Published using Google Docs
Privacy Policy en - Details
Updated automatically every 5 minutes

Privacy Policy

Please also note: You can find our General Terms and Conditions at: https://www.socialsweethearts.de/terms-en

Introduction

This Privacy Policy informs you about the type, scope and purpose of the processing of personal data (hereinafter referred to as "data") in the context of the provision of our range of services and on our websites, mobile applications, functions and contents connected with them as well as external online representations, e.g. Social Media Profiles (hereinafter collectively referred to as "Services"):

Section I – Controller and Overview of Data Processing

Controller

social sweethearts GmbH

Karl-Valentin-Str. 17,

D-82031 Gruenwald

Germany

E-Mail: team@socialsweethearts.de

Tel.: +49 (0)211 436 91166

Complete legal information:: http://www.socialsweethearts.de/en_US/imprint

The Controller is hereinafter also referred to as "we" or "us".

Data Protection Officer

Dr. Thomas Schwenke, E-Mail: DSB@extern.socialsweethearts.de.

Description of our services and objectives

social sweethearts offers online services for entertainment purposes, such as games, puzzles, personality tests or quizzes.

Type of processed data:

Processing of special categories of Data (Art. 9 (1) GDPR)

No special categories of Data are processed.

Categories of data subjects

In the following, we will also summarise the data subjects as "users".

Purpose of Processing

Automated individual decision-making (Art. 22 GDPR):

We do not use exclusively automated individual decision-making.

As of: March 2024

Table of Contents

Introduction

Section I – Controller and Overview of Data Processing

Controller

Data Protection Officer

Description of our services and objectives

Type of processed data:

Processing of special categories of Data (Art. 9 (1) GDPR)

Categories of data subjects

Purpose of Processing

Automated individual decision-making (Art. 22 GDPR):

Section II - Rights of data subjects, legal basis for the processing and general information

Rights of Data Subjects

Right of Withdrawal

Right to Object

Cookies and Right to Object in Direct Marketing

Solely Automated individual decision-making

Erasure of data and archiving obligations

Changes and Updates to this Privacy Policy

Relevant Legal Basis for the Processing;

Security of Data Processing

Disclosure and Transmission of Data

Transfers to Third Countries

Section III - Processing operations

The Key Area of Data Processing

Contractual services (e.g. Nametests, testony, Trivia Pearls, Sweet Puzzles, apost)

Mobile Applications (Sticker test and Storytest)

Purchase of applications via Appstores

Push notifications

Cookie-Management with Sourcepoint

PURE-subscription by contentpass

Single sign-on authentication with Facebook

Answering Inquiries and Communication via Freshdesk

Answering Inquiries and User Service

Administration, Financial Accounting, Office Organization, Archiving

Business and market research

Typeform

Data protection information for Job Candidates

Application process

Campusjäger by Workwise (Application process)

Workable (Application process)

Application Process - Talent Pool

Wellfound (formerly AngelList (angel.co))

BambooHR

Deel

We use an international recruitment and payroll service offered by Deel.

Webserver and Security

Amazon Web Services

Cloudflare

Godaddy

Google Suite and Google Cloud

MongoDB Atlas

Raygun

SolarWinds Worldwide, LLC (Pingdom and Papertrail)

Sophos Managed Detection and Response

Embedded content and functions

Ex.co (former Playbuzz) content distribution

Facebook Features and Content

Giphy features and content

Google Services and Content

Imgur features and content

Instagram Features and Contents

Pinterest features and content

Reddit features and content

Rumble features and content

TikTok features and content

Twitter features and content

video intelligence video player

Sharing graphics with Snapchat

WhatsApp features and content

External online profiles

Online Presences in Social Media

Organization and Marketing

ADYOULIKE

Amazon Publisher Services

Appnexus

Bitly

ContractHero

DocuSign

Easycompliance

Harvest (Iridesco, LLC)

Hootsuite

Taboola

Teads content distribution

Yieldlove

Newsletter Mailing and Performance Measurement

Communication via Mail, E-Mail, Fax or Telephone

Sweepstakes and Competitions

Optimization

Amazon Personalize

Google Firebase

Web analytics, online marketing and technology partners

Advanced Analytics

Branch Metrics, Inc.

Criteo

e-dialog GmbH

Google Tag Manager

Google Analytics

Google Ads/ AdWords

Google Doubleclick

Google AdMob

Facebook Pixels and Custom Audiences

OpenX

Outbrain

Snap Pixel

Supermetrics

Taboola

Webflow

Profiles in Social Networks (Social Media)

Section IV - Definitions

Section II - Rights of data subjects, legal basis for the processing and general information

Rights of Data Subjects

You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the  further information and a copy of the data in accordance with Art. 15 GDPR.

You have correspondingly. In accordance with Article 16 of the GDPR, the right to obtain from the controller the rectification of inaccurate personal data concerning you, or the completion of the data concerning you.

In accordance with Art. 17 GDPR, you have the right to demand that relevant data be erased without undue delay or, alternatively, to demand a restriction of the processing of the data in accordance with Art. 18 GDPR.

You have in accordance with Art. 20 GDPR the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

In accordance with Art. 77 GDPR, you also have the right to file a complaint with the a supervisory authority.

Right of Withdrawal

You have the right to withdraw consents granted pursuant to Art. 7 (3 GDPR with effect for the future.

Right to Object

You can object to the future processing of the data concerning you in accordance with Art. 21 GDPRat any time. The objection may be lodged in particular against processing for direct marketing purposes.

