Privacy Policy

Protecting your personal information is our top priority, which is why we only use your data in strict compliance with applicable data protection principles. The provisions of the EU General Data Protection Regulation (“GDPR”) become enforceable throughout Europe on 25 May 2018. We want to keep you fully informed now about how 8fit processes personal data in accordance with this new regulation (see Article 13 ff. GDPR). Please read our privacy policy carefully. If you have any questions or comments about our privacy policy, you can always contact us at the e-mail address below.

1. Overview

The following privacy policy informs you about the nature and extent of the processing of personal data by Urbanite Inc., 9450 SW GEMINI Dr., 20004 Beaverton, OR 97008, USA (hereinafter “8fit”, “we”, “us” or “our”). Personal data is any information that allows an individual to be identified directly or indirectly. The use of our app, products, services, technologies or features, and all related pages, applications and services (collectively referred to as the “Services”), is governed by this Privacy Policy.

When you register for the first time, or log on in the case of existing customers, you declare by means of a simple notification that you accept this privacy policy and expressly consent to the handling, use and disclosure of your personal data in the manner described herein.

The data gathered by 8fit can be divided primarily into two categories:

  • All data required for the processing, preparation and performance of an agreement with 8fit. If other service provides are involved in the performance of the agreement, e.g. payment services, optimization services or hosts, your data will be forwarded to them to the extent required
  • When you access our Services, some information is exchanged between your device and our server, or the server of the services we use. This may include personal information. One of the ways in which the information gathered in this way will used is to further improve our Service.  

Under the GDPR, you have various rights that you can assert with us. These include the right to selectively object to the use of data, particularly for advertising purposes. The option to object is highlighted in print. Further information on your rights can be found in the additional section below and in the individual descriptions of the respective data uses.

Our Services are only available to users who are 16 years of age or older. If you are not at least 16 years old, you may only use our Services if your parents have given their consent herein, and you have provided sufficient proof of this consent.

If you have any questions about our Privacy Policy, you may contact our data privacy officer by email at: datenschutz@8fit.com.

2. Name and Contact Information for the Person Responsible for Data Processing and of the Company’s Data Privacy Officer

This Privacy Policy applies to data processing by 8fit and to the following services: www.8fit.com and the 8fit-App. Our company data privacy officer may be reached at: 8fit GmbH, Stralauer Allee 10, Berlin, z. Hd. betrieblicher Datenschutzbeauftragter or at datenschutz@8fit.com.

3. Purposes of Data Collection, Legal Basis and Legitimate Interests Pursued by Us or a Third Party, and Categories of Recipients

3.1. Accessing our Service

If you access our Service, especially by visiting our website or app, the app or the browser used on your device automatically sends information to our server and temporarily stores it in a log file. The following information is collected without your intervention and stored until it is automatically or manually deleted in the log file:

  • Your device’s IP address
  • Date and time of access
  • The name and URL of the retrieved file, the website/app from which access was made (referrer URL)
  • Your browser’s unique identifier
  • The name of your Internet provider

The processing of the aforementioned data is based on Article 6 paragraph 1 lit. f) GDPR. Our legitimate interest arises from the uses listed below. At this point, we note that we are unable and do not attempt to draw any conclusions about your identity from the data collected. Your device’s IP address and the other information listed above are used by us for the following purposes:

  • To ensure that a trouble-free connection can be established
  • To ensure the convenient use of our Service
  • To evaluate system security and stability
  • Other administrative purposes

The data is stored in compliance with legally established data retention periods and then deleted automatically. We also use cookies, tracking tools, targeting methods and interfaces to other services such as social media platforms, payment processors or app store providers. The exact procedures, and how your data will be used for this purpose, are explained in more detail in section 4 below.

3.2. Concluding, Performing or Terminating an Agreement

Data Collected when concluding an agreement

We primarily define our Services as those of a personal fitness trainer: Based on your own self-defined training goals, we prepare your personal training and nutritional plan with workouts, suggested recipes and a broad variety of other information about health, fitness and nutrition. To do this, we collect the information required to conclude, perform or terminate an agreement.  This includes:

  • E-mail address
  • First and last name
  • Billing and payment information
  • Information you enter yourself and that is generated during the use of our Services, such as gender, age, height, weight, training goals, training history, sporting activities, mealtimes, etc.

