Data privacy statement
The protection of your personal data is important to us. With this data privacy statement, we aim to explain to you in more detail what personal data we collect when you use komoot.com and for what purpose the data is used.
Contact information and responsible party
Responsible for the processing of your personal data is:
komoot GmbH
Friedrich-Wilhelm-Boelcke-Straße 2
14473 Potsdam
Germany
If you have any questions or suggestions regarding data protection, please feel free to email us at feedback@komoot.de.
You can contact our privacy protection officer at datenschutzbeauftragter@komoot.de.
Subject matter of data protection
The subject of data protection is personal data, i.e. all information relating to an identified or identifiable natural person.
Automated data collection
When accessing our website, your device automatically transmits data for technical reasons. The following data is stored separately from other data that you may transmit to us:
We save this data for the following purposes:
Your IP address is only saved for a period of 90 days.
In this case, the processing takes place on the basis of our predominant legitimate interests mentioned above (Art. 6 Para. 1 lit.f GDPR).
Registration data
To be able to use all functions of komoot, you have to register. For this you have to provide the following mandatory information:
When you sign up via Facebook, all of your Facebook friends that are also on komoot can find you via the search function, unless your Facebook settings determine otherwise. After you sign up, you will receive a registration email in order to activate your komoot account.
Your registration data is necessary in order for komoot to create a user account for you. This is also used to activate and manage your account and to allow you to use all the features of the komoot website. In this way, you opt-in to a (free) user contract which allows us to store the data (according to Art. 6 Para. 1 lit. b GDPR).
In order to conclude the contract, you have to provide us with this data. However, you are neither contractually nor legally obliged to conclude the contract and thus to provide the data.
In addition, you can provide further voluntary information as part of the registration, for example you can save a profile photo, tell others about yourself or indicate your favorite sport. This information is voluntary and not necessary to register you. Please note, however, that this information may be visible to other komoot users according to your settings. You can determine whether you want to be found by other users. We collect this data in order to be able to provide you with the corresponding functions of our website, Art. 6 Para. 1 lit. b GDPR.
When you log in to komoot, we also save your IP address for a short period of time in order to be able to detect and prevent possible attacks and mass misuse of logins to komoot (e.g. so-called brute force attacks) by blocking these IP addresses temporarily if necessary. The processing takes place in order to ensure the security of the processing according to Art. 32 GDPR and based on our legitimate interest in protecting us from misuse of our service (Art. 6 Para. 1 lit.f GDPR). Data is stored for a maximum of 90 days. It is subsequently anonymised.
Community functions
At komoot, you can interact with other users, for example by publishing personal Highlights, commenting, giving other tips or discussing with other users. You can also follow other users if you want to keep up to date with new posts from them.
The use of these functions is of course voluntary. If you use it, we collect the data you have entered in order to make it accessible to other komoot users in accordance with your settings and the function you use.
If you want, we can also inform you by e-mail or push notification if there is any news about your published posts. You'll also receive an email and a notification if you're set as a safety contact by another user. You’ll also subsequently be notified when the user for whom you’re a safety contact starts a Tour and has Live Tracking enabled. You can manage which notifications you receive in your settings.
Your data is processed for these purposes in order to be able to provide you with the functions within the framework of your user contract (Art. 6 Para. 1 lit. b GDPR).
Live Tracking
If you use Live Tracking, a feature of komoot Premium, your location data will be sent to our API at regular intervals during the Tour recording. You can optionally share location data by sending a publicly accessible link or by designating other komoot users as safety contacts. Your safety contacts will receive an email and a message in their profile as soon as you start a new Tour and Live Tracking is active. Your location data will be deleted after 28 days.
Your data is processed for the aforementioned purposes in order to be able to provide you with the functions as part of your user contract (Art. 6 Para. 1 lit. b GDPR).