Cookies and Right to Object in Direct Marketing

We use temporary and permanent cookies, i.e. small files that are stored on the user's devices (for the explanation of the term and function, see last section of this Privacy Policy). In part, cookies serve security purposes or are required for the operation of our online services (e.g., for the appearance of the website) or to save the user's decision when confirming a cookie banner. In addition, we or our technology partners use cookies to measure the reach and for marketing purposes, about which the users will be informed in the scope of the Privacy Policy.

Consent management (apost.com) 

We participate in the IAB Europe Transparency & Consent Framework and comply with its specifications and guidelines. For this purpose, we use the Consent Management Platform (CMP) of Sourcepoint Technology Inc, 228 Park Ave S #87903, New York 10003-1502, USA as a processor. Within the framework of the IAB Europe Transparency & Consent Framework, Sourcepoint has the identification number 6. Sourcepoint's CMP enables you to give us consent to the processing of your data in accordance with data protection regulations and to revoke this consent at any time. You can also object to data processing based on our legitimate interest. You can find an overview of your setting options, the purposes and integrated third parties via the text link "Consent Management" at the bottom of the page on apost.com.

Further objection options

If users do not want cookies to be stored on their computer, they are advised to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online services.

An objection to the use of cookies used for online marketing purposes can be declared for many of the services, especially in the case of tracking, via the US site http://www.aboutads.info/choices/, the EU site http://www.youronlinechoices.com/ or in general http://optout.aboutads.info.

Furthermore, the storage of cookies can be prevented by deactivating them in the browser settings. Please note that in this case not all functions of out online service can be used.

Solely Automated individual decision-making

In accordance with Art. 22 GDPR, you have the right not to be subject to a decision based exclusively on automated processing - including profiling - which has legal effect concerning you or similarly significantly affects you.

We inform you that we do not use exclusively automated individual decision-making.

Erasure of data and archiving obligations

The data processed by us will be erased or its processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated in this Privacy Policy, the data stored by us will be erased as soon as it is no longer required for its intended purpose and there are no legal obligations to retain it. If the data are not erased because they are necessary for other and legally permissible purposes, their processing is restricted. This means that the data is excluded and not processed for other purposes. This applies, for example, to data that must be retained for commercial or taxation reasons.

In accordance with statutory requirements, the records shall be kept for 6 years in particular in accordance with § 257 (1) German Commercial Code (trading books, inventories, opening balance sheets, annual financial statements, commercial letters, accounting documents, etc.) and for 10 years in accordance with § 147 (1) German Financial Act (books, records, management reports, accounting documents, commercial and business letters, documents relevant to taxation, etc.).

Processes relating to the assertion of the rights of data subjects, will be stored for up to three years beginning after the end of the year in which they were concluded, on the basis of legitimate interests, in order to enable us to prove that they have been properly processed.

Changes and Updates to this Privacy Policy

We ask you to keep yourself regularly informed about the contents of our Privacy Policy. We will adapt the Privacy Policy as soon as any changes in data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

Relevant Legal Basis for the Processing;

In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. If the legal basis is not explicitly stated in the Privacy Policy, the following applies: The legal basis for obtaining consents is Art. 6 (1) lit. a and Art. 7 GDPR, the legal basis for processing for the performance of our services and performance of contractual measures as well as for answering inquiries is Art. 6 (1) lit. b GDPR, the legal basis for processing to fulfil our legal obligations is Art. 6 (1) lit. c GDPR, and the legal basis for processing to protect our legitimate interests is Art. 6 (1) lit. f GDPR. In the event that the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis.

The principles for commercial communications outside of business relations, in particular by post, telephone, fax and e-mail, are contained in § 7 of the German Unfair Competition Act (UWG).

Security of Data Processing

We shall take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons; the measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, transfer, integrity and pseudonymity. Furthermore, we have established procedures that guarantee the assertion of data subjects' rights, the erasure of data and the response to data hazards. Furthermore, we already consider the protection of personal data during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design of technology and by data protection-friendly presettings (Art. 25 GDPR).

The security measures include in particular the encrypted transmission of data between your browser and our server.

Employees are bound to confidentiality with regard to data protection, are instructed, monitored, and informed of possible liability consequences.

Disclosure and Transmission of Data

If we disclose data to other persons and companies (processors or third parties) within the scope of our processing, transfer the data to them or otherwise grant them access to the data, this will only be carried out on the basis of a legal permission (e.g. if a transfer of the data to third parties, such as to payment service providers, is required for contract fulfilment pursuant to Art. 6 (1), lit. b GDPR), if you have consented, if a legal obligation requires this or on the basis of our legitimate interests (e.g. when using agents, web hosting services, etc.).

If we commission third parties with the processing of data on the basis of a so-called " Data Processing Agreement", this is done on the basis of Art. 28 GDPR.

If we disclose, transfer or otherwise grant access to data to other companies in our Group of Companies (Undertakings), this is done in particular for administrative purposes as a legitimate interest and in addition on the basis of an Data Processing Agreement.

Transfers to Third Countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services or disclosure or transmission of data to third parties, this only takes place if it is necessary to fulfil our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or let the data being processed in a third country only if the special requirements of Art. 44 ff. GDPR are met. This means, for example, processing is carried out on the basis of special guarantees, such as the officially recognised adequate data protection level corresponding to the EU or compliance with officially recognised special contractual obligations (so-called "Standard Contractual Clauses").

