Legal

With the following data protection information we would liketo inform you which types of your personal data (hereinafter "data")we process for which purposes and to what extent. The data protectioninformation applies to the processing of personal data carried out by us, inparticular on our product website "instavalo" , in mobileapplications and within external online presences, such as our social mediaprofiles (hereinafter collectively referred to as "online offer"), onwhich we present our product "instavalo".

​

‍

Responsible​

Instavalo GmbH

Gießerallee 23

47877 Willich

Germany

​

​Relevant legal bases

In the following we inform you about the legal basis of theGeneral Data Protection Regulation (GDPR), on the basis of which we process thepersonal data. In addition to the regulations of the GDPR, the national dataprotection regulations apply in your or our country of residence andheadquarters. If, in individual cases, more specific legal bases may berelevant, we will inform you of them below.

​

Safety measures​

In accordance with the legal requirements, appropriatetechnical and organizational measures are taken, taking into account the stateof the art, the implementation costs and the type, scope, circumstances andpurposes of the processing as well as the different probabilities of occurrenceand the extent of the threat to the rights and freedoms of natural persons toensure a level of protection appropriate to the risk.

The measures include, in particular, securing the confidentiality, integrityand availability of data by controlling physical and electronic access to thedata as well as access, input, disclosure, securing availability and theirseparation. In addition, procedures have been set up to ensure that the rightsof data subjects are exercised, data is deleted and reactions to data threatsare made. Furthermore, the protection of personal data is already taken intoaccount during the development or selection of hardware, software and processesin accordance with the principle of data protection, through technology designand through data protection-friendly default settings.

Shortening of the IP address: If IP addresses are processed by us or by theservice providers and technologies used and the processing of a complete IPaddress is not necessary, the IP address will be shortened (so-called "IPmasking"). The last two digits of the IP address are removed or replacedby placeholders. The purpose of shortening the IP address is to prevent or makeit much more difficult to identify a person based on their IP address.

SSL encryption (https): In order to protect your data transmitted via ouronline offer, we use SSL encryption. You can recognize such encryptedconnections by the prefix https:// in the address line of the browser.

​

Provision of the online offer and web hosting​

In order to be able to provide our online offer securely andefficiently, we use the services of one or more web hosting providers fromwhose servers (or servers managed by them) the online offer can be accessed.For these purposes, we may use infrastructure and platform services, computingcapacity, storage space and database services, as well as security services andtechnical maintenance services.

The data processed as part of the provision of the hosting offer may includeall information relating to the users of our online offer that arises in thecourse of use and communication. This regularly includes the IP address, whichis necessary in order to be able to deliver the content of online offers to thebrowser, and all entries made within our online offer or on websites.

E-mail dispatch and hosting: The web hosting services we use also include thedispatch, receipt and storage of e-mails. For these purposes, the addresses ofthe recipients and senders as well as other information regarding the e-maildispatch (e.g. the providers involved) and the content of the respectivee-mails are processed. The aforementioned data can also be processed for SPAMdetection purposes. We ask you to note that e-mails are generally not sent inencrypted form on the Internet. As a rule, e-mails are encrypted duringtransport, but (unless a so-called end-to-end encryption method is used) not onthe servers from which they are sent and received. Therefore, we cannot acceptany responsibility for the transmission path of the e-mails between the senderand receipt on our server.
Collection of access data and log files: We ourselves (or our web hostingprovider) collect data for each access to the server (so-called server logfiles). The address and name of the retrieved websites and files, date and timeof retrieval, amounts of data transferred, notification of successfulretrieval, browser type and version, the user's operating system, referrer URL(the previously visited page) and, as a rule, IP Addresses and the requestingprovider belong.

The server log files can be used on the one hand for security purposes, e.g. toavoid overloading the server (especially in the case of abusive attacks,so-called DDoS attacks) and on the other hand to ensure server utilization andstability.