Shop
If you purchase a Premium subscription or a gift voucher in our shop, we integrate payment service providers to process payments. When paying by credit card, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., C/O A & L Goodbody, Ifsc, North Wall Quay, Dublin, D01 H104, Ireland - "Stripe"). You can find Stripe's privacy policy at: https://stripe.com/en-de/privacy
You also have the option of paying via PayPal. In this case, your payment will be processed by PayPal (Europe) S.à r.l. et Cie (“PayPal”), S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. You can find PayPal's privacy policy at: https://www.paypal.com/en/webapps/mpp/ua/privacy-full
We transmit payment information to these payment service providers to process the payments for the respective services, Article 6 (1) (b) GDPR. The further processing of payment information by the payment service provider is the sole responsibility of the respective payment service provider. Please note the data protection declarations of the payment service providers. The respective payment service provider is solely responsible for processing your payment data. We have neither access nor influence over it.
We only receive information from the payment service providers that the payment has been properly processed. We process this information along with your name in order to complete the transaction you have made. If you have purchased a voucher from us, we will also process your e-mail address in order to send you the voucher code. The legal basis for processing is Art. 6 (1) (b) GDPR.
In order to be able to conclude the purchase contract, you must provide this data. However, you are neither contractually nor legally obliged to conclude the contract and thus to provide the data.
Requests
Support requests submitted through our support center (Zendesk)
If you contact us via our support center, we process:
To process your inquiries via our support center, we use the Zendesk customer service platform, a service provided by Zendesk Inc., 989 Market Street, San Francisco, CA 94103 ("Zendesk") (cf. Art. 4 No. 8 , 28 GDPR).
Your personal data will be processed in the USA. There is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Zendesk Inc. is a certified company in accordance with the Data Privacy Framework. USA.
Direct inquiries via our contact details
If you send us inquiries by e-mail or by other means (e.g. by post), your details will be processed to process the enquiry. This includes:
Depending on how you contact us or the contact details you have provided, we may also process:
Purpose and legal basis of processing
The legal basis for the processing is our legitimate interest (Art. 6 Para. 1 lit. f GDPR) in rapid communication in order to conduct the exchange you are seeking and to be able to process your request properly. In the case of inquiries in connection with an existing or future contractual relationship with us, processing is carried out to initiate and implement the respective contractual relationship, Art. 6 (1) (b) GDPR. In addition, we have a legitimate interest in the efficient management of our customer relationships, Article 6 (1) (f) GDPR.
Storage data
We store inquiries about contracts or of potential legal relevance during the general limitation period, i.e. three years from the end of the year in which we received your requests. We store all other inquiries for a period of 24 months. Your requests will then be deleted unless we are legally obliged to keep them for a longer period of time.
The storage takes place on the basis of our legitimate interest, the proper documentation of our business operations and the protection of our legal positions (Art. 6 Para. 1 lit. f GDPR). In the case of inquiries about contracts, the storage takes place to initiate and implement the respective contractual relationship (Art. 6 Para. 1 lit. b GDPR) and, if necessary, to fulfill legal obligations (Art. 6 Para.1 lit. c GDPR).
Security vulnerability reward program
If you have discovered a vulnerability on our website and in our services and report it to us, we will process your contact details as well as other information you have provided in order to receive and process your report and, if necessary, to ask you any questions. If your report is included in our bounty reward program and you qualify for a reward, we also need additional information from you in order to pay you the corresponding reward.
Please note that we may forward reports regarding vulnerabilities on service providers or third parties to them.
The legal basis for the processing of your personal data is Article 6 (1) (f) GDPR. We have a legitimate interest in receiving and processing your report to ensure the security and functionality of our website and services.
We store reports of potentially legal relevance during the general limitation period, i.e. three years from the end of the year in which we received your report. We store all other reports for a period of 24 months. Your report will then be deleted unless we are legally obliged to keep it for a longer period of time.
The storage takes place on the basis of our legitimate interest, the proper documentation of our business operations and the safeguarding of our legal positions (Art. 6 Para. 1 lit. f GDPR) and, if necessary, to fulfill legal obligations (Art. 6 Para.1 lit. c GDPR).
Newsletter
If you register with us, we will inform you about news about our services on the komoot platform about once a month.
In this case, the collection and processing of your personal data takes place due to our legitimate interest in promoting similar services to your user account with komoot (Art. 6 Para. 1 lit. f GDPR, § 7 Para. 3 UWG).
You can object to this at any time - even when registering - by deactivating the corresponding checkbox or by clicking on the link to unsubscribe in the respective emails.