The legal basis for this is Art. 6(1) a) and b) and Art. 9(2) a) of the GDPR. Unless we use your contact information for customer support or customer service (see details under 3.3), the information required to conclude the agreement is stored until it is no longer needed for this purpose and/or until the rights under any guarantee or warranty expire. Subsequently, we retain the required personal information for the periods established by law. During this retention period (usually six to 10 years after conclusion of the agreement), the information is used only in the case of an audit by the tax authority.

3.3. Data Processing for Customer Support or Customer Service

3.3.1. Informational purposes

If you have signed-up for our services, we keep you as an existing customer. In this case, we process your contact information in order to send you information about new, enhanced or improved features, products and services, etc.

3.3.2. Personalized ads

To ensure that you receive only information that corresponds to your interests, we classify and add information to your customer profile. For this purpose, both statistical information as well as information about you (such as basic or historical data from your customer profile) are used. The goal is to optimize our Services by adapting them to your actual or perceived interests and/or needs, and to send you the appropriate recommendations and not bother you with useless ads.

The legal basis for each of the aforementioned data uses is Art. 6(1) b) and f) of the GDPR and Art. 9(2) a) of the GDPR.  The use of existing customer data for the company’s own advertising purpose is recognized as a legitimate interest under Recital 47 of the GDPR.

3.3.3. Customer Support

Zendesk

On the basis of Art. 6(1) b) of the GDPR, we use the ticket system of Zendesk Inc., 1019 Market St, San Francisco, CA 94103, USA (“Zendesk”) for service, support and other user queries. If you send us a support request over one of our channels (e.g. our contact form, live chat, e-mail, etc.), the following data will be processed over Zendesk’s servers, depending on the content and the selected contact channel:

  • The information you enter
  • Name
  • Email address
  • Browser information
  • IP address

Zendesk is certified in compliance with the Privacy Shield Framework and therefore meets European standards for lawful data processing of orders. For more information on Zendesk data processing, see http://www.zendesk.com/company/privacy. You may also send questions directly to the Zendesk data privacy officer at: privacy@zendesk.com

3.3.4. Newsletters

One of our Services is to offer prospective customers the opportunity to sign-up for our newsletter. We use the double opt-in process to confirm that the email address entered actually corresponds to the prospective customer. After the email address is entered, we send you a confirmation link. Your email address will only be included on our mailing list after you click on this confirmation link. We store the information collected during this process only for purposes of documentation and proof. This includes:

  • The email address you provide
  • Your IP address
  • The date and time of registration
  • Form of address
  • The date, content and time of the confirmation email
  • The IP address of the device used for the confirmation
  • The date and time of your confirmation

The legal basis for this is Art. 6(1) a) GDPR. We store this information until the contract relationship ends as proof of the legality of sending the newsletter. After the contract relationship ends, we retain the required personal information for the period specified by law. During this period (usually 10 years from the conclusion of the agreement), the data will only be processed again in the event of a tax audit. You can revoke your consent at any time with effect for the future. Simply click on the unsubscribe button in the respective e-mail or send a short note by e-mail. Please use the options to contact the company’s data privacy officer for this purpose.

3.3.5. Right to Object

You may object to the use of your data for the aforementioned purposes at any time free of charge for each communication channel and with effect for the future. An email or a letter sent using the contact information shown under 1. is sufficient for this purpose.

Once you submit your objection, we will block the relevant contact address for future advertising data processing. We will process your objection as soon as possible and implement the appropriate blocking measures immediately after it is confirmed. Please note that in some exceptional cases the relevant information or product recommendations may still be received even after receipt of your objection. This is simply due to technical reasons and does not mean your objection has not been processed. Thank you very much for your understanding.

4. Data Processing for the Provision of our Services

In this section, we inform you about the data processing necessary for the provision of our Services:

4.1. Online Presence and Website Optimization

We will not sell or lease your information to third parties for their marketing purposes without your explicit consent. We only disclose certain information to third parties from time to time to be able to offer the best possible product to our customers, improve the quality of our Services and protect the interests of our customers. However, this disclosure will always be subject to strict limitations, which are described in more detail below.

