Lenabo App Privacy Policy

Privacy Policy

1) Information on the collection of personal data and contact details of the data controller

1.1 We are pleased that you are using our application (hereinafter referred to as "App"). Below, we inform you about how we handle your personal data when you use our App. Personal data is any data that can be used to personally identify you.

1.2 The data controller for this app within the meaning of the General Data Protection Regulation (GDPR) is Lenabo GmbH, Brunnenallee 32, 53332 Bornheim, Germany, Tel.: +49 177 2308157, Email: info@lenabo.de. The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Log files when using our mobile app

When you download our mobile app from an app store, the necessary information is transferred to the app store, specifically your username, email address, and customer number, the time of download, payment information, and your device's unique identifier. We have no control over this data collection and are not responsible for it. We only process the data to the extent necessary for downloading the mobile app to your mobile device.

When you use our mobile app, we collect the personal data described below to enable convenient use of the feature. If you wish to use our mobile app, we collect the following data, which is technically necessary for us to offer you the features of our mobile app and to ensure its stability and security:

Date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Content of the requirement
Access status/http status code
Amount of data sent in bytes
Source/referrer from which you accessed this page
Browser used
Language and version of the browser software
Operating system used and its interface
IP address used (possibly in anonymized form)

The processing is carried out in accordance with Article 6 Paragraph 1 Letter f GDPR on the basis of our legitimate interest in improving the stability and functionality of our app. The data will not be shared or used for any other purpose. However, we reserve the right to subsequently review the aforementioned log files should there be concrete indications of unlawful use.

We also need your unique device number (IMEI = International Mobile Equipment Identity), unique network subscriber number (IMSI = International Mobile Subscriber Identity), mobile phone number (MSISDN), possibly MAC address for WLAN usage and the name of your mobile device.

3) Hosting & Content Delivery Network

3.1 Firebase Cloud Storage
We use the web hosting service "Firebase Cloud Storage" from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") for hosting and displaying app content, based on data processing on our behalf. All data collected on our website is processed on Google's servers. As part of the aforementioned services, data may also be transferred to servers of Google LLC in the USA for further processing on our behalf. We have concluded a data processing agreement with Google for the use of Firebase, which obligates Google to protect the data of our website visitors and not to disclose it to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with European data protection standards. Further information on Google's data protection practices in relation to Firebase can be found on the following website: https://firebase.google.com/support/privacy
Further processing on servers other than those mentioned above by Google will only take place within the scope outlined below.

3.2 Google Cloud CDN

We use a Content Delivery Network from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

This service allows us to deliver large media files such as graphics, page content, or scripts more quickly via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website, in accordance with Article 6(1)(f) GDPR.

Data may also be transferred to: Google LLC, USA

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

4) Cookies

To make our app more user-friendly and enable certain features, we use cookies. These are small text files that are stored on your device. Some of the cookies we use are deleted after you close the app (session cookies). Other cookies remain on your device and allow us to recognize you (persistent cookies). When cookies are set, they collect and process certain user information, such as browser and location data, as well as IP addresses, to varying degrees. Persistent cookies are automatically deleted after a predetermined period, which can vary depending on the cookie.

Some cookies are used to simplify the operation of the app by saving settings. If any of the cookies we use also process personal data, this processing is carried out in accordance with Article 6 Paragraph 1 Letter b GDPR for the performance of the contract, in accordance with Article 6 Paragraph 1 Letter a GDPR in the case of consent, or in accordance with Article 6 Paragraph 1 Letter f GDPR to protect our legitimate interests in ensuring the best possible functionality of the app and a user-friendly and effective design of the app's use.

You can configure your mobile operating system and app settings to suit your preferences, for example, by rejecting third-party cookies or all cookies. However, please note that in this case, you may no longer be able to use all the features of our mobile app.