For this purpose, we also use customer.io, a service provided by Peaberry Software Inc., 9450 SW Gemini Dr, Suite 43920, Beaverton, Oregon 97008-7105, USA (“customer.io”). We use customer.io as a processor.
Customer.io enables us to only send you news by email or push notification – depending on your selected preferences – that is relevant, of interest, and of use to you. So that we can tailor these notifications to your interests and provide you with the perfect personalized komoot experience – for example, to send you curated inspiration and ideas specific to you – we use data based on your use of komoot, your interactions with us, and the information saved in your user account. This includes:
Data that you actively provide us with, e.g.:
● User and display name
● Email address
● Notification settings (push notification, email)
● Favorite sport
Data that we obtain from your interaction within komoot, e.g.:
● Device information
● Information about your completed tours (finish time)
● Usage information (start time for a session)
● Community information (how many followers you have, and how many people you are following)
Customer.io also enables us to identify which of our communications are effective and which are not, e.g. whether our communication prompts you to save one of our suggested tours or explore it. We can then use this information to improve our notifications to you.
The usage takes place on the basis of our legitimate interest in being able to send you only news that is also relevant and of interest to you, in order to improve your user experience with our product, and so that you can use komoot more effectively to plan tours and explorations, Art. 6 Para. 1 lit. f GDPR.
ReCAPTCHA
We use reCAPTCHA, a service from Google LLC, 1600 Amphitheater Pkwy Mountain View, California 94043, USA ("Google"), which is integrated into our website and shows the so-called Captchas - small tasks that are easy for people to solve but for machines are difficult to manage. These Captchas help us to prevent the automatic creation of user accounts and thus spam, fraud and other abuse in our community.
If you call up our registration and login form, reCAPTCHA will collect device and — if applicable — personal data from you in order to be able to recognize whether you are a human user or a spam bot. This data includes information about your surfing behavior, login data, information about your browser and your IP address. In addition, reCAPTCHA uses cookies.
Your personal data will be processed in the USA. There is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Google Cloud EMEA Limited is a certified company in accordance with the Data Privacy Framework. Please note that there is currently no adequacy decision by the EU Commission for the USA. Therefore, we have concluded the standard contractual clauses approved by the EU Commission with Google in accordance with Article 46 (2) (c) GDPR.
For more information, see Google’s Privacy Policy.
We use reCaptcha based on our legitimate interest in protecting ourselves from spam, fraud against us and our users and other misuse through automatically created accounts (Art. 6 Para. 1 lit. f GDPR).
Cookies and similar technologies
We store so-called "cookies" and use cookie-like technologies to be able to offer certain functions of our website and to optimize the use of our pages. "Cookies" are small files that are stored on your end device with the help of your internet browser. Similar technologies can be, for example, pixels, scripts, local storage or other comparable technologies for storing information (hereinafter collectively referred to as “cookies”).
Necessary cookies
We set cookies, which are absolutely necessary for the operation and functionality of the website and the associated services, in accordance with Section 25 Paragraph 2 No. 2 of the Telecommunications and Digital Services Data Protection Act ("TDDDG") without your consent. This category includes cookies that ensure that the website is technically accessible and usable. In addition, these cookies ensure essential and basic functionalities of our website and the associated services. Specifically, we use cookies that are absolutely necessary for the following functions:
Depending on the respective function of these cookies, these cookies are only stored for the duration of your visit (session cookies) or for a longer period of time, e.g. until you actively log out. Cookies for storing your chosen settings and the cookie settings you have made remain stored until the end of the browser session.
If personal data from these cookies are processed, the processing is carried out to ensure the following:
Cookies for analysis purposes
Additionally, we use cookies to analyze and evaluate your usage behavior in accordance with Section 25 (1) TDDDG. This is only done on the basis of your consent (Article 6 (1) (a) GDPR).
These cookies are used to measure online traffic and analyze behavior. They collect information about how you interact with our website, which pages you have visited and which features of our website you have used. Your usage behavior can be traced using a user ID. This enables us to better understand the use of our website and optimize it accordingly.
If personal data from these cookies is processed, this processing is also based on your consent.