​​

• Types     of data processed: content data, usage data (e.g. websites visited,     interest in content, access times), meta/communication data (e.g. device     information, IP addresses).
• Affected     persons: users (e.g. website visitors, users of online services).
• Legal     basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f GDPR).
• Services     and service providers used:
• Amazon     Web Services (AWS): services in the field of providing information     technology infrastructure and related services (e.g. storage space and/or     computing capacity);
• Service     Provider: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA     98109, USA; https://aws.amazon.com/de/Website:
• Privacy     Policy: https://aws.amazon.com/de/privacy/?nc1=f_pr.​

​​

​​

Web analysis, monitoring and optimization​

The web analysis (reach measurement) serves to evaluate theflow of visitors to our online offer and can include behavior, interests ordemographic information about the visitors, such as age or gender, aspseudonymous values. With the help of range measurement, we can, for example,recognize the time at which our online offer or its functions or content areused most frequently or invite users to reuse them. We can also understandwhich areas need optimization.
In addition to web analysis, we can also use test procedures, for example totest and optimize different versions of our online offering or its components.

For these purposes, so-called user profiles can be created and stored in a file(so-called "cookie") or similar processes can be used for the samepurpose. This information can include, for example, content viewed, websitesvisited and elements used there and technical information such as the browserused, the computer system used and information on usage times. If users haveconsented to the collection of their location data, this can also be processeddepending on the provider.
The IP addresses of the users are also saved. However, we use an IP maskingprocess (ie pseudonymization by shortening the IP address) to protect users. Ingeneral, no clear user data (e.g. e-mail addresses or names) are stored in thecontext of web analysis, A/B testing and optimization, but pseudonyms. Thismeans that we and the providers of the software used do not know the actualidentity of the users, but only the information stored in their profiles forthe purposes of the respective process.

Notes on legal bases: If we ask users for their consent to the use ofthird-party providers, the legal basis for processing data is consent.Otherwise, user data is processed on the basis of our legitimate interests (ieinterest in efficient, economical and recipient-friendly services). In thiscontext, we would also like to draw your attention to the information on theuse of cookies in this data protection declaration.

​​

• Types of data processed: usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: users (e.g. website visitors, users).
• Purposes of processing: range measurement (e.g. access statistics, recognition of eturning visitors), tracking (e.g. use of cookies), conversionmeasurement (measurement of the effectiveness of marketing measures), profiling (creating user profiles).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6 Para. 1 lit. a GDPR), legitimate interests (Art. 6 Para. 1 lit. f GDPR).

​​

Services and service providers used:

• Matomo: The information generated by the cookie about your use of this website is only stored on our server and is not passed on to third parties; Web analysis / range measurement in self-hosting;
      Service provider: MCON Germany GmbH
      Website: https://matomo.org/;
      Deletion of data: The cookies are stored for a maximum of 13 months.

​

​​

Presence in social networks (social media)​

We maintain online presences within social networks andprocess user data in this context in order to communicate with the users activethere or to offer information about us.

We would like to point out that user data can be processed outside the EU/EEAarea. This can result in risks for the user because, for example, theenforcement of user rights could be made more difficult.

Furthermore, user data is usually processed within social networks for marketresearch and advertising purposes. For example, usage profiles can be createdon the basis of usage behavior and the resulting interests of users. The usageprofiles can in turn be used, for example, to place advertisements inside andoutside the networks that presumably correspond to the interests of the user.For these purposes, cookies are usually stored on the users' computers, inwhich the usage behavior and the interests of the users are stored.Furthermore, data can also be stored in the usage profiles independently of thedevices used by the users (especially if the users are members of therespective platforms and are logged in to them).

For a detailed description of the respective forms of processing and thepossibility of objection (opt-out), we refer to the data protectiondeclarations and information provided by the operators of the respectivenetworks.

Also in the case of requests for information and the assertion of data subjectrights, we would like to point out that these must be asserted directly withthe providers. Only the providers have access to the data of the users and cantake appropriate measures and provide information directly.

• Types of data processed: Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: users (e.g. users of online services).
• Purposes of processing: contact requests and communication, tracking (e.g. interest/behavioral profiling, use of cookies), remarketing, range measurement (e.g. access statistics, recognition of returning visitors).
• Legal basis: Legitimate interests (Art. 6 Para. 1 lit. f GDPR).