Section III - Processing operations

The following section provides an overview of our processing activities, which we have subdivided into other areas of operation. Please note that the areas of operation are for guidance only and that processing activities may overlap (e.g. the same data may be processed in several operations).

For reasons of clarity and comprehensibility, you will find the frequently repeated terms in Section IV of this data protection declaration.

The Key Area of Data Processing

In this section you will find information on our key services and operations, such as responding to enquiries and providing our contractual services as well as the associated ancillary tasks.

 

Contractual services (e.g. Nametests, testony, Trivia Pearls, Sweet Puzzles, apost)

We process the data of our customers within the scope of our services in order to provide our contractual services. We receive the data either through user input or when users expressly consent to provide us with data via an interface to Facebook. Furthermore, data resulting from the use of our services are processed (so-called usage or metadata, such as functions and content used or information on user devices).

If we evaluate the interests or behaviour of users, this will lead to a needs-oriented design of our Online Services.

For example, users are provided with content or functions that correspond to the content and functions previously used. For this purpose, we use data that we obtain about users in accordance with this Privacy Policy and analyse it with the aid of algorithmic functions. This analysis is only for our purposes, the results will not be passed on to third parties.

Nametests: First name or player name, app-specific ID, language (locale), gender (guessed based on first name and language), player’s profile or avatar picture (we use the profile picture on result graphics, which the user can share); no access to friends list/ friends' data; no e-mail addresses of users are processed and stored. (more Details and FAQ)

Testony.com and Stickertest.com : First name (if provided by user), gender, language; no access to friends list/ friends' data; no e-mail addresses of users are processed and stored.

Trivia Pearls: First name or player name and player’s profile or avatar picture (we use the profile picture on result graphics, which the user can share); Friends and connections: The first names of Facebook friends and Messenger connections who also play this game; Language (locale); app-specific player ID; no e-mail addresses of users are processed and stored.

Sweet Puzzles: First name or player name and player’s profile or avatar picture (we use the profile picture for/on result and/or puzzle graphics, which the user can play as puzzle and/or share); Language (locale); gender (guessed based on first name and language), app-specific player ID; no e-mail addresses of users are processed and stored. (Details)

apost: apost is an information portal, the use of which does not require the entry of user data and neither access to Facebook profiles of users nor their e-mail addresses.

Mobile Applications (Sticker test and Storytest)

We process the data of the users of our applications to the extent necessary to provide the users with the applications and its functionalities, to monitor its security and to develop it further. Furthermore, we may contact users in compliance with the statutory provisions if communication is necessary for the purposes of administration or use of the applications. In addition, we refer to the data protection information in this privacy policy with regard to the processing of user data.

Legal basis: The processing of data necessary for the provision of the functionalities of the applications serves to fulfil contractual obligations. This also applies if the provision of the functions requires user authorisation (e.g. release of device functions). If the processing of data is not necessary for the provision of the functionalities of the applications, but serves the security of the applications or our business interests (e.g. collection of data for the purpose of optimising the applications or security purposes), it is carried out on the basis of our legitimate interests. If users are expressly requested to give their consent to the processing of their data, the data covered by the consent is processed on the basis of the consent.

Device permissions for access to functions and data: The use of our applications or their functionalities may require user authorizations to access certain functions of the devices used or to access data stored on or accessible through the devices. By default, these authorizations must be granted by the users and can be revoked at any time in the settings of the respective devices. The exact procedure for controlling application permissions may vary depending on the device and software used by the users. Users can contact us if they require further explanation. We would like to point out that the refusal or revocation of the respective authorizations can affect the functionality of our applications.

Processing of data by services that are integrated within the application (Within the applications we use the following services and point out the supplementary or linked data processing information):

Purchase of applications via Appstores

The purchase of our apps is done via special online platforms operated by other service providers (so-called "appstores"). In this context, the data protection notices of the respective appstores apply in addition to our data protection notices. This applies in particular with regard to the methods used on the platforms for webanalytics and for interest-related marketing as well as possible costs.

Services and service providers being used:

Push notifications

With the consent of the users, we can send the users so-called "push notifications". These are messages that are displayed on users' screens, devices or browsers, even if our online services are not being actively used.

In order to sign up for push messages, users must confirm that their browser or device has requested to receive push messages. This approval process is documented and stored. The storage is necessary to recognize whether users have consented to receive the push messages and to be able to prove their consent. For these purposes, a pseudonymous identifier of the browser (so-called "push token") or the device ID of a terminal device is stored.

The push messages may be necessary for the fulfilment of contractual obligations (e.g. technical and organisational information relevant for the use of our online offer) and will otherwise be sent, unless specifically mentioned below, on the basis of user consent. Users can change the receipt of push messages at any time using the notification settings of their respective browsers or end devices.

Analysis and performance measurement: We statistically evaluate push messages and can thus identify if and when push messages were displayed and clicked on. This information is used for the technical improvement of our push messages based on technical data or target groups and their retrieval behavior or retrieval times. This analysis also includes determining whether the push messages are opened, when they are opened and whether users interact with their content or buttons. For technical reasons, this information can be assigned to individual push message recipients. However, it is neither our intention nor, if used, that of the push message service provider to monitor individual users. Rather, the evaluations serve to identify the usage habits of our users and to adapt our push messages to them or to send different push messages according to the interests of our users.

