Privacy Policy for the StatHubs App

The protection of your personal data is a high priority for Profihost GmbH. With this data protection notice, we inform you about the type, scope and purposes of the processing of personal data in connection with the use of the StatHubs app (hereinafter referred to as the "App").

Personal data is any information relating to an identified or identifiable natural person. The processing of personal data is carried out exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

1. Controller and Data Protection Officer

The controller for the processing of personal data in connection with the use of the App is:

Profihost GmbH, Hildesheimer Straße 25, 30880 Laatzen, GermanyPhone: +49 511 899555-10E-mail: service@profihost.com

If you have any questions about data protection, you can reach the data protection officer of Profihost GmbH at datenschutz@profihost.com.

2. Information on the processing of personal data

When using the app, various personal data is processed. In the following, we inform you about which data is processed, for what purposes this is done and on what legal basis the processing is based.

In particular, users of the app, persons who register or log in to use the app, interested parties and contact persons of customers and business partners may be affected by the processing operations described below.

2a. Data processing when downloading the app

When downloading the app from the Apple App Store or the Google Play Store, certain information may be transmitted to the respective app store operator. This may include, but is not limited to, the username, email address, your account customer number, the time of download, payment information, and unique device identifiers.

The processing of personal data in connection with the registration, provision and download of the App via the respective App Store is carried out exclusively by the operator of the respective App Store. We have no influence on this data processing. The respective app store provider is solely responsible for this.

Further information on data processing can be found in the data protection information of the respective app store operator.

2b. Data processing based on access rights of the App

In order to provide individual functions of the App, it may be necessary to access certain functions of your device. Access is exclusively based on your previously given consent in accordance with Art. 6 (1) (a) GDPR.

You can revoke your consent at any time with effect for the future. This does not affect the lawfulness of the processing carried out until the revocation.

Accessing the device's memory

The app can store content selected by you on your device. To do this, the app needs access to your device's memory.

Access is based exclusively on your consent in accordance with Art. 6 (1) (a) GDPR.

Access to location data

The App may collect location data if the App is actively used and you have given the necessary permission to do so.

According to the previous range of functions, the processing of location data serves in particular to improve the user-friendliness of the app, including the display of delivery and pick-up locations. In addition, location data of users interested in accepting delivery or collection orders can be linked to location data of corresponding orders in order to indicate suitable orders to users in their vicinity.

The processing is carried out on the basis of your consent in accordance with Art. 6 (1) (a) GDPR.

Revocation of device permissions

You can change or revoke granted device permissions at any time via the settings of your device.

On Android, this is usually done via the device's settings under the "Permissions" menu item. On iOS, permissions can be managed in the privacy settings of the operating system.

Uninstalling the app basically removes device permissions granted.

2c. Data collected automatically

When using the App, certain technical data is automatically processed to the extent necessary for the operation and provision of the App.

This may include, but is not limited to:- internal device ID- operating system version- hardware model- device IP address- time of access- operating system and version- software information- preferred language settings- unique device identifiers

This data is processed in order to enable the use of the App and its functions, to improve the performance and stability of the App, and to detect, prevent and remedy misuse and malfunctions.

The processing is carried out on the basis of Art. 6 (1) (b) GDPR, insofar as the processing is necessary for the performance of the user contract, as well as on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest is to ensure secure, stable and user-friendly operation of the app.

2d. Registration and Login

When you create a user account or log in, we process the data you provide in order to provide you with access to your user account, to manage it and to enable the use of the app in accordance with the contract.

Mandatory information in the context of registration is marked accordingly and is necessary for the conclusion and execution of the user contract. Mandatory information may include, in particular, surname, first name, date of birth, e-mail address, home or business address, telephone number, password and payment data in connection with Google Play or the Apple App Store. Without the provision of this information, no user account can be created.

We use the data collected in the course of registration and login in particular for authentication at login, to process requests for password reset, to check your eligibility to use and manage the user account, to enforce the terms of use and to communicate with you in connection with your user account. This includes, but is not limited to, technical notices, legal information, security messages, updates and other communications required for the use of the App.