Services and service providers used:

• LinkedIn: Social Network;
      Service Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland;
      Website: https://www.linkedin.com;
      Privacy Policy: https://www.linkedin.com/legal/privacy-policy;
      Possibility of objection (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• YouTube: Social network and video platform;
      Service provider: Google Ireland Limited, Gordon House, Barrow Street,Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway,Mountain View, CA 94043, USA;
      Privacy Policy: https://policies.google.com/privacy;
      Possibility of objection (opt-out): https://adssettings.google.com/authenticated.
• Xing: Social network; Service provider: XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany;
      Website: https://www.xing.de;
      Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

​​

​​

Newsletters and electronic notifications​

We send newsletters, e-mails and other electronicnotifications (hereinafter "newsletters") only with the consent ofthe recipient or legal permission. If the content of a newsletter isspecifically described, they are decisive for the consent of the user.Otherwise Our newsletters contain information about our services and us.
In order to register for our newsletter, it is generally sufficient if youenter your e-mail address. However, we may ask you to provide a name so that wecan address you personally in the newsletter, or other information if this isnecessary for the purposes of the newsletter.

​

Double opt-in procedure: Registration for our newslettertakes place in a so-called double opt-in procedure. This means that afterregistration you will receive an e-mail in which we ask you to confirm yourregistration. This confirmation is required so that nobody can register withsomeone else's email address. The registrations for the newsletter are loggedin order to be able to prove the registration process in accordance with thelegal requirements. This includes storing the time of registration andconfirmation as well as the IP address. Changes to your data stored by theshipping service provider are also logged.

Deletion and restriction of processing: We can store the unsubscribed e-mailaddresses for up to three years on the basis of our legitimate interests beforewe delete them in order to be able to prove a previously given consent. Theprocessing of this data is limited to the purpose of a possible defense againstclaims. An individual request for deletion is possible at any time, providedthat the previous existence of consent is confirmed at the same time. In thecase of obligations to permanently observe contradictions, we reserve the rightto store the e-mail address in a blacklist for this purpose alone.

The registration process is logged on the basis of our legitimate interests forthe purpose of proving that it was carried out properly. If we commission aservice provider to send emails, this is done on the basis of our legitimateinterests in an efficient and secure shipping system.

Notes on the legal basis: The newsletter is sent on the basis of the consent ofthe recipient or, if consent is not required, on the basis of our legitimateinterests in direct marketing, if and to the extent that this is permitted bylaw, e.g. in the case of advertising for existing customers. If we commission aservice provider to send emails, this is done on the basis of our legitimateinterests. Appropriate agreements for the protection of personal data andlawful processing have been concluded with the service provider (processingagreement). The registration process is recorded on the basis of our legitimateinterests to demonstrate that it has been carried out in accordance with thelaw.

Content: Information about us, our services, promotions and offers.

• Types     of data processed: Inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), meta/communication data (e.g. device information, IP addresses), usage data (e.g. websites visited, interest in content, access times).
• Affected persons: communication partners.
• Purposes of processing: direct marketing (e.g. by e-mail, SMS or post).
• Legal bases: Consent (Art. 6 Para. 1 lit. a GDPR), legitimate interests (Art. 6     Para. 1 lit. f GDPR).
• Possibility of objection (opt-out): You can stop receiving our newsletter at any time, ie revoke your consent or object to further receipt. You will find a link to unsubscribe from the newsletter at the end of each newsletter or you can use one of the contact options given above, preferably email.