If we use cookies on the basis of your consent (or the associated processing of your personal data is based on your consent), you can revoke your consent at any time via the "Privacy Settings" link. Alternatively, you can change your settings at any time. You can find the link in the footer of the website. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of your consent until the revocation.
These cookies remain stored on your end device for up to two years, unless you withdraw your consent before this period has expired.
Services relating to the cookies we use for analysis purposes
In this section, we explain the services that we use in the context of the cookies we use for analysis purposes in more detail:
Google Analytics
With your permission, we use Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
Google Analytics collects pseudonymous data from you about the use of our website - including your abbreviated IP address- and uses cookies. Please note that Google transmits the information generated by the cookies about your use of the website (including your shortened IP address) to servers in the USA and shares this data within the group of companies and with other third parties. Here, too, personal data may be transferred to the USA and third countries for which there is no adequacy decision by the EU Commission. For data transfer to the USA, there is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Apart from that, Google will use the standard contractual clauses approved by the EU Commission in accordance with Article 46 (2) (c) GDPR.
Google will use this information to evaluate your use of the website for us, to create reports on the use of our website and to perform further analyses and evaluations related to the use of our website and internet use. Google can also link this data to other data about you, such as your search history, your personal account, the usage data of other devices and other data that Google has stored about you. Google may also transfer this information to third parties if required to do so by law (e.g. state authorities) or if third parties process this data on Google's behalf.
Your data will be stored by Google Analytics for a period of 14 months. After this period, the data will be deleted and only aggregated statistics will be kept. For more information about how Google uses your data, see Google's privacy policy.
The use of Google Analytics is based on your consent (Art. 6 Para. 1 lit. a GDPR).
You can withdraw your consent at any time by clicking "Privacy Settings" at the bottom of the page. The revocation of your consent does not affect the legality of the processing carried out on the basis of your consent up to the time of revocation.
Google Firebase
We use Google Firebase, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use Google as a processor (cf. Art 4 No. 8, 28 GDPR).
Google Firebase offers us various services to offer the functionalities of our website. Specifically, we use the following services within the framework of Google Firebase:
Crash Reporting
Google collects statistical and technical data for us about any website crashes. As intended, they do not receive any personal data. However, should personal data be included, we collect this based on our legitimate interest in the error-free operation of our website and the possibility of troubleshooting (Art. 6 Para. 1 S. 1 lit. f GDPR).
Performance Monitoring
Google stores non-personal statistics about the performance of our website for us, i.e. about the speed and any delays in the process. As intended, this information does not contain any personal data. However, should personal data be included, we collect this based on our legitimate interest in error-free and needs-based operation of our website and the possibility of error detection and correction (Art. 6 Para. 1 S. 1 lit. f GDPR).
A/B Testing
We use the A/B testing functions of Google Firebase to be able to test innovations as part of the product development of our website. As part of this, non-personal statistical data is collected. The use is based on our legitimate interest in the needs-based design of our website (Art. 6 Para. 1 S. 1 lit. f GDPR) to address your device and play out content as a test, technical data must be processed via your end device.
Datadog
We use Datadog, a service provided by Datadog, Inc., 620 8th Ave., 45th Fl., New York, NY 10018, USA (“Datadog”). We use Datadog as a processor (cf. Art. 4 No. 8, 28 GDPR). Your personal data will be processed in the USA. There is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Datadog, Inc. is a certified company in accordance with the Data Privacy Framework.
We use Datadog to investigate disruptions on our website and app – e.g. in the form of unexpected deviations, anomalies, and errors – and to monitor the performance of our website and app, including latency (in other words, the time delay that occurs e.g. when transmitting information to our server), availability, and response times.
To this end, Datadog collects specific technical data for us, including user agent (e.g. browser type and version, operating system), error information (stack trace, i.e. the behavior of the respective apps that led to an error, as well as the time when the error occurred), and data on the performance of our website and app, i.e. on the speed and any run delays. Datadog also collects the user ID. Using Datadog enables us to evaluate this data for the purposes mentioned above.
We save the data that we collect using Datadog for a period of 30 days. After this period, we only hold aggregated data with no personal reference.
The processing of the data takes place due to our legitimate interest in ensuring the error-free and proper operation of our website and our app, and in being able to identify and resolve errors (Art. 6 Para. 1 S. 1 lit. f GDPR).