5) Making contact

When you contact us (e.g., via contact form or email), personal data is collected. The specific data collected when using a contact form is indicated on the respective contact form in the app. This data is stored and used solely for the purpose of responding to your inquiry, contacting you, and for the associated technical administration. The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6 para. 1 lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after your inquiry has been fully processed. This is the case when it is clear from the circumstances that the matter has been resolved and provided that no statutory retention obligations apply.

6) Data processing when opening a customer account

In accordance with Article 6(1)(b) GDPR, personal data will continue to be collected and processed if you provide it to us for the performance of a contract or when opening a customer account. The specific data collected is evident from the respective input forms. You can delete your customer account at any time by sending a message to the data controller's address provided above. We store and use the data you provide for contract processing. After complete contract fulfillment or deletion of your customer account, your data will be blocked in accordance with tax and commercial law retention periods and deleted after these periods have expired, unless you have expressly consented to further use of your data or we have reserved the right to further use your data as permitted by law, about which we will inform you accordingly below.

7) Registration in the app

You can register in our app by providing personal data. The specific personal data processed for registration is determined by the input form used. We use the so-called double opt-in procedure for registration, meaning your registration is only complete once you have confirmed it by clicking the link in the confirmation email sent to you for this purpose. If you do not confirm your registration within 24 hours, it will be automatically deleted from our database. Providing the aforementioned data is mandatory. You can provide any further information voluntarily through our portal.

When you use our app, we store your data required for contract fulfillment, including any payment information, until you permanently delete your account. We also store any data you voluntarily provide for the duration of your portal use, unless you delete it beforehand. You can manage and change all your information in the secure customer area. The legal basis for this is Article 6(1)(f) GDPR.
Furthermore, we store all content you publish (such as public posts, wall entries, guestbook entries, etc.) in order to operate the app. We have a legitimate interest in providing the app with all user-generated content. The legal basis for this is Article 6(1)(f) GDPR. If you delete your account, your comments, especially those published in the forum, will remain visible to all readers, but your account will no longer be accessible. All other data will be deleted in this case.

8) Use of your data for direct marketing

8.1 Subscribe to our email newsletter

When you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to send you the newsletter is your email address. Providing any further information is voluntary and is used to personalize our communications with you. We use the double opt-in procedure for sending our newsletter. This means that we will only send you an email newsletter after you have explicitly confirmed that you consent to receiving it. We will then send you a confirmation email asking you to click on a link to confirm that you wish to receive the newsletter in the future.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Article 6 Paragraph 1 Letter a of the GDPR. When you subscribe to the newsletter, we store your IP address, which is registered by your internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used exclusively for sending you promotional material via the newsletter. You can unsubscribe from the newsletter at any time via the unsubscribe link provided in the newsletter or by sending a corresponding message to the data controller named above. After you unsubscribe, your email address will be immediately deleted from our newsletter mailing list, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes permitted by law, about which we inform you in this privacy policy.

8.2 Sending the email newsletter to existing customers

If you provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our product range via email. According to Section 7 Paragraph 3 of the German Unfair Competition Act (UWG), we do not need to obtain your separate consent for this. The data processing is based solely on our legitimate interest in personalized direct marketing pursuant to Article 6 Paragraph 1 Letter f of the GDPR. If you initially objected to the use of your email address for this purpose, we will not send you any emails.

You have the right to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by sending a message to the data controller named at the beginning of this document. You will only incur transmission costs at the basic rates for this. Upon receipt of your objection, the use of your email address for advertising purposes will be discontinued immediately.

9) Sending push notifications

You can sign up to receive our push notifications. You will receive regular information about our services via our push notifications.

To register, you must confirm the receipt of notifications or allow them in your operating system settings. This process is documented and stored. This includes storing the registration time and your device identifier. Collecting this data is necessary so that we can display push notifications and, in the event of misuse, trace the processes involved. It therefore serves our legal protection. The processing of this data is based on Article 6 Paragraph 1 Letter a of the GDPR.

You can withdraw your consent to the storage and use of your personal data for receiving our push notifications and the statistical data collection described above at any time with effect for the future. To withdraw your consent, you can unsubscribe from push notifications in the app settings on your operating system.

