Data protection information pursuant to Article 13 of the EU General Data Protection Regulation for the use of the Ambidexter App ("YUNAR App")

Status: June 2020


 

Ambidexter GmbH, Theodor-Heuss-Allee 72, 60486 Frankfurt am Main, Germany, (hereinafter referred to as "Ambidexter GmbH") as the data controller within the framework of the EU General Data Protection Regulation (hereinafter referred to as "GDPR") collects and processes your personal data as well as other information about you, provided that you register for the Ambidexter platform (hereinafter referred to as "platform") via YUNAR App or, without being a registered user, use the service offer in accordance with the terms of use. With the following information we give you an overview of the processing of your personal data by us and your rights from the data protection law.

 

1. Who is responsible for data processing and whom can I contact

 

The controller of data processing is:

 

Ambidexter GmbH

Theodor-Heuss-Allee 72

DE-60486 Frankfurt am Main

e-mail adress: info@yunar.de

 

You can reach our company data protection officer at:

 

Ambidexter GmbH

Data protection officer

Theodor-Heuss-Allee 72

DE-60486 Frankfurt am Main

e-mail adress: datenschutz@yunar.de

 

2. Which sources and data we use

 

We process personal data within the scope of your use of our services which we make available on the platform and such data which we receive directly from you.

 

In order to install the YUNAR App, you may first need to enter into a user agreement with a third party (Google Inc., iTunes SARL, hereinafter referred to as "Third Party Provider") for access to a portal or online shop of the respective Third Party Provider (Android Marketplace, iTunes App Store, hereinafter referred to as "Third Party Portal"). Ambidexter GmbH is not a party to any such agreement and has no control over the data processing by the Third Party Provider. You may review the privacy policy of the third party to determine what information is processed and how the third party processes it in the course of registering for the third party portal.

 

For activated push messages within the scope of the information service offered here, the terms of use of the operating system provider you use apply.

 

·If you use the platform without registering, the following personal data will be collected:

(i)Nickname, device and usage related data ("Internet Data") amongst others,

(ii)specific information about the device on which the Platform is installed via YUNAR App (including Unique App Installation ID, Device ID, manufacturer, model and operating system details, time of installation, language of the terminal device),

(iii)information on the use of certain features and functions on the device; and

(iv)session-related information (including automatically generated identifiers).

·If you register for the platform, the following personal data will also be processed according to the services used on the platform:

(v)e-mail address,

(vi)Access data such as user name, password,

(vii)Contact information such as name, address, telephone number.

 

In addition, the following personal data in particular are collected, processed and stored when using the individual services made available via the YUNAR App:

 

a.) Analysis Information Service

After you have given your revocable consent to the play of personalised advertising (for more details, see section 3. d.)) you will receive recommendations, tips and advice tailored to your needs via push message. For this purpose, in addition to your "login data" as a registered user or guest user, we analyse your location data for location-dependent push messages ("push event"), ad message and time as well as the number and type of cards you have deposited in the YUNAR App. Finally, we will assign you to a certain user group (e.g. intensive or occasional use) based on your user habits when using the YUNAR App. We use device-specific identifiers to display general advertising.

 

b.) Loyalty program - Service ("Wallet")

Information on loyalty programmes (name of the loyalty programme, loyalty card incl. customer number, card number, points balance, name of the loyalty card issuer, name of the loyalty card), deployment behaviour within the loyalty programme (deployment locations and times of the loyalty cards), access data of the loyalty programme (e.g. user name and password).

 

c.) Customer card closure - service ("Wallet")

For the application of a new customer card via the "Wallet" function provided in the YUNAR App, we only process those personal data that the customer card provider also collects for the purpose of applying for a new customer card. These are usually so-called master data (surname, first name, e-mail, etc.) and, if applicable, further optional data (e.g. about your interests and preferences). The collection of this personal data is necessary so that we can forward your declaration of intent to the corresponding customer card provider and thus register customer cards with this provider for you.

In the relationship between the loyalty card provider and you as a user, only the data protection notices of the loyalty card provider, to which we have expressly referred and linked, apply.

If you give us your consent in each case, we will store this data in your YUNAR profile in order to simplify the registration process for you in the event of further applications for customer cards and to be able to display even more individual tips, information or advice within the framework of the analysis information service mentioned under 2.2. a.).

 

d.) Further development of our offered services

For the further development of our offers, the data types mentioned under a.), b.) and c.) are used.

 

3. What do we process your data for (purpose of the processing) and on which legal basis do we

 

We, as the data controller, will use your personal data only for the explicit and legitimate purposes of the respective data processing ("purpose limitation") as stated below.