​​

Services and service providers used:

• Twilio: Cloud communication platform as Platform as a Service (SMS sending). The electronic notifications can also be sent as SMS text messages (or are sent exclusively via SMS if the authorization to send, e.g. consent, only     includes sending via SMS).
      Service Provider: Sengrid, 1801 California Street Suite 500, Denver, CO 80202, USA.
      Website: https://www.twilio.com/legal/tos
• Sengrid: Email marketing platform; Sending newsletters and analysis.
      The data you enter for the purpose of receiving the newsletter will be     stored on the Sendgrid servers. For the purpose of analysis, the e-mails     sent with Sendgrid contain a so-called “tracking pixel” that connects to     the Sendgrid servers when the e-mail is opened. In this way it can be     determined whether a newsletter message has been opened. Furthermore, we     can use Sendgrid to determine whether and which links in the newsletter     are clicked on. All links in the message are so-called tracking links that     can be used to count your clicks. If you do not want an analysis by     Sendgrid, you must unsubscribe from the newsletter. For this purpose, we     provide a corresponding link at the end of each newsletter. Duration of     storage: The data you have stored with us for the purpose of receiving the     newsletter will be stored by us until you unsubscribe from the newsletter     distribution list and will be deleted both from our servers and from the     Sendgrid servers after you have unsubscribed from the newsletter. Data     stored by us for other purposes (e.g. e-mail addresses for the members'     area) remain unaffected.
      Service Provider: Sendgrid, 1801 California Street Suite 500, Denver, CO     80202, USA.
      Website: https://sendgrid.com/
      Privacy Policy: https://www.twilio.com/legal/privacy

​​

​

Transfer and Disclosure of Personal Data​

As part of our processing of personal data, it may happenthat the data is transmitted to other bodies, companies, legally independentorganizational units or persons or that it is disclosed to them. The recipientsof this data can include, for example, payment institutions in the context ofpayment transactions, service providers commissioned with IT tasks or providersof services and content that are integrated into a website. In this case, weobserve the legal requirements and, in particular, conclude appropriatecontracts or agreements with the recipients of your data that serve to protectyour data.
Data transfers within the organization: We may transfer personal data to otherentities within our organization or allow them access to this data. If thistransfer takes place for administrative purposes, the transfer of the data isbased on our legitimate entrepreneurial, association and business interests ortakes place if it is necessary to fulfill our contractual obligations or if theconsent of the person concerned or a legal permit is available.

​

​

Deletion of data​

The data processed by us will be deleted in accordance withthe legal requirements as soon as your consent to processing is revoked orother permissions are no longer applicable (e.g. if the purpose of processingthis data no longer applies or it is not required for the purpose).
If the data is not deleted because it is required for other, legallypermissible purposes, its processing will be restricted to these purposes(so-called blocking). This means that the data will be blocked and notprocessed for other purposes. This applies, for example, to data that must bestored for commercial or tax reasons or whose storage is necessary to assert,exercise or defend legal claims or to protect the rights of another natural orlegal person.
You will be informed about further storage periods as part of this dataprotection notice.

​

​

Commercial and Business Services​

We process the data of our contractual and businesspartners, e.g. customers and interested parties (contractual partners) in thecontext of contractual and comparable legal relationships and related measuresand in the context of communication with the contractual partners (orpre-contractual), e.g. to answer inquiries about our product.

We process this data to fulfill our contractual obligations, to safeguard ourrights and for the purposes of the administrative tasks associated with thisinformation and the corporate organization. We only pass on the data of thecontractual partners to third parties within the framework of the applicablelaw to the extent that this is necessary for the aforementioned purposes or tofulfill legal obligations (e.g. to telecommunications services involved andother auxiliary services as well as subcontractors, banks, tax and legaladvisors, payment service providers or tax authorities) or with the consent ofthe persons concerned. The contractual partners will be informed about otherforms of processing, e.g. for marketing purposes, within the framework of thisdata protection notice.
We inform the contracting parties which data is required for the aforementionedpurposes before or as part of the data collection, e.g. in online forms or inperson.

We delete the data after statutory warranty and comparable obligations haveexpired, i.e. generally after 4 years, unless the data is stored in a customeraccount, e.g. for as long as it has to be kept for legal archiving reasons(e.g. usually 10 years for tax purposes). We delete data disclosed to us by thecontractual partner as part of an order in accordance with the specificationsof the order, generally after the end of the order.
Insofar as we use third-party providers or platforms to provide our services,the terms and conditions and data protection notices of the respectivethird-party providers or platforms apply in the relationship between the usersand the providers.
Customer account: Contractual partners can create an account within this onlineoffer (customer account). If it is necessary to register a customer account,contractual partners will be informed of this as well as of the informationrequired for registration. Customer accounts are not public and cannot beindexed by search engines. As part of the registration and subsequentregistrations and uses of the customer account, we store the IP addresses ofthe customers together with the access times in order to be able to prove theregistration and to prevent any misuse of the customer account.
If the customer order is terminated, e.g. by termination, the data relating tothe customer account will be deleted, subject to their retention being requiredfor legal reasons. It is the customer's responsibility to back up their dataupon termination of the customer account.