4.1.1. Cookies – General Information

We use cookies on our website in compliance with Art. 6(1) f) of the GDPR. Our interest in improving our Services is recognized as legitimate in the aforementioned provision. Cookies are small files generated automatically by your browser and stored on your device (laptop, tablet, smartphone, etc.) when you use our Services. Cookies do not harm your device, and do not contain viruses, Trojans or other malware. Cookies contain information downloaded by the specific device. This does not mean, however, that we receive direct knowledge of your identity.  One purpose of cookies is to make it more convenient for you to use our Services. For example, we use session cookies to track your use of the individual pages of our website or when you have logged on to your customer account. When you use our Service again at a later time, the cookie automatically recognizes your previous visit to the website, as well as your input and settings, so that you do not have to enter them again. To make the site more user friendly, we also use temporary cookies, which are stored on your device for a pre-determined period of time. These cookies are automatically deleted when you log off.

If you already have a customer account and are logged on, the information stored on the cookies are associated with that account.

Another reason we use cookies is to gather statistics on the use of our Services and evaluate them in order to optimize your experience and to display information tailored to you. These cookies allow us to automatically recognize that you have visited our site before. The cookies are automatically deleted after a pre-defined period. Most browsers accept cookies automatically. However, you can disable cookies on your browser or choose to be notified when a new cookie is created. However, disabling cookies completely may mean that not all features of our services will be available to you. The storage period of cookies depends on their purpose and is not the same for all of them.

4.1.2. Braze

To design and continuously improve our web funnel in compliance with Art. 6(1) a) of the GDPR, we use the external service provider Braze, 318 W 39th St, 10018 New York City, USA, (hereinafter “Braze”).  We use Braze to control our email marketing campaigns and to reach out to our registered users. For this purpose, when you set up an 8fit account using our web funnel, we send the following information to Braze:

  • Name
  • Email address
  • Time zone
  • Device information (screen resolution, browser information and
    operating system)
  • IP address
  • Location
  • Language used

You can object to this data processing at any time by either clicking on the unsubscribe button of the respective newsletter or simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.

4.1.3. Sentry

We are constantly improving and developing our website to provide our users with the best possible customer experience. However, not all malfunctions, such as those caused by programming errors, can be reliably ruled out from the start. Therefore, we use Sentry, an error tracking tool from Functional Software Inc., 132 Hawthorne St, San Francisco, CA 94107, USA (hereinafter “Sentry”). To improve the accessibility and technical stability of our website by monitoring system stability and detecting code errors, we may automatically send the following information to Sentry in the event of a software failure:

  • Device information (operating system, browser version, browser type)
  • The IP address of the device
  • Email
  • Name
  • Date and time of error

The legal basis of the aforementioned data processing is Art. 6(1) f) of the GDPR. There is no explicit analysis for advertising purposes in this process. The information is collected anonymously, is not used for personal reasons, and is subsequently deleted. This analysis helps us to continuously improve our website and fix hidden code errors. Such processing is in our legitimate interest because the data is used solely for identifying and analysing errors. For more information on Sentry’s data processing and how it works, see Sentry’s privacy policy: https://sentry.io/privacy/

In the event that personal data is processed here, you can object to it at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.

4.1.4. Yahoo Gemini Tag

To manage our marketing campaigns, in compliance with Art. 6(1) f) of the GDPR, we use the Yahoo Gemini Tag tool, a product of Oath Ltd. (formerly Yahoo), 5-7 Point Square, North Wall Quay, Dublin, Ireland (hereinafter “Yahoo Gemini”). This service helps us to optimize our campaigns and adapt advertising media to specific behaviours and interests, and track their conversion. The tool is integrated into our Services as a Javascript library. The data processing initiated for this purpose is generally anonymous. The identification of an individual with the use of the tool is not intended or desired. However, the identification of an individual in exceptional cases cannot be ruled out with complete certainty, which is why we wish to inform you about it. The following data is collected when the tool is used:

  • Device information (e.g. type, brand)
  • Device operating system (e.g. iOS 11),
  • IP address of the device
  • Date and time our Services are accessed
  • Type of campaign and content
  • Response to the respective campaign (e.g. clicking on a button)

The data processing for advertising on the basis of behaviour and interests is recognized as in our legitimate interest under Recital 47 of the GDPR. The information is stored for the legally established retention periods and then deleted.