The evaluation of the push messages and the measurement of performance are based on the consent of the users, which is given with their permission to receive the push messages. Users can object to the analysis and performance measurement by unsubscribing from the push messages. Unfortunately, it is not possible to cancel the analysis and performance measurement separately.

Contents: Information on new contents and functions

Services and service providers being used:

Cookie-Management with Sourcepoint

We use a cookie management solution for our website apost.com in which users' consent to the use of cookies, or the procedures and providers mentioned in the cookie management solution, can be obtained, managed and revoked by the users. The declaration of consent is stored so that it does not have to be retrieved again and the consent can be proven in accordance with the legal obligation. Storage can take place server-sided and/or in a cookie (so-called opt-out cookie or with the aid of comparable technologies) in order to be able to assign the consent to a user or and/or his/her device. Subject to individual details of the providers of cookie management services, the following information applies: The duration of the storage of the consent can be up to two years. In this case, a pseudonymous user identifier is formed and stored with the date/time of consent, information on the scope of the consent (e.g. which categories of cookies and/or service providers) as well as the browser, system and used end device.

PURE-subscription by contentpass

On the apost.com website, we offer the option of taking out a PUR subscription instead of consenting to the use of advertising cookies. We use the contentpass service to provide membership subscriptions and paid access.

This is an offer of Content Pass GmbH. When you take out the service, contentpass becomes your contractual partner. In order to be able to display and thus offer you this service on our website, contentpass, on our behalf, processes your IP address at the beginning of your website visit. For the registration as well as the contract processing of contentpass and the associated data processing, contentpass is the controller within the meaning of the DS-GVO. We are exclusively responsible for the processing of your IP address.

The basis for the data processing of the IP address, within the scope of our contract processing with contentpass, is our legitimate interest in offering you the opportunity to access our website free of advertising and tracking and your interest in using our website practically without advertising and tracking (Art. 6 para. 1 p. 1 lit. f) GDPR). In addition, we hereby fulfil the legal obligation to obtain legally compliant consent to data processing requiring consent (Art. 6 para. 1 lit. c) GDPR).

Please click on the following links to learn more about data protection at contentpass, to log in to your contentpass account, or to register for contentpass.

Please click on the following links to learn more about data protection at contentpass, to log in to your contentpass account, or to register for contentpass.

Single sign-on authentication with Facebook

We use Facebook's single sign-on method, which allows users to register within our online service.

We are jointly responsible (so-called "joint-controllership") with Meta Platforms Ireland Limited for the collection or receipt as part of a transmission (but not the further processing) of Event Data that Facebook collects or receives as part of a transmission for the following purposes using the Facebook single sign-on registration procedures that are implemented on our online services: a) displaying content advertising information that matches users' presumed interests; b) delivering commercial and transactional messages (e.g. b) delivering commercial and transactional messages (e.g., addressing users via Facebook Messenger); c) improving ad delivery and personalizing features and content (e.g., improving recognition of which content or advertising information is believed to be of interest to users). We have entered into a special agreement with Facebook ("Controller Addendum", https://www.facebook.com/legal/controller_addendum), which specifically addresses the security measures that Facebook must take (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to comply with the rights of data subjects (i.e., users can, for example, submit information access or deletion requests directly to Facebook). Note: If Facebook provides us with measurements, analyses and reports (which are aggregated, i.e. do not contain information on individual users and are anonymous to us), then this processing is not carried out within the scope of joint responsibility, but on the basis of a DPA ("Data Processing Terms", https://www.facebook.com/legal/terms/dataprocessing), the "Data Security Conditions" (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of Standard Contractual Clauses ("Facebook EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular to access to information, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook.

Answering Inquiries and Communication via Freshdesk

We use Freshdesk Customer Support solutions for communication with our users.

Answering Inquiries and User Service

We process the information in the inquiries, which we receive via our contact form and other means, e.g. via e-mail, in order to answer the inquiries. For these purposes, the inquiries may be stored in our Customer Relationship Management (CRM) system or in similar procedures that serve us to manage inquiries. For customer relationship management purposes (CRM) we use so-called CRM software. With the help of the software we can answer the inquiries more effectively and faster.

Administration, Financial Accounting, Office Organization, Archiving

We process data within the framework of administrative tasks as well as the organization of our company, financial accounting and compliance with legal obligations, such as archiving.

Business and market research

In order to operate our business economically and to identify market trends and user requirements, we analyse the data available to us on business transactions, contracts, enquiries, etc., in order to ensure that we are able to offer our users the best possible service. For this purpose, we combine the personal data of users from registrations and orders with the behaviour-related data of users.

In the context of the economic evaluation we bring together the data of the users independently of the used devices (e.g. if users use our online offer on a mobile or on a stationary device).

Typeform

We use Typeform support and bug reporting forms which can be filled by our end users.

- For as long as the processing is covered by the user consent;

- For as long as necessary to comply with legal obligations of Typeform;

- For as long as the processing is strictly necessary to pursue the legitimate interests and achieve the goals pertaining to such legitimate interests as set out it Typeform Privacy Policy.

Data protection information for Job Candidates

This section informs job candidates about the processing of their data during the application process.

Application process

Candidates can send us their applications via e-mail. Please note, however, that e-mails are generally not sent in encrypted form and that the candidates themselves must ensure that they are encrypted. We can therefore accept no responsibility for the transmission of the application between the sender and the reception on our server.
Instead of applying by e-mail, candidates can still send us their application by post.