Alternatively, registration or login can be done via existing user accounts from Microsoft, Apple or Google. If you choose such a registration method, we will receive the information that the respective provider provides to us as part of the registration process. This may include, but is not limited to, your name, email address, user ID, and other account information that you have approved for registration.

Further information can be found in the data protection notices of the respective providers:

Microsoft: https://privacy.microsoft.com/de-de/privacystatement

Apple: https://www.apple.com/de/legal/privacy/

Google: https://policies.google.com/privacy

This data is processed for the purpose of authentication, setting up and managing your user account, and providing you with the login method you have chosen. The respective provider is responsible for the processing of personal data in connection with your user account with Microsoft, Apple or Google. Further information on this can be found in the data protection information of the respective provider.

The processing of the data collected in the course of registration, login and account management is carried out on the basis of Art. 6 (1) (b) GDPR, insofar as it is necessary for the execution of the user contract or pre-contractual measures, as well as on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest is to ensure the safe, orderly and functional operation of the App. If the respective provider or operating system requires separate consent to the data transfer, the processing will also be carried out on the basis of your consent in accordance with Art. 6 (1) (a) GDPR.

2e. Data processing when using the App

As part of using StatHubs, you can enter, store and manage various information within the app.

This includes, in particular, data that you transmit to the app in connection with the registration and connection of your online shop within a space. This includes, for example, access data and connection information to connected systems and services such as Magento, Shopware, Shopify, Oxid, Amazon, eBay, Google Analytics, Google Ads, Facebook or YouTube.

According to the intended range of functions, this does not include any personal data of your customers or other data subjects. Rather, anonymised or aggregated information is processed, such as order and shopping basket data, sales data, traffic and visitor information as well as comparable statistical key figures.

When using fee-based functions, billing-related payment data may also be processed insofar as this is necessary for the provision and billing of the respective services. Payment is processed by the respective app store provider.

Furthermore, technical usage information may be processed in the context of use. This includes, in particular, the date and time of access, functions and content accessed, information about app crashes, system activities and information about the browser or device used.

This data is processed in order to provide the contractually agreed services, to enable the use of the app and to ensure the stability, security and functionality of the app.

The processing is carried out on the basis of Art. 6 (1) (b) GDPR, insofar as the processing is necessary for the performance of the user contract, and on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest is to ensure secure, error-free and user-friendly operation of the app.

3. Disclosure of data

a. Principles of data sharing

Your personal data will only be passed on to third parties in the cases described below.

In particular, a transfer may take place if you have given your express consent to this in accordance with Art. 6 (1) (a) GDPR, if the disclosure is necessary for the assertion, exercise or defence of legal claims in accordance with Art. 6 (1) (f) GDPR, if there is a legal obligation under Art. 6 (1) (c) GDPR or if the disclosure is necessary for the performance of a contractual relationship in accordance with Art. 6 (1) (b) GDPR.

b. Disclosure to external service providers

Insofar as fee-based services are used within the app, personal and billing-related data may be passed on to external service providers insofar as this is necessary to carry out payment processing.

The processing is carried out on the basis of Art. 6 (1) (b) GDPR. In particular, the information required to make in-app payments is affected. Payment is processed via Google Play or the Apple App Store.

The respective service providers may only use the transmitted data in the context of the respective provision of services and are obliged to process the data confidentially and securely.

Further information on data processing by the respective providers can be found in their privacy policies:- Google: https://policies.google.com/privacy?hl=de- Apple Support: https://support.apple.com/de-de/HT211970- Apple Data Protection: https://www.apple.com/de/privacy/

In addition, data may be transmitted to third-party providers in the context of the use of integrated plugins or technical extensions, insofar as this is necessary for the provision, security, functionality or user-friendly use of the app.

In these cases, the processing is carried out on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest is to ensure that the app is functional, safe and user-friendly. Insofar as consent is required for individual processing, the processing is carried out on the basis of Art. 6 (1) (a) GDPR. It cannot be ruled out that individual service providers may also process personal data outside the European Union or the European Economic Area.