 

We process the aforementioned personal data in accordance with the provisions of the General Data Protection Regulation ("GDPR") and the Federal Data Protection Act ("BDSG"):

 

a.) For the performance of contractual obligations (cf. Article 6 paragraph 1 sentence 1, letter b) GDPR)

The legal basis for the processing of your personal data is the contract concluded with you for the use of YUNAR App.

The purposes of the data processing are primarily based on the specific application.

The main purpose of the YUNAR App is the continuous analysis of your purchasing, consumption and/or saving behaviour on the basis of the data provided by you to the YUNAR App with the aim of optimising your spending. Ambidexter GmbH continuously evaluates this data in order to provide you with suggestions for savings based on the analyses, recommendations, tips, hints or advice regarding the use of loyalty cards or the redemption or acquisition of loyalty points, the use of eCoupons, the acquisition of eCoupons, advantage offers in connection with the use of loyalty cards, suggestions for saving possibilities in relation to your purchasing, spending and financial behaviour. Furthermore, we use your contact data to answer questions about the provision of the YUNAR App.

Further details about the purpose of data processing can be found in the YUNAR APP terms of use.

 

b.) To fulfil a legal obligation (cf. Article 6 para. 1 sentence 1, letter c) GDPR)

Due to legal and supervisory regulations, internal or external audits can be carried out in our business operations (e.g. internal audit, audits, audits, annual financial statement audits, supervisory special audits). In doing so, your personal data may be transferred either to the respective supervisory authority or to an external service provider, e.g. an auditing company.

 

c.) As part of the legitimate interests (cf. Article 6 paragraph 1 sentence 1, letter f) GDPR)

 

As far as necessary, we process your data beyond the actual fulfilment of the contract to protect legitimate interests of us or third parties.

 

Examples:

·       Testing and optimization of procedures for demand analysis and direct customer approach; including customer segmentation and calculation of closing probabilities, including range analysis;

·       assertion of legal claims and defence in legal disputes;

·       Ensuring IT security and IT operation of the application;

·       Notification of users by e-mail or in-app notification, e.g. in case of malfunctions of the YUNAR App or events of information security or data protection as well as updates of the YUNAR App ;

·       Measures for business management and further development of services and products;

·       Measures for the purpose of direct advertising, e.g. advertising messages, information about competitions, special offers or new functionalities in the App.

 

We use third party analysis tools to constantly improve the YUNAR App. We base the legality of this processing on our overriding legitimate interest.

We use the service Google Firebase Analytics to analyze user behavior in the YUNAR App (e.g. click behavior) and for user categorization. You can find the privacy policy of Firebase underhttps://firebase.google.com/support/privacy(last access: June 2020). In the settings ("Legal" under "Profile") you can deactivate the use of Firebase Analytics at any time.

We use the analysis technology Adjust e.g. for the analysis of IP addresses of users, advertising ID and IDFA / ADID to measure the effectiveness of campaigns. The privacy policy of Adjust can be found atwww.adjust.com/terms/privacy-policy(last access: June 2020). In the settings ("Legal" under "Profile") you can deactivate the use of Adjust at any time.

Within the YUNAR App the tool Crashlytics is used. After an app crash, data about the crash with exact information about code locations and device information is created and sent, which should simplify maintenance and improve the resulting stability of the app. The Crashlytics privacy policy can be found athttps://fabric.io/terms(last accessed: June 2020).

 

d.) On the basis of your consent (see Article 6 para. 1 sentence 1, letter a) GDPR)

If you have given us permission to process personal data for specific purposes (e.g. to receive a newsletter by e-mail, to pass on data to third parties or to process location data for the purpose of providing location-based services), the legality of this processing is based on your consent. A given consent can be revoked at any time. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. You can request a status overview of the consents you have given at any time.

 

Within the framework of Location Based Services, we offer you special services that are tailored to your particular location (Analysis Information Service). You can only use these functions after you have agreed in the YUNAR App that we can collect your location data for the purpose of providing services. You can allow or revoke this function at any time in the settings of the YUNAR App or the operating system of your mobile device.

 

4. Who gets my data

 

Within Ambidexter GmbH, those departments that require your data to fulfil our contractual and legal Pichten will be given access to your data. Also service providers and vicarious agents employed by us may receive data for these purposes, provided they comply with our written data protection instructions and confidentiality obligations. These are mainly companies from the categories listed below.

Contractors commissioned by us are obliged to comply with the provisions of the GDPR and the BDSG.