Campusjäger by Workwise (Application process)

We use the services of the recruitment platform Campusjäger for the purposes of searching for job candidates, making and contacting them, as well as forwarding application documents and selecting job applicants.

Workable (Application process)

To conduct the online application process, we use the services of third party provider Workable Software Limited, 21a Kingly Street, 2nd Floor, London, W1B 5QA, UK.

Application Process - Talent Pool

As part of the application process, we offer job candidates the opportunity to be included in our talent pool for a period of two years. In this case, the following information is added to the general information on the application procedure:

Candidates are informed that their consent to be included in the talent pool is voluntary, has no influence on the current application process and they can revoke this consent at any time for the future and declare their objection within the meaning of Art. 21 GDPR.

Wellfound (formerly AngelList (angel.co))

WellfoundAngelList offers a  talent platform which we use for recruiting purposes. We also use their integration with Deel and Workable.

BambooHR

We use BambooHR for keeping track of the employees’ and job candidates’ data, employee self-onboarding and other HR-related tasks.

Deel

We use an international recruitment and payroll service offered by Deel.

Webserver and Security

Our services are operated on web servers. In the following section we will inform you about their use and data processed during the operation of our servers.

Amazon Web Services

We use Amazon Web Services including infrastructure and platform services, computing capacity, storage and database services, telecommunications services, security services, technical maintenance services, and cloud hosting services.

Hetzner

Hetzner is an Internet hosting company and data center operator. We use Hetzner’s infrastructure and platform services, computing capacity, storage and database services, security services, technical maintenance services

Cloudflare

Cloudflare provide hosting and content delivery network, DDoS mitigation, internet security and distributed domain name server services. Our complete Project Traffic is routed through Cloudflare.

Godaddy

Domain name registrar and web hosting services.

Google Suite and Google Cloud

We use the Google Cloud and the Google Suite Service for the following purposes: Google Drive for document storage (marketing, sales, evaluations, accounting, personnel, contracts, finance), Google Calendar for calendar management - Google Docs, spreadsheets and presentations for online document collaboration; storage of data, websites and public documents.

MongoDB Atlas

MongoDB Atlas is a cloud-based DaaS (Data as a service) solution offered by MongoDB.

New Relic

New Relic provides a digital intelligence platform lets developers, ops, and tech teams measure and monitor the performance of their applications and infrastructure. We use New Relic services for server and application monitoring.

Raygun

Raygun provides error, crash and performance monitoring for software teams. We use Raygun as PHP error and exception handler.

SolarWinds Worldwide, LLC (Pingdom and Papertrail)

We use the services of SolarWinds (Pingdom and Papertrail) to monitor the performance of our websites and to determine how changes we make to our websites affect visitor experience.

Sophos Managed Detection and Response

Cybersecurity service that provides threat detection, investigation, and response capabilities to quickly identify and mitigate potential security breaches.

Embedded content and functions

In this section we inform you which contents, software or functions (briefly "contents") of other providers we embed in the context of our website on the basis of Art. 6(1)(f) GDPR (so-called "embedding"). If we ask users to give their consent to the use of the Services (e.g. in the context of a so-called cookie opt-in), the use is based on consent in accordance with Art. 6 (1) (a) GDPR.

The embedding is done to make our online offer more interesting for our users or for legal reasons, e.g. to be able to present videos or social media contributions within our online offer at all. Embedding can also be used to improve the speed or security of online content, e.g. when software elements or fonts are obtained from other sources. The processed data includes in all cases the user's usage and metadata and also the IP address necessarily transmitted to the provider for embedding the content, the data subjects include the visitors to our website. The data subject categories include the users of our website, users and interested parties. Further explanations can be found in the definitions of terms, in particular on the functions and security measures, at the end of this Privacy Policy. The data retention is determined by the data protection conditions of the providers of the embedded content.

Ex.co (former Playbuzz) content distribution

Playbuzz is a content partner with whose help we can present relevant content for the users within our online services. Playbuzz itself states that no personal user data will be stored or otherwise processed by Playbuzz itself.

Facebook Features and Content

Functions and contents of the Facebook service can be integrated within our online services. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

We are jointly responsible (so-called "joint-controllership") with Meta Platforms Ireland Limited for the collection or transmission (but not further processing) of "Event Data" that Facebook collects or receives as part of a transmission using the Facebook Social Plugins that run on our website for the following purposes: a) displaying content advertising information that matches users' presumed interests; b) delivering commercial and transactional messages (e.g. b) delivering commercial and transactional messages (e.g., addressing users via Facebook Messenger); c) improving ad delivery and personalizing features and content (e.g., improving recognition of which content or advertising information is believed to be of interest to users). We have entered into a special agreement with Facebook ("Controller Addendum", https://www.facebook.com/legal/controller_addendum), which specifically addresses the security measures that Facebook must take (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to comply with the rights of data subjects (i.e., users can, for example, submit information access or deletion requests directly to Facebook). Note: If Facebook provides us with measurements, analyses and reports (which are aggregated, i.e. do not contain information on individual users and are anonymous to us), then this processing is not carried out within the scope of joint responsibility, but on the basis of a DPA ("Data Processing Terms", https://www.facebook.com/legal/terms/dataprocessing/update), the "Data Security Conditions" (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of Standard Contractual Clauses ("Facebook EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular to access to information, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook.

