as well as when the user interacts with incoming messages, for example by clicking on links contained within them.

Mailchimp (The Rocket Science GroupLLC)

Mailchimp is a service provided by The Rocket Science Group LLC for managing email addresses and sending messages.

Personal data processed: Email; last name; usage data; first name.

Processing location: United States

Category of personal information collected under CCPA: Identifiers; internet data.

Infrastructure Monitoring

With this type of service, this application can monitor the usage and behavior of its individual components to improve performance, operation, maintenance, and troubleshooting.

The personal data processed depends on the features and type of implementation of the services, whose function is to filter the activities taking place through this application.

Sentry (Functional Software, Inc.)

Sentry is a service provided by Functional Software, Inc. for application monitoring.

Personal data processed: Various types of data as described in the service’s privacy policy.

Processing location: United States

Category of personal information collected under CCPA: Internet data.

Additional Information on Personal Data

Push Notifications

This application may send push notifications to the user to achieve the purposes described in this privacy policy.

In most cases, users can refuse to receive push notifications by accessing their device settings, such as notification settings on mobile phones, and then adjusting these settings for this application, for some, or for all applications on the device.

Users should be aware that disabling push notifications may negatively affect this application and its functionality.

User Rights

Users can exercise certain rights regarding the data processed by the provider.

Users entitled to more comprehensive standards can exercise all the rights described below. In all other cases, users may contact the provider to determine which rights apply to them.

In particular, users have the right to:

Withdraw consent at any time. If the user has previously consented to the processing of personal data, they may withdraw their consent at any time.
Object to the processing of their data. The user has the right to object to the processing of their data if the processing is based on a legal ground other than consent. More information on this is provided below.
Access their data. The user has the right to know whether their data is being processed by the provider, to obtain information about specific aspects of the processing, and to receive a copy of the data.
Review and correct data. The user has the right to verify the accuracy of their data and to request its update or correction.
Request restriction of data processing. Users have the right, under certain circumstances, to request the restriction of their data processing. In this case, the provider will process the data for no purpose other than storage.
Request deletion or removal of personal data. Under certain circumstances, users have the right to request the deletion of their data by the provider.
Receive and transfer their data to another controller. The user has the right to receive their data in a structured, commonly used, and machine-readable format and, where technically feasible, to have it transmitted directly to another controller without hindrance. This provision applies if the data is processed automatically and the processing is based on the user’s consent, a contract to which the user is a party, or pre-contractual obligations.
Lodge a complaint. Users have the right to lodge a complaint with the competent supervisory authority.

Details on the Right to Object to Processing

If personal data is processed in the public interest, in the exercise of official authority vested in the provider, or to protect the legitimate interests of the provider, the user may object to this processing by providing a justification based on their particular situation.

Users are informed that they may object to the processing of their personal data for direct marketing at any time without providing any reason. Whether the provider processes personal data for direct marketing purposes can be found in the relevant sections of this document.

How Rights Can Be Exercised

All requests to exercise user rights can be directed to the provider using the contact information provided in this document. Requests can be made free of charge and will be processed by the provider as soon as possible, and at the latest within one month.

Applicability of More Comprehensive Standards

While most provisions of this document apply to all users, some provisions explicitly apply only when the processing of personal data is subject to more comprehensive protection standards.

Such more comprehensive standards apply if the processing:

is carried out by a provider established in the EU;
relates to the personal data of users located in the EU and involves offering paid or unpaid goods or services to these users;
concerns the personal data of users located in the EU and allows the provider to monitor the behavior of these users in the EU.

Additional Information on Data Collection and Processing

Legal Measures

The user’s personal data may be processed by the provider for law enforcement purposes, either during or in preparation for legal proceedings arising from improper use of this website or its associated services.
The user acknowledges that the provider may be required by authorities to disclose personal data.

Additional Information About the User’s Personal Data

In addition to the information provided in this privacy policy, this website may provide the user, upon request, with additional contextual information related to specific services or the collection and processing of personal data.

System Logs and Maintenance

This application and third-party services may collect files for operational and maintenance purposes that record interactions taking place through this application (system logs), or use other personal data (e.g., IP address) for this purpose.