For the provision, maintenance, further development and technical support of the App, we may use external technical service providers and processors. In particular, Profihost GmbH, based in Germany, can be used as a technical service provider for the development, operation, support and maintenance of the StatHubs app.

Insofar as such service providers gain access to personal data in the course of their activities or process personal data on our behalf, this is done exclusively on the basis of a data processing agreement in accordance with Art. 28 GDPR and in compliance with the applicable data protection requirements.

The service providers may only process personal data in accordance with our instructions and to the extent necessary for the provision of services.

Insofar as we commission third parties to process personal data, this is done exclusively on the basis of corresponding contractual agreements and in compliance with the requirements of Art. 28 GDPR.

c. Data transfer within the group.one group of companies

Profihost GmbH is part of the group.one group of companies.

Insofar as this is necessary for administrative purposes, for the fulfilment of contractual services, for the provision of technical services or for the protection of legitimate interests, personal data may be transmitted to other companies within the group.one group of companies or made available to them.

The transfer will be carried out exclusively in accordance with the applicable data protection regulations and only to the extent that there is a corresponding legal basis for this, in particular in accordance with Art. 6 (1) (b) or (f) GDPR.

d. Data processing in third countries

Insofar as personal data is transmitted to or processed by service providers or systems outside the European Union (EU) or the European Economic Area (EEA) in the course of using the App, this is done exclusively in compliance with the legal requirements of Art. 44 et seq. GDPR.

A transfer to third countries will only take place if there is an adequacy decision of the European Commission for the country in question, suitable safeguards such as standard contractual clauses have been agreed or there is another legally permissible basis for the data transfer.

To the extent required by law, users will be informed separately about details of such data transfer.

4. Storage period

We only store personal data for as long as is necessary for the respective processing purposes or as long as there are statutory retention obligations.

Personal data is usually stored for the duration of the user or contractual relationship. After termination of the contractual relationship, the data will be deleted or anonymized, provided that no statutory retention obligations or legitimate interests oppose deletion.

In addition, backup copies may be retained for a period of up to three years after the termination of the contractual relationship, insofar as this is necessary to secure, assert or defend legal claims.

Statutory retention obligations under commercial and tax law remain unaffected.

5. Your rights as a data subject

You are entitled to the statutory rights under the GDPR. These include, in particular:

• the right to information in accordance with Art. 15 GDPR in conjunction with § 34 BDSG,- the right to rectification in accordance with Art. 16 GDPR,- the right to erasure in accordance with Art. 17 GDPR in conjunction with § 35 BDSG,- the right to restriction of processing in accordance with Art. 18 GDPR,- the right to data portability in accordance with Art. 20 GDPR,- the right to object in accordance with Art. 21 GDPR and - the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR in conjunction with § 19 BDSG.

If personal data is processed on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing on grounds relating to your particular situation. If the processing is carried out for the purpose of direct marketing, there is a right to object at any time without giving special reasons.

If the processing of personal data is based on consent, you can revoke this consent at any time with effect for the future. This does not affect the lawfulness of the processing carried out until the revocation.

To exercise your rights, you can contact us at any time using the contact details provided in this Privacy Policy.

6. Data security

We use appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other unauthorised processing.

For the transmission of personal data between the App and our systems, we use state-of-the-art encryption methods.

Our security measures are continuously reviewed and further developed in line with technological developments.

7. Up-to-dateness and modification of this data protection information

This data protection notice applies to the use of the StatHubs app in its current version.

Due to the further development of the app, technical changes or changed legal or official requirements, it may be necessary to adapt this data protection notice.

The current version of the data protection information can be accessed at any time within the app and on the provider's website.

8. Account deletion

You can request the deletion of your StatHubs account and the personal data associated with it at any time.

To request account deletion, please send an email to info@stathubs.com using the email address associated with your StatHubs account. Please state clearly that you would like your StatHubs account to be deleted.

After your request has been verified, your StatHubs account and the personal data associated with it will be deleted or anonymized.