Giphy features and content

Functions and contents of the Giphy service can be integrated within our online services. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

Google Services and Content

We use the following services and contents of the provider Google: YouTube - Videos; Google Maps - Maps; Google Fonts - Fonts; Google - Recaptcha.

Imgur features and content

Functions and contents of the Imgur service can be integrated within our online services. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

Instagram Features and Contents

Functions and contents of the Instagram service can be integrated within our online offer. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

We are jointly responsible (so-called "joint-controllership") with Meta Platforms Ireland Limited for the collection or transmission (but not further processing) of "Event Data" that Facebook collects or receives as part of a transmission using Instagram functions that run on our website for the following purposes: a) displaying content advertising information that matches users' presumed interests; b) delivering commercial and transactional messages (e.g. b) delivering commercial and transactional messages (e.g., addressing users via Facebook Messenger); c) improving ad delivery and personalizing features and content (e.g., improving recognition of which content or advertising information is believed to be of interest to users). We have entered into a special agreement with Facebook ("Controller Addendum", https://www.facebook.com/legal/controller_addendum), which specifically addresses the security measures that Facebook must take (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to comply with the rights of data subjects (i.e., users can, for example, submit information access or deletion requests directly to Facebook). Note: If Facebook provides us with measurements, analyses and reports (which are aggregated, i.e. do not contain information on individual users and are anonymous to us), then this processing is not carried out within the scope of joint responsibility, but on the basis of a DPA ("Data Processing Terms", https://www.facebook.com/legal/terms/dataprocessing/update), the "Data Security Conditions" (https://www.facebook.com/legal/terms/data_security_term ) and, with regard to processing in the USA, on the basis of Standard Contractual Clauses ("Facebook EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular to access to information, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook.

Pinterest features and content

Functions and contents of the Pinterest service can be integrated within our online offer. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

Reddit features and content

Functions and contents of the Reddit service can be integrated within our online offer. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

Rumble features and content

Functions and contents of the Rumble service can be integrated within our online services. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

TikTok features and content

Functions and contents of the Tiktok service can be integrated within our online services. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

Twitter features and content

Functions and contents of the Twitter service can be integrated within our online services. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

video intelligence video player

Video player embedded in our web pages.

Sharing graphics with Snapchat

As part of our services, we offer users the opportunity to share graphics generated by us via the Snapchat platform. For these purposes we ask for the first name of the users, which is then integrated into the generated graphic. The graphic is stored on our server without personal reference, i.e. without IP addresses or other individualizing features (except for the first name, which itself does not allow identification). For the processing of the data by Snapchat, we refer to the data protection regulations of the provider.

WhatsApp features and content

Within our online services, functions and contents of the WhatsApp-Messenger can be incorporated. This may include, for example, content such as images, videos or texts and buttons with which users can express their appreciation of the content, subscribe to the authors of the content or our contributions.

External online profiles

In this area you will find information about our data processing in the context of operating external online activities, e.g. in social media.

Online Presences in Social Media

We maintain online presences within social networks and platforms in order to communicate with the customers, prospective customers and users active there and to be able to inform them about our services there.

We would like to point out that data of users outside the European Union and the Switzerland may be processed. This can pose risks for users because, for example, the enforcement of users' rights could be made more difficult. Furthermore, user data is usually processed for market research and advertising purposes. Thus, for example, user profiles can be created from the user behaviour and the resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements inside and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the user's computer, in which the user's usage behaviour and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to these).

The processing of users' personal data is based on our legitimate interests in effective user information and communication with users. If the users are asked by the respective providers for a consent to the data processing (i.e. declare their consent e.g. by ticking a checkbox or confirming a button), the legal basis of the processing is a consent.

For a detailed description of the respective processing and the possibilities of objection (opt-out), we refer to the information provided by the providers linked below.

Also in the case of requests for information and the assertion of user rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, then please contact us.

Organization and Marketing

In this section you will find information on data processing carried out by us for the purpose of optimising our marketing and market research activities, as well as managing our ventures.

ADYOULIKE

ADYOULIKE is a technology partner with whom we manage the real-time display of ads on our online services.

Amazon Publisher Services

With the help of Amazon we market advertising material and advertising spaces within our online services.

Appnexus

Appnexus is a technology partner with whom we manage the real-time display of ads on our online services.

Bitly

Bitly is a URL shortening service and a link management platform.

ContractHero

We use contract management software provided by ContractHero.

DocuSign

DocuSign provides a digital transaction management platform to facilitate digital transactions that include the signing process of contractual documents and other documents.

Easycompliance

Easycompliance is utilized for conducting a matching process that involves comparing the names of individuals and businesses against various sanctions lists, including but not limited to the European Union and/or Reguvis (Haddex sanctions lists) and/or OFAC (US-SDN / NONSDN) and/or info4c's PEPDESK database. The purpose of this process is to identify any potential matches and ensure compliance with relevant regulations.

Harvest (Iridesco, LLC)

We are using a time tracking tool provided by Harvest (Iridesco, LLC).

Hootsuite

Hootsuite is a social media management platform that offers a number of integrating solutions for measuring & benchmarking, performance optimization, visualization & analyse, creating and publishing content and nurturing communities.

Taboola

Taboola develops and markets service for online content publishers and advertisers that recommends digital content to website users. We use Taboola Content Discovery Platform as a cross-promotion tool.

Teads content distribution

With the help of Teads we market advertising material and advertising spaces within our online services.