Your data will be deleted as soon as it is no longer needed for the purpose for which it was collected. Therefore, your data will be stored for as long as your subscription to our push notifications is active.

10) Online Marketing

10.1 Google AdSense

This website uses Google AdSense, a web advertising service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google AdSense uses cookies, which are text files placed on your computer, to help the website analyze how users use the site. Google AdSense also uses web beacons (small, invisible graphics) to collect information. These web beacons allow simple actions, such as website traffic, to be recorded, collected, and analyzed. The information generated by the cookie and/or web beacon about your use of this website (including your IP address) is generally transmitted to and stored on a Google server. This may also involve transmission to the servers of Google LLC in the USA.

Google uses the information obtained in this way to analyze your usage patterns with regard to AdSense ads. The IP address transmitted by your browser as part of Google AdSense is not combined with other Google data. The information collected by Google may be transferred to third parties if required by law and/or if third parties process this data on Google's behalf.
All processing described above, in particular the reading of information on the device used via cookies and/or web beacons, will only be carried out if you have given us your explicit consent in accordance with Art. 6 para. 1 lit. a GDPR. Without this consent, Google AdSense will not be used during your visit to our website.

You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

Google's privacy policy can be viewed here: https://www.google.de/policies/privacy/

10.2 Google Ads Conversion Tracking

This app uses the online advertising program "Google Ads" and, within the framework of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

We use Google Ads to advertise our attractive offers on external websites using advertising materials (so-called Google AdWords). Based on the data from these advertising campaigns, we can determine the success of individual advertising measures. Our aim is to show you advertising that is relevant to you, to make our app more appealing to you, and to ensure a fair calculation of the advertising costs incurred.

The conversion tracking cookie is set when a user clicks on a Google ad. Cookies are small text files that are stored on your device. These cookies typically expire after 30 days and are not used for personal identification. If the user visits certain pages of this app and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Therefore, cookies cannot be tracked across the websites of different Google Ads customers. The information obtained using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. These customers see the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can personally identify users.

When using Google Ads, personal data may also be transferred to the servers of Google LLC in the USA.

Details about the processing triggered by Google Ads Conversion Tracking and how Google handles website data can be found here: https://policies.google.com/technologies/partner-sites

All processing described above, in particular the setting of cookies for reading information on the device used, will only be carried out if you have given us your explicit consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

You can also permanently object to the setting of cookies by Google Ads conversion tracking by downloading and installing the browser plug-in from Google available at the following link:
https://www.google.com /settings /ads /plugin ?hl=de

To target advertising more effectively to users whose data we have obtained through business or similar relationships, we use a customer matching feature within Google Ads. For this purpose, we electronically transmit one or more files containing aggregated customer data (primarily email addresses and phone numbers) to Google. Google does not gain access to unencrypted data; instead, it automatically encrypts the information in the customer files during the transmission process using a special algorithm. Google can then only use the encrypted information to associate it with existing Google accounts that the individuals have created. This enables the delivery of personalized advertising across all Google services linked to the respective Google account.

Customer data is only transferred to Google if you have given us your explicit consent in accordance with Article 6 Paragraph 1 Letter a of the GDPR. You can revoke this consent at any time with effect for the future. Further information on Google's data protection measures regarding the customer matching function can be found here: https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182
Google's privacy policy can be viewed here: https://www.google.de/policies/privacy/

