We, as the provider/operator of the wefeel app (the "App"), are the controller within the meaning of applicable data protection law, in particular the General Data Protection Regulation ("GDPR"), for the processing of personal data of the user ("you") of the App.
Personal data is defined in the GDPR as any information relating to an identified or identifiable natural person.
Below we inform you, in a clear and structured manner as part of our information obligations (Art. 13 et seq. GDPR), about which personal data is processed when using our App, in what way, and on what legal basis. We also inform you about the rights you have against us and against the competent supervisory authority.
Kindori LLC
30 N Gould St Ste N
Sheridan, Wyoming 82801
USA
Phone: +49 (0) 173 8347395
Email: privacy@kindori.com
Katharina Schäfer
Phone: +49 (0) 173 8347395
Email: privacy@kindori.com
You can download our App from an app store of your choice (Apple App Store or Google Play Store, hereinafter "Store") onto a suitable device (hereinafter generally "smartphone"). When downloading our App onto your smartphone, the information necessary for this purpose is transmitted to the respective Store, in particular your Store username, email address and customer number, the time of the download, payment information, and the individual device identifier. We have no influence over this data collection and are not responsible for it. We only process this data to the extent necessary for downloading the App onto your smartphone. Beyond this, we do not store or otherwise process this data.
The legal basis for this processing is Art. 6(1)(1)(f) GDPR, as it is in our legitimate interest to enable you to download and install the App by processing the data required for this purpose.
Our App is operated on the servers of Amazon Web Services EMEA SARL, a subsidiary of Amazon Web Services Inc. (hereinafter "AWS"). This means that the data we collect during general use of our App is, in the first instance, stored in Germany and thus within the EU.
The legal basis for this processing of your personal data is Art. 6(1)(1)(f) GDPR, as it is in our legitimate interest to use the services of a professional provider for the secure and efficient provision of our App.
We have entered into a data processing agreement with Amazon Web Services EMEA SARL in accordance with Art. 28 GDPR. The server location is Frankfurt am Main, Germany.
An internet connection is established while using our App.
In doing so, we collect and process many different types of personal data, in particular data that you actively enter (e.g. message content) as well as data generated by the targeted use of individual App functions (e.g. starting a session). Processing this personal data is technically necessary to comfortably provide you with the functions of the App you use, as well as to ensure the stability and security of our information technology systems.
The following personal data may be processed when a session starts:
If you use additional functions of our App, personal data required for the function you have selected is processed in addition to the data mentioned above, such as:
The specific personal data processed is therefore transparent from your respective interaction with the App. It is generally possible to associate such data with you as a person.
However, we only store this data temporarily. As soon as the data is no longer required to achieve the purposes mentioned above, we delete it without delay. The storage period therefore depends on the category of data.
In general, we delete your personal data from our live system without delay when you delete your user account with us. After deletion of the user account, we only retain pseudonymous data for statistical evaluation of App usage that is not attributable to individual users, as well as data we need to comply with our legal obligations (e.g. tax obligations). Processing this data is necessary to provide our App with its various modern functions. The legal basis is therefore our legitimate interest pursuant to Art. 6(1)(1)(f) GDPR. For individual functions, we may rely on your consent pursuant to Art. 6(1)(1)(a) GDPR. Insofar as we have contractually committed to providing the App to you, the legal basis for data processing for which we do not obtain consent is the performance of the contract pursuant to Art. 6(1)(1)(b) GDPR. Storage of data based on our legal obligations is based on Art. 6(1)(1)(c) GDPR.
To use our App, you must register as a user. To do so, you must provide us with the following information:
We process this data for the purpose of providing the functions associated with your account, i.e. for the performance of a contract with you pursuant to Art. 6(1)(1)(b) GDPR. A further legal basis is our legitimate interest pursuant to Art. 6(1)(1)(f) GDPR.