Yieldlove

Yieldlove is a technology partner with whom we manage the placement of ads on our online services. Yieldlove's service includes other technology partners, for whose use consent is obtained (on the legal basis of the "IAB Europe Transparency & Consent Framework Policies" https://iabeurope.eu/iab-europe-transparency-consent-framework-policies/). The exact information is provided to the users in the course of obtaining a so-called "Cookie-Consent-Layer".

An agreement on so-called joint responsibility has been concluded between and and Yieldlove (Article 26 GDPR). This means that we are jointly responsible for the processing (in particular the collection of data and its transmission to Yieldlove) in accordance with the law due to the use of Yieldlove. However, since Yieldlove is solely responsible for the technical implementation and we are not technically involved in the processing procedures (and in particular have no access to user data), Yieldlove assumes the internal responsibility for the technical processes and the fulfilment of data subject rights. For further information, please do not hesitate to contact us.

Newsletter Mailing and Performance Measurement

We will only send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter "newsletters") with the consent of the recipients or a legal permission. Subscribers' data is logged as we are required to provide documentation of registrations. We also keep track of whether newsletters have been opened and whether links have been clicked. This information is stored on a per-user basis for technical reasons, but is not used to monitor individual users, but rather, for example, to adapt content and services to users. Information that we should collect in addition to the e-mail address (e.g. name) is used to personally address the users or to adapt the contents of the newsletter to the users.

Communication via Mail, E-Mail, Fax or Telephone

Sending information material, contacting us by telephone.

Sweepstakes and Competitions

Optimization

In this section you will find information on data processing carried out by us for the purpose of optimising our website. Above all, it serves us to improve the usability and functionality of the website.

Amazon Personalize

We use the Amazon Personalize service to optimize a better user experience of Facebook instant games and related messenger bots, e.g. optimized content recommendations, better quiz results, ideal sending time, ideal content and ideal frequency for notifications, etc.

Google Firebase

We use Google Firebase to enable users of our games on Facebook to keep their own guestbook where their friends can post entries and save results for the quizzes and games they have participated in.

 ·         

Web analytics, online marketing and technology partners

In this section we inform you which services of technology partners are used for web analytics and online marketing purposes. If we ask users for their consent (e.g. in the context of a so-called "cookie banner consent"), the legal basis for processing data for online marketing purposes is this consent. Otherwise, user data will be processed on the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online services. In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.. Further explanations can be found in the definitions of terms, in particular on the functions and security measures, at the end of this Privacy Policy. The retention of the data is determined, unless otherwise stated, in accordance with the Privacy Policies of the technology partners.

Advanced Analytics

Analytics software that we use to measure usage and interaction with our services on or in connection with Meta platforms (by means of so-called events, such as viewing posts or clicking "Like" buttons) and to obtain demographic data about our users (e.g., age average, place of residence, language used). User data is processed by Meta for the purpose of displaying content and ads based on users' presumed interests based on user profiles. The data is only provided to us in aggregated, i.e. summarized form, so that we do not see the data of individual users. We use the results to design our content and services in a user-oriented manner.

Branch Metrics, Inc.

Branch Metrics provides a deep-link feature that allows links to be included that lead to specific sub-pages of an online service or app without directing users to the main page or with the ability to link to an app instead of a less usable mobile website. At the same time, the links can be better analyzed, which in turn allows us to better tailor the content to the users' needs. We are just using the free deep-linking feature of this service: https://branch.io/glossary/deep-linking/ and do not use it for advertising purposes.

Criteo

We use Criteo's services for personalized marketing purposes, e.g. to display advertisements within other websites based on the presumed interests of users or products already seen..

e-dialog GmbH

Search engine optimization (SEO), Optimization, Management of Google Services. Please note: Google Services are used in a sub-subprocessing relationship, e-dialog GmbH is the direct subprocessor.

Google Tag Manager

Google Tag Manager is a tool that allows us to manage so-called website tags via an interface (and thus integrate Google Analytics and other Google marketing services into our online serviced,). The Tag Manager itself (which implements the tags) does not process any personal data of the users. With regard to the processing of users' personal data, reference is made to the following information on the Google services. Usage guidelines: https://www.google.com/intl/de/tagmanager/use-policy.html.  

Google Analytics

We use Google Analytics to perform measurement and analysis of the use of our online services by users based on a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It is used to assign analysis information to an end device in order to recognize which content users have accessed within one or various usage processes, which search terms they have used, have accessed again or have interacted with our online services. Likewise, the time of use and its duration are stored, as well as the sources of users referring to our online services and technical aspects of their end devices and browsers. In the process, pseudonymous profiles of users are created with information from the use of various devices, and cookies may be used. In Analytics, higher level geographic location data is provided by collecting the following metadata based on IP search: "city" (and the derived latitude and longitude of the city), "continent", "country", "region", "subcontinent" (and the ID-based equivalents). To ensure the protection of user data in the EU, Google receives and processes all user data via domains and servers within the EU. The IP address of users is not logged and is shortened by the last two digits by default. The shortening of the IP address takes place on EU servers for EU users. In addition, all sensitive data collected from users in the EU is deleted before it is collected via EU domains and servers.

We use Google Analytics also to display ads placed by Google and its partnersonly to users who have shown an interest in our online services or who have specific characteristics (e.g. interests in specific topics or products determined on the basis of the websites visited) that we transmit to Google (so-called "Remarketing Audiences" or "Google Analytics Audiences"). With the help of remarketing audiences, we also want to ensure that our ads match the potential interest of users

Google Ads/ AdWords

We use Google AdWords to place ads  to measure the success of the ads we place on Google's and Google partner's websites.