More detailed information on this tool is available on the Yahoo Gemini website at https://policies.yahoo.com/ie/de/yahoo/terms/advertising/index.htm. You can object to this data processing at any time by following this link and clicking on the opt-out button: https://aim.yahoo.com/aim/us/en/optout/.

4.1.5. Facebook Pixel

To set up, continuously improve, and track the conversion of our Facebook campaigns as required, in compliance with Art. 6(1) f) of the GDPR, we use the individual visitor action pixel of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Facebook”). This pixel is integrated into our website’s code. This helps us ensure that the Facebook ads we initiate are only displayed to Facebook users who have shown interest in our Services. In this way we know that our Facebook ads correspond to the potential interest of the respective users and not bothering them. It also allows us to track the actions of Facebook users after they have viewed or clicked on one of our Facebook ads. At the same time, it helps us track the conversion of the respective campaign for statistical, market-research and billing purposes. The following information is collected during its use:

  • Time stamp
  • URL
  • Campaign-related information (particularly impression, form field and activated button specifications)

Information collected in this way is anonymous to us and therefore does not provide us with any information about the identity of the respective user. Such processing for behavioural and interest-based advertising purposes is recognized as in our legitimate interest under Recital 47 of the GDPR. The data is stored in accordance with the legally established retention periods and then automatically deleted.

When you log on after placing the pixel on your Facebook account, or you visit our website while logged on, Facebook might store and process this information, which is why we would like to inform you about this. Facebook can connect this data with your Facebook account and use it for its own advertising purposes, in accordance with Facebook’s data policy: https://www.facebook.com/about/privacy/. You can find more information about Facebook Pixel here. You can enable Facebook and its partners to display ads on and off Facebook. You can object to this special data processing at any time by changing your Facebook settings  accordingly or by simply informing us that you no longer want this processing in the future. Please use the contact options for our company’s data privacy officer for this purpose. Please be aware that the objection only applies to the device being used in each case. For further information, see the Facebook Privacy Policy and information on protecting your personal privacy.

4.1.6. Facebook Lookalike Audiences

To optimize targeting and track the conversion of our Facebook campaigns, in compliance with Art. 6(1) a) of the GDPR, we use the option of developing Facebook lookalike audiences offered to us by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Facebook”). You can find more information about the Facebook Lookalike Audiences at: https://www.facebook.com/business/help/365463786964246.

The data processing for advertising on the basis of behaviour and interests is recognized as in our legitimate interest under Recital 47 of the GDPR. If you belong to the Facebook Lookalike Audience, we send your email address and your device’s ID to Facebook. You can object to this special data processing at any time by changing your Facebook settings at https://www.facebook.com/settings/?tab=ads or simply inform us that you no longer want this processing in the future. Please use the contact options for our company’s data privacy officer for this purpose.

4.1.6. Facebook Login

We allow you to sign up for and log on to our Services via the Login with Facebook feature. This replaces the otherwise necessary registration. To log in you are redirected to the Facebook server, where you sign on using your user information. This links your Facebook profile to our Services. By using this simplified login feature, you give us your consent to use the following information from your publically visible profile:

  • Name
  • Location
  • Birth date
  • Gender
  • Email address
  • Time zone
  • Friends or
  • Profile photo

The legal basis of the aforementioned data processing is Art. 6(1) a) of the GDPR and Art. 9(2) a) of the GDPR. The purpose of the data collection above is the simplified login and the establishment and fulfilment of an agreement. This information is required for the conclusion of the agreement in order to be able to identify it. For the purpose and scope of Facebook’s data collection and the further processing and use of the information, as well as the associated rights and setting options to protect your privacy, please consult the Facebook privacy information.