Adjust
We use Adjust, a service provided by Adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany (“Adjust”). We use Adjust as a processor
Adjust helps us to measure and evaluate the marketing performance of our advertising campaigns. Adjust does so by recording whether you were sent to us via an advertising partner and, if so, by which advertising partner. This enables us to identify which advertising campaigns are effective and which are not, and to improve our advertising accordingly. Your data is not used for retargeting or other advertising purposes.
The use is based on our legitimate interest in advertising our product on a range of channels and in being able to fulfil contracts with our advertising partners, Art. 6 Para. 1 S. 1 lit. f GDPR.
Social Plugins
If you want, you can use social plugins to share the content of our website on social networks. We have provided a two-click solution: If you want to share content via such a plugin, you must first click on an icon of the corresponding social network. This click then unlocks the plug-in of the respective social network for the future.
Only then will various data be transmitted to the respective social network. This can include:
Processing your personal data as mentioned above for the purpose of integrating social plugins is done solely based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR.
You can withdraw your consent by adjusting settings here or by clicking “Privacy Settings” at the bottom of the page. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent up until the moment you withdrew it.
If you are logged into the respective social network while visiting our site, the provider may recognize that you visited our site and assign the visit to your account. If you use the plugin functions (e.g. clicking the "Like" button, submitting a comment), this information will also be transmitted from your browser directly to the respective social network and saved there if necessary. The purpose and scope of the data collection and the further processing and use of the data by the networks can be found in the data protection information of the respective social network.
Location determination
If you use our app or visit our website, we use your IP address to determine your approximate location so that we can show you maps and routes in your vicinity. This processing is carried out in accordance with Art. 6 Para. 1 lit. f GDPR, based on our legitimate interest in being able to provide our users with an appropriate product that is relevant to them, and in optimizing the app for our users.
Your IP address is processed solely on servers in the EU.
Your location is not saved on your device, but is deleted again as soon as your session ends.
Integrated third-party content
We have also included third-party content on our website. This content is loaded from the servers of the respective providers, so that your end device transmits certain technically necessary data to the third party provider. In particular, it is not excluded that these providers can take note of the IP address assigned to you. As far as personal data is processed, this is done on the basis of the data protection declarations of the respective third party providers. The inclusion of your data is processed to allow us to display corresponding content and to offer necessary functions, as well as allowing us to operate our website more efficiently as long as this doesn't infringe on your own legitimate interests (Art. 6 para. 1 lit. f GDPR). We include the following third-party content:
Google Maps
To activate Google Street View in our maps, we integrate Google Maps, a service for users in the EU from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For users outside of the EU, this service is provided by Google LLC, 1600 Amphitheater Pkwy Mountain View, California 94043, USA ("Google"). There is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Google LLC is a certified company in accordance with the Data Privacy Framework.
You can see their privacy policy here.
YouTube
We use YouTube videos. YouTube is a service of Google LLC, 1600 Amphitheater Pkwy Mountain View, California 94043, USA, for users from the EU of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). There is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Google LLC is a certified company in accordance with the Data Privacy Framework.
You can see their privacy policy here.
Vimeo
We integrate videos from Vimeo. Vimeo is a service of Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA. There is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Vimeo Inc. is a certified company in accordance with the Data Privacy Framework.
You can see their privacy policy here.
Webhoster
We operate our website on the servers of our web host Amazon Web Service EMEA Sarl, 38 avenue John F. Kennedy, L-1855, Luxembourg, which processes personal data on our behalf. Processing takes place only within the European Union.
Applications
When you apply for a job at komoot, we process the following:
If you go through our application process, other personal data will also be processed, especially as part of the challenges and if we make notes or have questions for you during an interview. We also reserve the right to cross-check professional information that you have published or that you make available on professional networks, insofar as this is necessary to process your application. You can find more information about the application process at: How does our recruitment process work? | komoot.
Your personal data is processed to process your application or to decide on the establishment of an employment relationship. Your data in connection with your application will only be made accessible to the persons responsible for the application within our company. The data processing takes place on the legal basis of § 26 paragraph 1, 3 BDSG.