 

Under these conditions, recipients of personal data may be, for example

·       processors to whom we may transfer personal data in order to carry out the business relationship with you. In detail: Cloud-based IT operations, support/maintenance of IT/IT applications, performance of analyses, storage of data, archiving, compliance services, controlling, data destruction, customer administration, marketing, telephony.

·       The company Braze Inc., 330 West 34 th Street, New York, NY 10001, USA, supports us as a contract processor in playing out push notifications to you.

 

Other data recipients may be those entities for which you have given your consent to the transfer of data.

 

5. Is data transferred to a third country or to an international organisation

 

A data transfer to countries outside of the European Union ("EU") or the European Economic Area ("EEA") as so-called third countries,ndet only instead of, if this is necessary for the execution of the services used or required by law (e.g. Meldepichten), you have given us your consent or in the context of an order processing. If service providers are used in the third country, we ensure that the data is transferred in accordance with the level of protection guaranteed by the GDPR; see Artt. 44 to 49 GDPR. In order to comply with the European level of data protection, we therefore conclude EU standard contractual clauses with service providers in the case of data transfer to third countries or rely on the EU-US Privacy Shield or the transfer on the basis of an adequacy decision.

 

6. How long will my data be stored (storage period)

 

All of your personal data, which are stored at Ambidexter GmbH in connection with the platform and the purpose of the fulfillment of the services of YUNAR App., will be deleted - as far as no legal retention periods exist (cf. German Commercial Code, Fiscal Code) - if you initiate the deletion of the user profile independently or after one year of your inactivity in dealing with YUNAR App.

 

Furthermore, we instruct our service providers involved in the processing of your personal data accordingly to delete them.

 

7. What data protection rights do I have

 

Every data subject has the right of access under Article 15 GDPR, the right of rectification under Article 16 GDPR, the right of deletion under Article 17 GDPR, the right to restrict processing under Article 18 GDPR, the right of objection under Article 21 GDPR and the right of data transferability under Article 20 GDPR. With regard to the right of information and the right of deletion, the restrictions under Sections 34 and 35 of the BDSG shall apply. In addition, there is a right of appeal to a data protection supervisory authority (Article 77 GDPR in conjunction with Article 19 BDSG).

You can revoke your consent to the processing of personal data at any time. Please note that the revocation is only effective for the future.

Processing that took place before the revocation is not affected.

 

8. Is there an obilgations for me to provide data

 

The use of the YUNAR App and the associated services are completely voluntary and can be discontinued at any time by the user.

 

In the context of the wish to use the services of Ambidexter GmbH, which are offered through YUNAR App, the provision of named personal data is necessary to provide you with the analysis results as well as tips, hints and advice for a positive change in your purchasing, consumption and saving behaviour (data required by Ambidexter GmbH to fulfil the obligations from the terms of use).

 

Data of your (mobile) end devices are partly necessary to provide the service or services or to display the pages correctly or to guarantee the security of your entries.

 

9. Does "Proling" take place

 

We process your data partly automatically with the aim of evaluating certain personal aspects ( Proling ). We use Proling in the following cases:

 

In order to provide you with targeted information, tips, advice on your spending or financial behaviour, to inform you about the optimised use of loyalty programmes and to inform you about products, we collect and store user-related information from various sources within the framework of the existing legal basis in accordance with section 3. This information enables communication and advertising to be tailored to your needs, including market and opinion research.

 

Information about your right of objection according to Article 21 General Data Protection Regulation (GDPR)

 

1. Right of objection on a case-by-case basis

 

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data relating to you, which is carried out on the basis of Article 6 paragraph 1, sentence 1 letter e) GDPR (data processing in the public interest) and Article 6 paragraph 1, sentence 1 letter f) GDPR (data processing based on a balancing of interests); this also applies to an Proling based on this provision within the meaning of Article 4 No. 4 GDPR.

If you lodge an objection, we will no longer process your personal data unless we can prove compelling reasons for processing that are worthy of protection and outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

 

2. Right to object to the processing of data for advertising purposes

 

In individual cases, we process your personal data in order to carry out direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purpose of such direct marketing, including at Proling, insofar as it is connected with such direct marketing.

If you object to the processing for the purposes of direct marketing, we will no longer process your personal data for those purposes.

The objection can be made without formality and should be sent by e-mail to: :kontakt@ambidexter.gmbh

 

Please note that the sole purpose and main service of the YUNAR App is to analyse your financial behaviour and to give you tips, advice and hints on how to save money, make the best use of your loyalty cards and eCoupons. If you object to the data processing for the fulfilment of these main services, this will be tantamount to a cessation of the use of the services of YUNAR App, which you are of course entitled to do at any time without observing any notice periods.