4.1.7. Pinterest Tag

To set up, continuously improve, and track the conversion of our Pinterest campaigns as required, in compliance with Art. 6(1) f) of the GDPR, we use a Pinterest Tag, an individual code snippet, from Pinterest Inc., 635 High Street, Palo Alto, CA, USA, (hereinafter “Pinterest”), which is integrated in our website. This helps us ensure that the Pinterest ads we initiate are only displayed to Pinterest users who have shown interest in our Services. In this way we know that our Pinterest ads correspond to the potential interest of the respective users and not bothering them. It also allows us to track the actions of Pinterest users after they have viewed or clicked on one of our Pinterest ads. At the same time, it helps us track the conversion of the respective campaign for statistical, market-research and billing purposes. The following information is collected during its use:

  • Device information (e.g. type, brand)
  • Device operating system (e.g. iOS 11),
  • IP address of the device
  • Date and time our Services are accessed
  • Type of campaign and content
  • Response to the respective campaign (e.g. clicking on a button

Information collected in this way is anonymous to us and therefore does not provide us with any information about the identity of the respective user. Such processing for behavioural and interest-based advertising purposes is recognized as in our legitimate interest under Recital 47 of the GDPR. The data is stored in accordance with the legally established retention periods and then automatically deleted.

When you log in to your Pinterest account after visiting our website while logged on, Pinterest might store and process this information, which is why we would like to inform you about this. Pinterest can link this data with your Pinterest account and use it for its own advertising purposes. You can read more about Pinterest’s data policy at https://policy.pinterest.com/de/privacy-policy. You can object to this special data processing at any time by disabling the relevant settings in your Pinterest account https://help.pinterest.com/de/articles/edit-your-settings#Web under “Personalization” or enabling the “Do not track” setting in your browser.

4.1.8. Taboola

In compliance with Art. 6(1) f) of the GDPR, we use an individual pixel from Taboola Inc., Oneustonsq, 40 Melton Street, 13th Floor, London, NW1 2FD OR 28 West 23rd St. 5th fl., New York, NY 10010 (hereinafter “Taboola”). This allows us to optimize our marketing campaigns, and customize them as much as possible to the personal interests of the target audience. It permits us to adapt our approach to their specific behaviours and interests. Ultimately, we are able to track the conversion of the respective campaign. For this purpose, the following information is processed:

  • Device information (operating system, browser version)
  • The (truncated) IP address of the device
  • Browser type

This information is combined by Taboola into a user profile using pseudonyms. These user profiles are not merged with information about the bearer of the pseudonym and do not allow any conclusions to be drawn about your personal data. Data processed in this way to optimize the behavioural and interest-based marketing of our Services is considered to be in our legitimate interest. The information is stored in compliance with the legally established retention periods and then automatically deleted. You can find more information about Tabooola’s data privacy policy at: https://www.taboola.com/privacy-policy. You may object to this data processing at any time by clicking on the following opt-out link: https://www.taboola.com/privacy-policy#optout

4.1.9. Snowplow

For the custom design and continuous improvement of our Services, in compliance with Art. 6(1) f) of the GDPR, we use Snowplow open-source analytics of Snowplow Analytics Ltd., the Roma Building, 32-38 Scrutton Street EC2A 4RQ London, UK (hereinafter “Snowplow”). It is installed on our own servers. The following information is sent only to our webhost:

  • Device information (e.g. type, brand)
  • Operating system (e.g. iOS 11),
  • Provider name (e.g. Vodafone),
  • Events in the app and the use of individual features, such as your personal training plan, the activities you enter, access to recipes, or the period of use.

Data processed in this way to optimize our Services is considered to be in our legitimate interest. The information is stored in compliance with the legally established retention periods and then automatically deleted. You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.