11) Web analytics services

Google Analytics 4
This app uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which allows the use of apps to be analyzed.
When using Google Analytics 4, so-called "cookies" are used by default. Cookies are text files that are stored on your device and enable analysis of your app usage. The information collected by cookies about your app usage (including your IP address, truncated by the last digits, transmitted by your device, see below) is generally transmitted to a Google server, where it is stored and processed. This may also involve the transfer of information to the servers of Google LLC, located in the USA, where the information may be further processed.
When using Google Analytics 4, the IP address transmitted by your device when using the app is always collected and processed in anonymized form by default, so that the collected information cannot be directly linked to you. This automatic anonymization is achieved by Google shortening the IP address transmitted by your device within member states of the European Union (EU) or other contracting states of the Agreement on the European Economic Area (EEA) by removing the last few digits.
On our behalf, Google uses this and other information to evaluate your use of the app, to compile reports on your app activity and usage patterns, and to provide us with other services related to your app and internet usage. The IP address transmitted by your device as part of Google Analytics 4.0 and shortened is not merged with other Google data. The data collected through Google Analytics 4.0 is stored for two months and then deleted.
Google Analytics 4 offers a special feature called "demographics" that allows for the creation of statistics about the age, gender, and interests of app users. This is based on an analysis of interest-based advertising and third-party information. This enables the identification and differentiation of app user groups for the purpose of targeted marketing efforts. However, the data collected via "demographics" cannot be linked to any specific individual, including you. This data is stored for two months and then deleted.
All processing described above, in particular the setting of Google Analytics cookies for storing and reading information on the device you use to access the app, will only take place if you have given us your explicit consent in accordance with Article 6(1)(a) GDPR. Without your consent, Google Analytics will not be used while you are using the app. You can withdraw your consent at any time with effect for the future. To withdraw your consent, please deactivate this service using the "Cookie Consent Tool" provided in the app.
In connection with this app, the "UserIDs" function is also used as an extension of Google Analytics 4. By assigning individual UserIDs, we can have Google generate cross-device reports (so-called "cross-device tracking"). This means that, with your consent to the use of Google Analytics 4 in accordance with Art. 6 Para. 1 lit. a GDPR, your usage behavior can also be analyzed across devices if you have created a personal account by registering on this app and are logged into your account on different devices using your login credentials. The data collected in this way shows, among other things, on which device you first clicked on an ad and on which device the corresponding conversion took place.
In connection with this app, the Google Signals service is also used as an extension of Google Analytics 4. Google Signals allows us to have Google generate cross-device reports (so-called "cross-device tracking"). If you have activated "personalized ads" in your Google account settings and linked your internet-enabled devices to your Google account, Google can analyze your usage behavior across devices and create database models based on this analysis, provided you have given your consent to the use of Google Analytics 4 in accordance with Article 6 Paragraph 1 Letter a of the GDPR. This analysis takes into account the logins and device types of all app users who were logged into a Google account and completed a conversion. The data shows, among other things, on which device you first clicked on an ad and on which device the corresponding conversion took place. We do not receive any personal data from Google in this process, but only statistics generated based on Google Signals. You have the option to disable the "personalized ads" feature in your Google account settings, thereby disabling cross-device analysis related to Google Signals. Follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de
Further information about Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de
We have concluded a so-called data processing agreement with Google for our use of Google Analytics 4, which obliges Google to protect the data of our app users and not to pass it on to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
Further legal information regarding Google Analytics 4 can be found at the following link: https://policies.google.com/privacy?hl=de&gl=de
Details about the processing initiated by Google Analytics 4 and how Google handles app data can be found here: https://policies.google.com/technologies/partner-sites

12) Retargeting/ Remarketing/ Referral Advertising

Google Ads Remarketing

This app uses retargeting technology from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

For this purpose, Google places a cookie in your browser, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you visit. Further data processing only takes place if you have consented to Google linking your internet and app browsing history to your Google account and using information from your Google account to personalize ads you see on the web. If you are logged into Google during your visit to our app, Google uses your data together with Google Analytics data to create and define target audience lists for cross-device remarketing. For this purpose, your personal data is temporarily linked by Google with Google Analytics data to create target audiences. When using Google Ads Remarketing, personal data may also be transferred to the servers of Google LLC in the USA.

All processing described above, in particular the setting of cookies for reading information on your device, will only be carried out if you have given us your explicit consent in accordance with Article 6(1)(a) GDPR. Without this consent, retargeting technology will not be used during your visit to our website.

You can withdraw your consent at any time with effect for the future. To exercise your right of withdrawal, please deactivate this service in the "Cookie Consent Tool" provided in the app.