Information Not Covered by This Privacy Policy

Additional information about the collection or processing of personal data can be requested from the provider at any time using the contact information provided.

How “Do Not Track” Requests Are Handled

This application does not support “Do Not Track” requests from web browsers.
Users can find information on whether integrated third-party services support the Do Not Track protocol in the privacy policy of the respective service.

Changes to This Privacy Policy

The provider reserves the right to make changes to this privacy policy at any time. Users will be informed of such changes on this page and, where applicable, through this website and/or—where technically and legally feasible—by sending a notice to the contact information the provider has on file for the users. Users are therefore encouraged to visit this page regularly and, in particular, to check the date of the last update at the bottom of the page.

If changes affect data usage based on the user’s consent, the provider will obtain a new consent where required.

Information for California Consumers

This section supplements and completes the other information contained in the privacy policy and is provided by the company operating this website—or, where applicable, by its parent, subsidiary, or affiliated company (collectively referred to in this section as “we,” “us,” or “our”).

The provisions in this section apply to all users who act as consumers under the California Consumer Privacy Act 2018 and who are residents of the State of California (hereinafter referred to as “you,” “your”), and supersede any conflicting or inconsistent provisions in the privacy policy for such users.

Within this section, the term “personal information” is used according to the definition provided in the California Consumer Privacy Act.

Categories of Personal Information Collected, Disclosed, or Sold

In this section, we summarize the categories of personal information that have been collected, disclosed, or sold, as well as the purposes for which they were used. Detailed information about these activities can be found under “Detailed Information on the Processing of Personal Data” within this document.

Collected Information: The Categories of Personal Information We Collect

We have collected the following categories of personal information about you: identifiers, biometric data, internet data, and geolocation data.

We will not collect any additional categories of personal information about you without notifying you.

How We Collect Information: From Which Sources Do We Collect Personal Information?

We collect the above-mentioned categories of personal information directly or indirectly from you when you use this application.

For example, you provide personal information when you submit a request through this application. Additionally, when you use this application, you indirectly share personal information that is automatically observed and collected. Finally, we may collect personal information from third parties who work with us to provide the service or to operate this application or its individual features.

How We Use the Collected Information: Sharing and Disclosure of Your Personal Information to Third Parties for Commercial Purposes

We may disclose personal information collected about you to third parties for commercial purposes. In such cases, these third parties are obligated, under a written agreement with us, to treat personal information confidentially and use it solely for the purpose of fulfilling the agreement.

We may also disclose your personal information to third parties if you have explicitly requested or authorized it, in order to provide the service to you.

For more information on the purposes of processing, please refer to the relevant section of this document.

Sale of Your Personal Information

In this context, “sale” means the “selling, renting, releasing, disclosing, disseminating, making available, transferring, or any form of oral, written, or electronic communication of consumers’ personal information by a business to another business or a third party for money or other valuable consideration.”

For example, a sale may occur if an application displays advertising, performs statistical analyses of traffic or views, or uses social media plugins or similar features.

Your Right to Opt Out of the Sale of Personal Information

You have the right to opt out of the sale of your personal information. This means we will comply with your request if you ask that your data no longer be sold.The opt-out can be made voluntarily, at any time, without a verifiable request, in accordance with the instructions below.

Instructions for Exercising the Right to Opt Out of the Sale of Personal Information

If you want to learn more or opt out of all types of data sales occurring on and offline through this website, you can contact us using the contact information provided in this document to obtain further information.

For What Purposes Do We Process Your Personal Information?

We may use your personal information to operate this application or its individual features and keep them functional (“business purposes”). In such cases, we will process your personal information only to the extent necessary and proportionate for the operational purposes for which it was collected and solely within the scope of those operational purposes.

We may also use your personal information for other purposes, such as commercial purposes (as described in the section “Detailed Information on the Processing of Personal Data” of this document), as required by law, or to enforce our rights before the relevant authorities if our rights or interests are threatened or violated.

We will not use your personal information for any other unrelated or incompatible purpose without notifying you in advance.