4.1.10. Google Analytics

For the custom design and continuous improvement of our Services, in compliance with Art. 6(1) f) of the GDPR, we use the web analytics service of Google Analytics of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”). Using cookies, Google creates pseudonymised user profiles. The information generated by the cookies for users includes:

  • Browser type/version
  • Operating system
  • Referrer URL (previously visited page)
  • Host name of the accessing computer (IP address)
  • Time of the server request

This information is sent to a Google server in the U.S. and stored there. The information is used to evaluate the use of our Services, to compile reports on the activities, and to provide other related services for purposes of market research and customized design. This information may also be sent to third parties if required by law or if third parties process this data on behalf of Google. Under no circumstances will your IP address be merged with any other Google data. The IP addresses are anonymised so that assignment is not possible (IP masking).

You can prevent the installation of the cookies in advance by configuring your browser software accordingly or object to the continued processing of your data with the cookies by clicking on the opt-out link. Please note that if you disable cookies, it will not be possible to fully take advantage of all of the features of our Services. You can also prevent Google from collecting and processing the data generated by the cookies and related to your usage (including your IP address) by downloading and installing this browser add-on. On mobile devices, we recommend using private mode. You can find more information on protecting your privacy in relation to Google Analytics on the Google Analytics website.

4.1.11. Google Tag Manager

We manage website tags (website code) with Google Tag Manager. These tags helps us manage and continuously improve our Services and reduce your loading time. Google Tag Manager only implements website code. Google Tag Manager itself does not generate cookies or collect any personal information. It merely integrates website code that we have stored elsewhere that may be used to collect data. It is therefore only used to facilitate the management of the respective code, but does not itself access the data processed by the code. In this privacy policy, we inform you about all tags that are integrated in this way. Consult the relevant Google pages for more information about Google Tag Manager and user guidelines.

4.1.12. Stripe Payment Service

For the fulfilment of the agreement and to process payments in particular, in compliance with Art. 6(1) a) and b) GDPR, we send your name and email address to our payment processor Stripe Payments Europe Ltd., Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland (hereinafter “Stripe”). By using Stripe’s library, the information entered during the ordering process (e.g. address, account number, bank code, credit card number, invoice amount, currency and transaction number) will not be processed by us but sent directly to Stripe by your browser. The information is used by Stripe exclusively for the implementation and realization of the payment process and is securely transmitted via SSL encryption. Stripe is certified by PCI DSS. Stripe may transmit, process and store personal information outside of the EU. You can find detailed information on the Stripes privacy policy at this Link.

4.2. Mobile App

4.2.1. Adjust

For the custom design and continuous improvement of our App, and for purposes of our own market research, we use the Adjust usage analytical tool of Adjust GmbH, Saarbrücker Str. 36, 10405 Berlin (hereinafter “Adjust”). We use Adjust to help us understand how our users find us and install our app. If you click on a link operated by Adjust, it will take you to the App Store via an Adjust server. Here, Adjust processes anonymous IP and Mac addresses, as well as the associated installation and event data. It is not possible for us or for Adjust to draw conclusions about an individual. The information collected in this way is used solely for the aforementioned evaluation purposes, specifically to analyse the feature and the use of the app by creating anonymous evaluations and graphics on the number of visits, the number of pages viewed per user, etc.

4.2.2. Apple Health Kit und Google Fit

To improve fitness tracking and health management, you have the option of transmitting the data collected by our Services via the interface provided by the respective providers into the Apple Health Kit or the Google Fit app. This only happens if you explicitly agree to the process via your device settings. If you consent to this transfer, we store the following personal data on our servers:

  • Start time of the steps taken
  • Distance in meters of the steps taken
  • Number of steps taken

We have no control over nor are we aware of how the health information is used in the Apple HealthKit or the Google Fit app. You can object to the processing of this data anytime by disabling the feature in your device settings. Before enabling the respective feature, we recommend reading the privacy policy of Apple or Google.