13) Tools and other items

Firebase Crashlytics

We use “Firebase Crashlytics”, a service provided by Google Ireland Ltd., Google Building Gordon House, Barrow Street, Dublin 4, Ireland, to create anonymized crash reports in order to improve the stability and reliability of our app.

Only with your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR will anonymous information be transferred to Google's servers in the event of an app crash (app status at the time of the crash, installation UUID, crash trace, phone manufacturer and operating system, latest log messages). Transfers to Google LLC in the USA are also possible. This information does not contain any personal data.

When using an iOS-based device, you can grant consent in the app's settings or after a crash. When using an Android-based device, you have the option during setup to generally consent to the transmission of crash notifications to Google and the app developer.

You can withdraw your consent at any time by

In iOS, disable the "Crash Reports" function in the app's settings.
In Android, adjust the system settings. To do this, open the app's settings, select "Google," and then in the three-dot menu in the top right corner, select "Usage & diagnostics." Here you can disable the sending of the relevant data.

Further information on data protection can be found in the Firebase Crashlytics privacy policy at https://firebase.google.com/support/privacy

14) Rights of the data subject

14.1 The applicable data protection law grants you comprehensive rights as a data subject (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

Right of access pursuant to Article 15 GDPR: You have, in particular, the right to information about your personal data processed by us, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, lodging a complaint with a supervisory authority, the origin of your data if they were not collected from you by us, the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved and the significance and the envisaged consequences of such processing for you, as well as your right to be informed of the safeguards pursuant to Article 46 GDPR relating to the transfer of your data to third countries;
Right to rectification pursuant to Art. 16 GDPR: You have the right to immediate rectification of inaccurate data concerning you and/or completion of incomplete data stored with us;
Right to erasure pursuant to Article 17 GDPR: You have the right to request the erasure of your personal data if the conditions of Article 17(1) GDPR are met. However, this right does not exist, in particular, if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
Right to restriction of processing pursuant to Article 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data, which you have contested, is being verified; if you object to the erasure of your data due to unlawful data processing and instead request the restriction of the processing of your data; if you need your data for the establishment, exercise or defence of legal claims after we no longer need this data for the purposes for which it was collected; or if you have objected to processing on grounds relating to your particular situation, pending the verification whether our legitimate grounds override yours.
Right to information pursuant to Article 19 GDPR: If you have asserted your right to rectification, erasure, or restriction of processing against the controller, the controller is obligated to inform all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
Right to data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller, insofar as this is technically feasible;
Right to withdraw consent pursuant to Article 7(3) GDPR: You have the right to withdraw your consent to the processing of your data at any time with effect for the future. In the event of withdrawal, we will delete the data concerned immediately, unless further processing is permitted by another legal basis that does not require consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint pursuant to Article 77 GDPR: If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

14.2 Right of objection

If we process your personal data based on our overriding legitimate interest as part of a balancing of interests, you have the right to object to this processing at any time, on grounds relating to your particular situation, with effect for the future.

If you exercise your right to object, we will cease processing the data in question. However, further processing remains possible if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the purpose of establishing, exercising or defending legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. You can exercise your right to object as described above.

If you exercise your right to object, we will cease processing the data in question for direct marketing purposes.

15) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and – if applicable – additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).

When processing personal data on the basis of explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the data concerned will be stored until you withdraw your consent.

If statutory retention periods exist for data processed in the context of contractual or quasi-contractual obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data will be routinely deleted after the expiry of the retention periods, provided that it is no longer required for the performance of a contract or for initiating a contract and/or we no longer have a legitimate interest in its continued storage.

When processing personal data on the basis of Article 6(1)(f) GDPR, this data will be stored until you exercise your right to object pursuant to Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.

When processing personal data for direct marketing purposes on the basis of Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object pursuant to Art. 21 para. 2 GDPR.

Unless otherwise stated in the other information in this declaration regarding specific processing situations, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Language