Offer of software and platform services: We process the data of our users,registered users and any test users in order to be able to provide them withour contractual services and on the basis of legitimate interests to ensure thesecurity of our offer and to be able to develop it further. The informationrequired is marked as such within the framework of the conclusion of thecontract, order or comparable contract and includes the information requiredfor the provision of services and billing as well as contact information inorder to be able to hold any consultations.
Further information on commercial services: We process the data of ourcustomers and clients in order to enable them to select, purchase or commissionthe selected services or works and related activities as well as their paymentand delivery or execution or provision.
The information required is marked as such within the framework of theconclusion of the contract, order or comparable contract and includes theinformation required for the provision of services and billing as well ascontact information in order to be able to hold any consultations.

• Types     of data processed: Inventory data (e.g. names, addresses), payment data     (e.g. bank details, invoices, payment history), contact data (e.g. e-mail,     telephone numbers), contract data (e.g. subject matter of contract,     contract history), usage data (e.g. websites visited, interest in content,     access times ), meta/communication data (e.g. device information, IP     addresses).
• Affected     persons: Interested parties, business and contractual partners.
• Purposes     of processing: provision of contractual services and customer service,     contact requests and communication, office and organizational procedures,     management and response to requests, security measures.
• Legal     basis: Fulfillment of contract and pre-contractual inquiries (Art. 6 Para.     1 lit. b GDPR), legal obligation (Art. 6 Para. 1 lit. c GDPR), legitimate     interests (Art. 6 Para. 1 lit. f GDPR).

​​​

Linking of third-party offers and services​

We also refer to other websites on our website, eg to thoseof our partners. When calling up these third-party offers, we have no influenceon how the provider handles your data. Please find out more about this in theirdata protection declaration.
We also integrate useful services from other providers on our website that weconsider useful. If data collected about you is processed or used when you useit, this only happens if you enter data yourself. The contact person for this("responsible person") is the respective provider. The dataprotection declaration of the respective provider applies to the use andprocessing of your data.

​

​

Rights of the persons concerned​

As a data subject, you have various rights under the GDPR,which result in particular from Art. 15 to 21 GDPR:

• Right of objection: You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data, which is based on Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed in order to operate direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.
• Right of withdrawal for consent: You have the right to withdraw your consent at any time.
• Right to information: You have the right to request confirmation as to whether the data in question is being processed and to request information about this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: In accordance with legal requirements, you have the right to request the completion of the data concerning you or the correction of incorrect data concerning you.
• Right to deletion and restriction of processing: You have the right, in accordance with the legal requirements, to request that data concerning you be deleted immediately, or alternatively to request a restriction of the processing of the data in accordance with the legal requirements.
• Right to data portability: You have the right to receive the data that you have provided to us in accordance with the legal requirements in a structured, common and machine-readable format or to request that it be transmitted to another person responsible.
• Complaint to the supervisory authority: In accordance with the statutory provisions, you also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your usual place of residence, your place of work or the place of the alleged infringement, if you are convinced that the processing of personal data concerning you data violates the GDPR. The responsible supervisory authority for Instavalo GmbH: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.

​

​​

Change and update of the data protection information​

We ask you to inform yourself regularly about the content ofour data protection information. We adapt these if changes in the dataprocessing we carry out make this necessary. We will inform you as soon as thechanges require your cooperation (e.g. consent) or other individualnotification.

If we provide contact information of companies andorganizations, please note that the addresses can change over time and ask youto check the information before contacting us.

The above data protection notices refer to the product"instavalo" from Instavalo GmbH.

As of February 10, 2024

‍