Google Doubleclick

We use Google Doubleclick to place ads and to measure the success of the ads we place on Google's and Google partner's websites.

Google AdMob

We use Google AdMob to measure the success of ads in mobile applications.

Facebook Pixels and Custom Audiences

We use the Facebook pixel to form target groups and measure the success of the ads we place on Facebook and to build target groups for ads.

With the help of the Facebook pixel  (or equivalent functions, to transfer Event-Data or Contact Information via interfaces or other software in apps), Facebook is on the one hand able to determine the visitors of our online services as a target group for the presentation of ads (so-called "Facebook ads"). Accordingly, we use Facebook pixels to display Facebook ads placed by us only to Facebook users and within the services of partners cooperating with Facebook (so-called "audience network" https://www.facebook.com/audiencenetwork/) who have shown an interest in our online services or who have certain characteristics (e.g. interests in certain topics or products that are determined on the basis of the websites visited) that we transmit to Facebook (so-called "custom audiences"). With the help of Facebook pixels, we also want to ensure that our Facebook ads correspond to the potential interest of users and do not appear annoying. The Facebook pixel also enables us to track the effectiveness of Facebook ads for statistical and market research purposes by showing whether users were referred to our website after clicking on a Facebook ad (known as "conversion tracking").

We are jointly responsible (so-called "joint-controllership") with Meta Platforms Ireland Limited for the collection or transmission (but not the further processing) of "event data" that Facebook collects or receives as part of a transmission for the following purposes using the Facebook pixel and comparable functions (e.g. APIs) that are implemented in our online services: a) displaying content advertising information that matches users' presumed interests; b) delivering commercial and transactional messages (e.g. b) delivering commercial and transactional messages (e.g., addressing users via Facebook Messenger); c) improving ad delivery and personalizing features and content (e.g., improving recognition of which content or advertising information is believed to be of interest to users). We have entered into a special agreement with Facebook ("Controller Addendum", https://www.facebook.com/legal/controller_addendum), which specifically addresses the security measures that Facebook must take (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to comply with the rights of data subjects (i.e., users can, for example, submit information access or deletion requests directly to Facebook). Note: If Facebook provides us with measurements, analyses and reports (which are aggregated, i.e. do not contain information on individual users and are anonymous to us), then this processing is not carried out within the scope of joint responsibility, but on the basis of a DPA ("Data Processing Terms", https://www.facebook.com/legal/terms/dataprocessing), the "Data Security Conditions" (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of Standard Contractual Clauses ("Facebook EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular to access to information, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook.

OpenX

OpenX Services include the Ad Exchange, a Web-based marketplace that enables publishers, advertisers, and ad networks to efficiently market, buy and sell digital and mobile advertising and ad inventory. OpenX also offers services, such as the Ad Server, through which OpenX acts as a service provider to enable Publishers, advertisers, ad networks, and other clients to manage their advertising inventory and to collect and use data to provide advertising on their digital and mobile properties and across the Internet. In this case, Publishers may use our services to process data, which they collect or source.

Outbrain

We use the Outbrain service for personalised marketing purposes, e.g. to display advertisements within our websites based on the presumed interests of users.

Snap Pixel

With the help of Snap Pixels we can see if our marketing activities within the Snapchat app have sparked the interest of users in our services.The snap pixel is used by us in the context of the online service https://stickertest.com/ and www.testony.com .

Supermetrics

We use Supermetrics marketing add-on to report, monitor and analyse our marketing campaigns.

Taboola

We use the Taboola service for personalised marketing purposes, e.g. the presentation of advertisements within other online offers based on the presumed interests of users.

Webflow

We use Webflow services to build static websites, which may include online forms.

Profiles in Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may entail risks for users, e.g. by making it more difficult to enforce users' rights.

In addition, user data is usually processed within social networks for market research and advertising purposes. For example, user profiles can be created on the basis of user behaviour and the associated interests of users. The user profiles can then be used, for example, to place advertisements within and outside the networks which are presumed to correspond to the interests of the users. For these purposes, cookies are usually stored on the user's computer, in which the user's usage behaviour and interests are stored. Furthermore, data can be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective networs or will become members later on).

For a detailed description of the respective processing operations and the opt-out options, please refer to the respective data protection declarations and information provided by the providers of the respective networks.

Also in the case of requests for information and the exercise of rights of data subjects, we point out that these can be most effectively pursued with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need help, please do not hesitate to contact us.

Facebook: We are jointly responsible (so called "joint controller") with Meta Platforms Ireland Limited for the collection (but not the further processing) of data of visitors to our Facebook page. This data includes information about the types of content users view or interact with, or the actions they take (see "Things that you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), and information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie information; see "Device Information" in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under "How we use this information?" Facebook also collects and uses information to provide analytics services, known as "page insights," to site operators to help them understand how people interact with their pages and with content associated with them. We have concluded a special agreement with Facebook ("Information about Page-Insights", https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular the security measures that Facebook must observe and in which Facebook has agreed to fulfill the rights of the persons concerned (i.e. users can send information access or deletion requests directly to Facebook). The rights of users (in particular to access to information, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information about Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data).

Section IV - Definitions

This section provides an overview of the terms used in this Privacy Policy. Many of the terms are taken from the law and defined above all in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are intended primarily for understanding. The terms are sorted alphabetically.