In addition, we also process information regarding how you became aware of komoot. We process this information in order to be able to better evaluate and optimize the reach of our recruiting measures. This is also in our legitimate interest, Art. 6 Para. 1 lit. f GDPR.
You are neither legally nor contractually obliged to provide your personal data. However, the provision of the data required to receive and process your application is necessary both for this receipt and processing of your application and for the decision to establish an employment relationship with you. If you do not provide us with the necessary personal data in connection with your application, we cannot consider your application.
If we are unfortunately unable to offer you a position, your application documents will generally be kept for up to 4 months after the end of the respective application process in order to be able to answer any questions in connection with your application. Further storage can take place if this is necessary for providing evidence, in particular for defending against, asserting or enforcing claims (Art. 6 Para. 1 lit. f GDPR).
Otherwise, we only store your applicant data if you have expressly consented to it (Article 6 (1) (a) GDPR). You can revoke your consent at any time with effect for the future. You can use the contact details above to do this. A revocation does not affect the processing that has taken place up to your revocation.
To receive and process applications, we use the Workable platform, a service provided by Workable Software Limited, 5 Golden Square, 5th Floor, London, W1F 9BS, United Kingdom ("Workable"). As our processor, Workable processes your personal data exclusively in accordance with our instructions (cf. Art. 4 No. 8, 28 GDPR). For the United Kingdom, there is an adequacy decision by the EU Commission in accordance with Art. 45 (1) GDPR, according to which the United Kingdom offers an appropriate level of protection.
Our social media presence
General information
We operate pages or profiles on different social media platforms. In this context, the processing of personal data described below takes place.
If you interact with us via our social media pages or our posts, we will collect and process the data you have provided, including your username and your profile photo (if applicable). The relevant processing takes place regularly on the basis of our legitimate interest in making the corresponding functions available on our social media pages (Art. 6 Para. 1 lit. f GDPR) and, if necessary, on the basis of your consent to the operator of the respective network (Art . 6 (1) (a) GDPR) or your contractual relationship with the operator (Art. 6 (1) (b) GDPR). Please also note that this content will be published on our relevant social media pages according to your account settings and may be accessible by anyone worldwide.
Further data processing by us can be carried out in order to be able to receive and process inquiries or messages via our social media pages (Art. 6 Para. 1 lit. b GDPR).
Uploaded content can be stored for an unlimited period of time. If you would like us to remove content you have uploaded to our social media site, please send us an email with your request to the contact details given under point 1.
In addition, the respective operators collect and process personal data from you under their own data protection responsibility when you visit our social media pages and/or interact with them or our contributions. This applies in particular if you are registered or logged in to the relevant social media network. Even if you are not logged into a social media network, the operators collect certain personal data when you visit the site, such as unique identifiers that are linked to your browser or your device. Please note that this data may be merged across different platforms and services if they are operated by the same operator. Further information can be found in the data protection notices of the respective operators, to which we refer below.
Specifically, we operate the following social media presences:
Facebook Fanpage
You can also find us on Facebook at https://www.facebook.com/komoot.
For users outside of the USA and Canada, Facebook is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For users in the USA and Canada, Meta Platforms Inc., 1601 Willow Road Menlo Park, CA 9402, USA, operates Facebook.
Even if you are not registered with Facebook and visit our Facebook fan page, Meta Platforms can collect pseudonymous usage data from you. You can find more information in the Meta Platforms data policy at https://de-de.facebook.com/about/privacy/ and at https://www.facebook.com/legal/terms/information\_about\_page\_insights\_data. In the data policy you will also find information about the setting options for your Facebook account.
Meta Platforms may share your data within the Meta group of companies and with other third parties. This can lead to a transfer of personal data to the USA and other third countries for which there is no adequacy decision by the EU Commission. For data transfer to the USA, there is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR for the EU-U.S. Data Privacy Framework, which serves as the basis for data transfer to certified companies and organizations in the USA. Otherwise, Facebook Ireland will use the standard contractual clauses approved by the EU Commission in accordance with Article 46(2)(c) GDPR. You can also refer to the Meta Platforms Data Policy for more information.