You also have the option of registering in the App using social login via an existing Google or Apple account. In this case, we additionally process the email address you have stored with Google or Apple, on top of the data mentioned above. In this case, Google or Apple receives the information that you have registered or logged in to our App. It is possible that Google or Apple processes further personal data in this context, for example about your smartphone, as part of a usage profile, and uses this for purposes such as advertising or market research. You have a right to object to this, which you must exercise against Google or Apple. We would like to point out that the use of social login is voluntary. Our offering of such a login as a voluntary option is based on the legitimate interest within the meaning of Art. 6(1)(1)(f) GDPR of offering low-threshold registration options on request.
When using the App, you may also optionally provide further information about yourself in your profile and exchange information with other users via the community feature about yourself, your emotional fitness, and how you deal with stressful situations. Furthermore, in the check-in feature you can provide information about your emotional state (as well as accompanying circumstances such as time and situation), which we then collect in the journal feature. As part of the exercise features offered in the App, you can also provide information such as personal goals or achievements, for example. None of this information is mandatory; providing it is entirely at your discretion. The legal basis for processing simple information is likewise the performance of the contract with you pursuant to Art. 6(1)(b) GDPR as well as our legitimate interest pursuant to Art. 6(1)(f) GDPR. Because the information you provide in your profile, in posts or messages to other users, in the check-in feature, or as part of the exercise features may also constitute sensitive data, or may allow conclusions to be drawn about your emotional fitness and thus your mental health as particularly sensitive personal information, we ask for your consent during registration to the processing of this particularly sensitive data, in case you wish to provide such information. The legal basis is therefore your consent pursuant to Art. 9(2)(a) GDPR, in addition to Art. 9(2)(e) GDPR. This consent can be withdrawn at any time.
When we process your data, you are a "data subject" within the meaning of the GDPR. You have the following rights: the right of access, the right to rectification, the right to restriction of processing, the right to erasure, the right to be notified, and the right to data portability. In addition, you have a right to object, a right of withdrawal, and the right to lodge a complaint with the supervisory authority.
Below you will find some details on the individual rights:
You have the right to obtain confirmation from us as to whether we process your personal data. If we process your personal data, you have the right to obtain information in particular about the purposes of processing, the categories of personal data, the recipients or categories of recipients, and, where applicable, the storage period.
You have the right to rectification and/or completion of the data we have stored about you if this data is inaccurate or incomplete. We will carry out the rectification or completion without delay.
Under certain conditions, you have the right to request that we restrict the processing of your personal data. One example of this is where you contest the accuracy of your personal data and we need a certain period to verify its accuracy. For the duration of this verification, your data is only processed to a limited extent. Another example of restriction is where we no longer need your data, but you need it for the establishment, exercise, or defense of legal claims.
In certain situations, you have the right to request that we delete your personal data without delay. This is the case, for example, if we no longer need your personal data for the purposes for which we collected it, or if we have processed your data unlawfully. Another example would be that we process your data based on your consent, you withdraw your consent, and we do not process the data on any other legal basis. However, your right to erasure does not always exist. For example, we may process your personal data to comply with a legal obligation, or because we need it for legal proceedings.
If you have exercised your right to rectification, erasure, or restriction against us, we are obliged to notify all recipients to whom we have disclosed your personal data of the rectification, erasure, or restriction of processing of your data, unless this proves impossible or involves disproportionate effort.
Under certain conditions, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and the right to have this data transmitted to another controller. This applies where we process the data either based on your consent or based on a contract with you, and where we process the data using automated procedures.
You also have the right to have us transmit your personal data directly to another controller, insofar as this is technically feasible and does not adversely affect the rights and freedoms of others.
For reasons arising from your particular situation, you have the right to object at any time to the processing of your personal data based on Art. 6(1)(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.
Following an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
If we process your personal data for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing. This also applies to profiling insofar as it is related to such direct marketing. If you object to the processing of your personal data for direct marketing purposes, we will no longer process it for these purposes.
Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.
You have the right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy. In particular, you may lodge a complaint in the member state of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.
An overview of the respective state data protection authorities and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html