4.2.3. Sentry

We want to provide our users with the best possible customer experience, which is why we are constantly improving and developing our app through updates. Before each release, it is thoroughly tested. Nevertheless, not all malfunctions, for example due to programming errors, can be reliably ruled out from the start. Therefore, we use the Sentry error analysis tool from Functional Software Inc., 132 Hawthorne St, San Francisco, CA 94107, USA (hereinafter “Sentry”). To improve the accessibility and technical stability of our app, we monitor system stability and identify code errors, and may automatically send the following information to Sentry in the event of a software failure:

  • Device information (type, brand, operating system, browser version, browser type),
  • The IP address of the device
  • Name and
  • Date and time of the error

The legal basis of the aforementioned data processing is Art. 6(1) f) of the GDPR. There is no explicit analysis for advertising purposes in this process. The information is collected anonymously, is not used for personal reasons, and is subsequently deleted. This analysis helps us to continuously improve our app and fix hidden code errors. Such processing is in our legitimate interest because the data is used solely for identifying and analysing errors. For more information on Sentry’s data processing and how it works, see Sentry’s Privacy Policy: https://sentry.io/privacy/

In the event that personal data is processed here, you can object to it at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.

4.2.4. Snowplow

For the custom design and continuous improvement of our app, in compliance with Art. 6(1) f) of the GDPR, we use Snowplow open-source analytics. It is installed on our own servers. The following information is sent only to our webhost:

  • Device information (e.g. type, brand, operating system, browser version, browser type, etc.)
  • Operating system (e.g. iOS 11),
  • Provider name (e.g. Vodafone),
  • Events in the app and the use of individual features,, such as your personal training plan, the activities you enter, access to recipes, or the period of use.

Data processed in this way to optimize our app is considered to be in our legitimate interest. The information is stored in compliance with the legally established retention periods and then automatically deleted. You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.

4.2.5. Amplitude

For the custom design and continuous improvement of our app, in compliance with Art. 6(1) f) of the GDPR, we use the Amplitude analytical tool of Amplitude Analytics Inc., 501 2nd Street Suite 100, San Francisco, California 94107, USA (hereinafter “Amplitude”). This tool helps us to better understand the behaviour of our users and gain insight on where improvements can be made. For this purpose, we use the Amplitude library, which collects the following data:

  • Device information (type, brand, operating system)
  • The IP address of the device
  • Name of provider (e.g. Vodafone),
  • Interaction with the app
  • Name
  • Email
  • Age
  • Weight
  • Height
  • Gender

User profiles may be created from this information, which we use exclusively for the aforementioned purpose. Amplitude is certified in compliance with the Privacy Shield Framework and therefore meets European standards for lawful order data processing. You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose. You can find more information about data processing by Amplitude at https://amplitude.com/privacy. You can also send your questions directly to the Amplitude data privacy officer at: contact@amplitude.com.

4.2.6. Cloudinary

To more efficiently manage the photos uploaded by you via the app and display them in your profile, in compliance with Art. 6(1) a) and Art. 9(2) a) of the GDPR, we use the Cloudinary cloud-based optimization tool of Cloudinary Ltd., 111 W Evelyn Ave, Suite 206, Sunnyvale, CA 94086, USA (hereinafter “Cloudinary”). When you upload a photo using the app, it is saved on Coudinary’s servers. Cloudinary is certified in compliance with the Privacy Shield Framework and therefore meets European standards for lawful order data processing. In addition, Cloundinary guarantees us by contract that we have exclusive access to these data.  You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose. You can find detailed information on data protection and your privacy at the Cloudinary website: http://cloudinary.com/privacy and http://cloudinary.com/tos.

4.2.7. Facebook Login

We allow you to sign up for and log on to our app via the Facebook Login feature. This replaces the otherwise necessary registration. To log in you are redirected to the Facebook server, where you sign on using your user information. This links your Facebook profile to our Services. By using this simplified login feature, you give us your consent to use the following information from your publicly visible profile:

  • Name
  • Location
  • Birth date
  • Gender
  • Email address
  • Time zone
  • Friends or
  • Profile photo

The legal basis of the aforementioned data processing is Art. 6(1) a) of the GDPR and Art. 9(2) a) of the GDPR. The purpose of the data collection above is the simplified login and the establishment and fulfilment of an agreement. This information is required for the conclusion of the agreement in order to be able to identify it. For the purpose and scope of Facebook’s data collection and the further processing and use of the information, as well as the associated rights and setting options to protect your privacy, please consult the Facebook privacy information.