In addition, together with Meta Platforms Ireland Limited, we are responsible for the processing of so-called insights data when you visit our Facebook fan page. With the help of this insight data, Meta Platforms Ireland Limited analyzes the behavior on our Facebook fan page and makes this data available to us in an anonymous form. To this end, we have entered into a joint data controllership agreement with Meta Platforms Ireland Limited, which you can view here. Among other things, Meta Platforms Ireland Limited undertakes the primary responsibility under the GDPR for the processing of Insights data and to fulfil all obligations according to all GDPR regulations regarding the processing of Insights data. The processing serves our legitimate economic interests in the optimization and needs-based design of our Facebook fan page, Art. 6 Para. 1 lit f. GDPR. Additionally, we also draw your attention to the following:
If you visit or like our Facebook page as a registered Facebook user, Meta Platforms Ireland Limited collects personal data from you. If you are not registered with Facebook and visit the Facebook page, Meta Platforms can collect pseudonymous usage data from you.
In detail, the following information is collected by Meta Platforms:
Liking or unliking a page or post
Recommending a page in a post or comment
Hovering over a page's name or profile picture to see a preview of the page's contents
You can find more information in Meta’s privacy policy. This includes further information on how Meta Platforms uses your data when you like our Facebook page. Meta’s privacy policy: https://www.facebook.com/legal/terms/information_about_page_insights_data.
Provision of your data
You are neither legally nor contractually obliged to provide your personal data; furthermore, the provision of your personal data - unless expressly mentioned in the aforementioned clauses - is not necessary for the conclusion of a contract.
However, the provision of your personal data is necessary to a certain extent so that we can provide you with the functions on our website. In particular, the provision of your data is necessary so in order to:
If it is necessary to provide your data, we will point this out to you when you enter it by marking it as a mandatory field. Providing further data is voluntary. In the case of required data, failure to provide this data means that we cannot provide you with the relevant functions of our website and cannot receive and process your inquiries or reports.
In other cases, non-provision may mean that we do not provide the relevant functions or not to the usual extent, or that we are only able to process your inquiries and reports to a limited extent.
Disclosure of your data
Your data will only be passed on beyond what is described in this data protection declaration to the following extent:
In addition, your personal data may also be passed on if we are exposed to other claims by third parties, which may include information about your data.
This data is passed on on the basis of our legitimate interest in combating abuse, prosecuting criminal offenses and asserting, exercising or defending claims according to article 6 (1) (f) GDPR or on the basis of a legal obligation under article 6 Paragraph 1 lit. c GDPR.
For the provision of the services, we rely on contractually linked third-party companies and external service providers, so-called processors (cf. Art. 4 No. 8, 28 GDPR). In such cases, personal data is passed on to these processors in order to enable them to carry out further processing. These processors process personal data on our behalf and are strictly bound by instructions.
In addition to the processing parties already mentioned in this data protection declaration, we also use the following categories of processors:
This data is transmitted on the basis of our legitimate interest in maintaining our business activities, performing our tasks, asserting, exercising or defending claims (according to Art. 6 (1) lit. f du RGPD) or on the basis of a legal obligation (according to Art. 6 Paragraph 1 lit. c du RGPD).
The transfer of personal data is justified by the fact that we have a legitimate interest in adapting our company’s form to fit economic and legal circumstances in accordance with Art. 6 Para. 1 lit. f GDPR.
Transfer of data to third-party countries
We also process data in countries outside the European Economic Area ("EEA"), in so-called third-party countries, or transfer data to recipients in these third-party countries.
Insofar as your personal data is transferred beyond the cases described in this data protection declaration to recipients outside the European Economic Area, we transfer your data to third-party countries for which there is an adequacy decision by the EU Commission in accordance with Article 45 (1) GDPR.
If such an adequacy decision does not exist, we use the standard contractual clauses approved by the EU Commission in accordance with Article 46 (2) (c) GDPR when structuring the contractual relationships with recipients in third-party countries. You can request a corresponding copy of these standard contractual clauses as well as information on the additional measures that we have taken to ensure an appropriate level of data protection using the contact details given under point 1.
Automated decision making and visitor profiling
We do not use automation to make specific decisions in regards to profiling.