Your Privacy Rights Under California Law and How to Exercise Them

Right to Access and Data Portability

You have the right to request from us information about:

the categories and sources of the personal information we collect about you, the purposes for which we use your information, and the parties to whom we disclose such information;
in the case of the sale or disclosure of personal information for business purposes – provided in the form of two separate lists:
- Sale: the categories of personal information that each category of recipient has acquired; and
- Disclosure for business purposes: the categories of personal information that have been disclosed to each category of recipient.

The access described above relates to personal information that we have collected or processed within the past 12 months.

If we provide the information electronically, it is “portable,” meaning it will be delivered in an easily readable format so that you can, to the extent technically feasible, transmit the information to other parties without hindrance.

Right to Delete Your Personal Information

You have the right to request that we delete your personal information, except where a legal exception applies (for example, if the information is needed for troubleshooting and error resolution for this website, detecting security incidents, preventing fraudulent or illegal activities, enforcing certain rights, etc.).

If no legal exception applies, we will delete your personal information upon your request and instruct our service providers—if any—to do the same.

How You Can Exercise Your Rights

To exercise the rights described above, you must submit a verifiable request to us using the contact information provided in this document.

To process your request, we need to know who you are. Therefore, you can only exercise the rights described if your request is verifiable, meaning:

It contains information that reasonably allows us to determine whether you are the person about whom we have collected personal information, or an authorized representative of that person;
It is sufficiently detailed so that we can reliably understand, evaluate, and respond to it.

We will not respond to a request if we cannot verify your identity and therefore cannot determine whether the personal information we hold actually relates to you.

If you are unable to submit a verifiable request yourself, you may authorize a representative recognized by the California Secretary of State to act on your behalf.

If you are an adult, you may submit a verifiable request on behalf of a minor for whom you have parental or legal responsibility.

You may submit a maximum of two requests within a 12-month period.

How and When We Respond to Your Request

We will acknowledge receipt of your verifiable request within 10 days and inform you how we will process it.

We will respond to your request within 45 days of receipt. If we need more time, we will explain the reasons and the additional time required. Please note that processing your request may take up to 90 days.

Our response will pertain to the preceding 12 months.

If we deny your request, we will provide the reasons for the denial.

We do not charge a fee for processing and responding to your verifiable request unless it is clearly unfounded or excessive. In such cases, we may charge a reasonable fee or refuse to process your request. In either case, we will inform you of our decision and the reasons behind it.

Definitions and Legal Notices

Personal Data (or Data)

All information that directly or in combination with other information can be used to identify a natural person.

Usage Data

Information that this application (or third-party services used by this application) automatically collects, such as: IP addresses or domain names of users’ computers using this application, URI addresses (Uniform Resource Identifier), the time of the request, the method used to send the request to the server, the size of the received response file, the status code indicating the server’s response (successful result, error, etc.), the country of origin, the features of the browser and operating system used by the user, various timestamps per visit (e.g., time spent on each page of the application), the navigation path within the application, particularly the sequence of pages visited, and other information about the user’s device operating system and/or IT environment.

User

The person using this application, who, unless otherwise specified, corresponds to the data subject.

Data Subject

The natural person to whom the personal data relates.

Processor (or Data Processor)

A natural or legal person, authority, agency, or other body that processes personal data on behalf of the controller, as described in this privacy policy.

Controller (or Provider, sometimes also Owner)

The natural or legal person, authority, agency, or other entity that alone or jointly with others determines the purposes and means of processing personal data, including the security measures related to the operation and use of this application. Unless otherwise specified, the controller is the natural or legal person through whom this application is offered.

This Application

The hardware or software tool through which the user’s personal data is collected and processed.

Service

The service offered through this application, as described in the applicable terms and conditions (if any) and on this website/application.

European Union (or EU)

Unless otherwise stated, all references to the European Union in this document refer to all current member states of the European Union and the European Economic Area (EEA).

Cookie

Cookies are trackers consisting of a small dataset stored in the user’s browser.

Tracker

The term tracker refers to any technology—e.g., cookies, unique identifiers, web beacons, embedded scripts, E-tags, or fingerprinting—that can be used to track users, for example, by enabling access to or storage of information on the user’s device.

Legal Notice

This privacy policy has been drafted based on provisions of various legislations, including Articles 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation).

This privacy policy applies exclusively to this application, unless otherwise specified in this document.

Last Updated: 25.07.2022