4.2.8. Push Notifications per Braze

To customize the design and continuously improve the individual user experience of our Services, we manage push notifications through the external service provider Braze, 318 W 39th St, 10018 New York City, USA (hereinafter “Braze”). Braze is a technical support tool with which we automatically send or receive the following information:

  • Device type (e.g. iPhone 8)
  • IP address
  • Location
  • Language used
  • Time zone
  • Operating system (e.g. iOS 11)
  • Email address
  • Birth date
  • Status of any subscription
  • Gender
  • Events generated by the app, performance metrics, performance and usage data

When you allow the app to send you push notifications, you consent to the collection of the aforementioned data in the manner described herein. The collection of the data therefore complies with Art. 6(1) a) of the GDPR. You may object to the data collection at any time by disabling the push notifications in your device settings or by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.

5. Recipients outside the EU

As indicated above under 3.4 and 3.5, data may also be sent to recipients located outside the European Union or the European Economic Area. This applies in particular to the aforementioned processing of analysis and/or targeting technologies, which can result in data transmission to the servers of the service providers. Other recipients may be affiliated service providers that we need in order to provide our services, e.g. hosts, CRM tools, analytical service providers. These servers may be outside the EU, especially in the US. We make absolutely sure that these service providers guarantee data protection standards equivalent to those of the GDPR and that they comply with the applicable directives. Therefore, we only work with those service providers who are certified by the EU-US Privacy Shield. In case number C(2016) 4176), the European Commission established the suitability of this data protection level for certification in compliance with Art. 45 GDPR. The use of these certified service providers thus meets European standards for lawful data processing. In addition, we have obtained suitable contractual guarantees from all service providers based in other EU countries, which ensure compliance with these EU standards and the enforcement of the rights of affected persons, for example based on the standard contractual clauses of the European Commission.

6. Your Rights

6.1. Overview

In addition to the right at any time to withdraw any consent you have given us, you are also entitled to the following if the respective legal conditions are met:

  • The right to be informed about your personal data that is stored with us, pursuant to Art. 15 GDPR
  • In the event of transmissions covered by Art. 46, 47 or 49(1) 2) GDPR, the right to information, or references to suitable or appropriate guarantees that a copy of them can be obtained, or where they are available
  • Your personal data that is stored with us, pursuant to Art. 15 GDPR
  • The right to correct inaccurate or incomplete data, pursuant to Art. 16 GDPR
  • The right to the deletion of your personal information that is stored with us, pursuant to Art. 17 GDPR
  • The right to limit the processing of your data, pursuant to Art. 18 GDPR
  • Right to data portability, pursuant to Art. 20 GDPR.

6.2. Right to Object

Under the provisions of Art. 21(1) GDPR, the data subject has the right to object on grounds relating to his or her particular situation, at any time to the processing of personal data.

The foregoing general right to object applies to all processing purposes described in this Privacy Policy that are based on Article 6(1) f) GDPR. Unlike the special right to object to data processing for commercial purposes (see above under 3.3), we are only obliged to implement such a general objection under the GDPR if you state reasons of overriding importance (e.g. a potential risk to life or health). Furthermore, you may contact the supervisory authority responsible for us, which is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragten für Datenschutz und Informationsfreiheit), Friedrichstraße 219, 10969 Berlin.

7. Data Security

We apply the highest standards to data security for our infrastructure and the processing of your data. For example, we use protection mechanisms for computers such as firewalls and data encryption. Our buildings and data are subject to physical access controls. Access to the personal information of our customers is only possible for those employees who need them to carry out their activities.

All personal data sent by you, including your payment information, is also transmitted using the generally accepted and secure SSL (Secure Socket Layer) standard. SSL is a secure and proven standard, e.g. it is also used for online banking. You will recognize a secure SSL connection with the placement of an “s” at the end of http (i.e. https: // …) in the address bar of your browser, or with the lock icon at the bottom of the browser.

We also apply suitable technical and organizational security measures to protect your personal data stored with us against manipulation, partial or complete loss, and against unauthorized access by third parties. Our security measures are continuously monitored using the latest technology, and regularly adapted to the relevant risk, and improved if necessary.

This Privacy Policy was last modified on 24th May, 2018.