Deletion of your data
Unless otherwise stated, we will delete or anonymize your personal data as soon as it is no longer required for the purposes for which we collected or used it in accordance with the preceding paragraphs. As a rule, we store your personal data for the duration of the usage or contractual relationship via the website plus a period of 30 days in which we keep backup copies after the deletion. We will also keep your data if we are obliged to do so for legal reasons or if the data is needed for criminal prosecution or to secure, assert or enforce legal claims.
If you delete your user account, your profile will be completely and permanently deleted. However, we will keep backup copies of your data for a period of 30 days before they are finally deleted, provided that this data is no longer required for legal reasons or for criminal prosecution or to secure, assert or enforce legal claims.
We also keep your data for the following reasons:
If data must be stored for legal reasons, processing will be restricted. The data is then no longer available for further use.
Your rights as a data subject
With regard to the processing of your personal data, you have the rights described below. To assert your rights, you can submit an application by post or email to the address given in Section 1 above.
Right to information
You have the right to receive information from us at any time on request about the personal data processed by us in the scope and under the conditions of Art. 15 GDPR and § 34 BDSG. To do this, you can submit an application by post or email to the above address.
Right to correct incorrect data
You have the right to request that we immediately correct your personal data if it is incorrect. For this, please contact the contact addresses given above.
Right to cancellation
You have the right, under the conditions described in Art. 17 GDPR and § 35 BDSG, to request that we delete your personal data. These requirements provide in particular a right to erasure if the personal data is no longer necessary for the purposes for which they were collected or otherwise processed, as well as in cases of unlawful processing, the existence of an objection or the obligation to erase them under EU law or the law of the Member State to which we are subject. For the period of data storage, see also the section “Deletion of your data” in this data protection declaration.
Right to restriction of processing
You have the right to demand that we restrict processing in accordance with Art. 18 GDPR.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, common, machine-readable format in accordance with Art. 20 GDPR. In order to assert your above right, please contact the above address.
Right to object
You have the right to object to the processing of your personal data at any time for reasons that arise from your particular situation on the basis of Art. 6 Para. 1 (GDPR). Your right to objection exists for reasons arising out of your particular situation, unless we can establish compelling legitimate grounds for processing that outweigh your interests, rights and freedoms or if the processing is necessary for the assertion and exercise of or defence against legal claims (Art. 21 (1) GDPR).
If we process your personal data for direct marketing purposes, including profiling, you have the right to object to this processing. After your objection, we will stop processing.
Unless otherwise stated in this data protection declaration, please use the contact addresses given in Section 1 above to assert your abovementioned right.
Right to complain
You have the right to contact a supervisory authority of your choice in the event of complaints.
Data processing when exercising your rights
Finally, we would like to point out that we process the personal data transmitted by you when you exercise your rights in accordance with Article 7 (3) sentence 1 GDPR and Articles 15 to 22 GDPR for the purpose of implementing these rights and to provide evidence of this and, if necessary, to defend legal positions. The processing of your data to fulfil your rights as a data subject is based on the legal basis of Art. 6 (1) (c) GDPR in conjunction with Art. 15 to 22 GDPR and Section 34 (2) BDSG. Insofar as we process the personal data for the purposes of legal defense, this is also our legitimate interest, Art. 6 Para. 1 lit. f GDPR.
For the sake of completeness, we would like to point out that any personal data in connection with requests to exercise your rights to fulfil the legal documentation obligations in accordance with GDPR (and in particular to prove the timely response to your request) is stored for the duration of the regular limitation period of three years, beginning with the end of the year in which your application was finally processed by us.
The legal basis for storage is Art. 6 (1) (f) GDPR. It is in our legitimate interest to provide and document the aforementioned evidence.
This personal data will be blocked and will not be processed for other purposes, unless the processing is necessary for the establishment, exercise or defense of legal claims. This is also in our legitimate interest, according to art. 6 Para. 1 lit. f GDPR.
You are neither contractually nor legally obliged to provide your personal data, but we can refuse to fulfil your request to exercise your rights as a data subject in accordance with Art. 12 Para 2 when you do not provide the required data.
Changes to this data protection declaration
The current version of this data protection declaration is always available at https://www.komoot.com/privacy.
Status as of 2024-06-11