1. Scope and general information
2. Data processing - General information
3. Data processing - Pal account / profile
4. Data processing - External services
5. Storage time
6. Your rights
7. Right of revocation and opposition
8. Data Security
10. Other notes and provisions
11. Technical information
1. Scope and general information
1.4. You can rely on us to process your personal data in accordance with applicable law, including but not limited to the GDPR and Data Protection Act 2018.
2.1. In order to download and install Pal from an App Store (such as Google Play or the Apple AppStore), you must first register with the provider of the respective App Store for a user account and enter into that App Store’s user agreement. We have no influence on the terms of such user agreement and are not a party to such user agreement. When downloading and installing Pal, certain information is transmitted to the respective provider of the App Store (e.g., Google or Apple), including your username, your e-mail address and the customer number of your account, the time of download and the individual device code and, in the case of in-app purchases, your payment information. We have no influence on, and are not responsible for, this data collection. We only process data provided to us as necessary for downloading and installing Pal on your mobile device (e.g., your iPhone or Android device).
2.2.You can install and open Pal anonymously. When using Pal, in order to ensure that Pal can operate and to provide its features to you, we collect the following technical data. This data is automatically collected and transmitted to us from your mobile device during your use of Pal ("Usage Data") and includes: (i) device name (e.g. "Apple iPhone 8" or "Samsung Galaxy S9"); (ii) operating system and version; (iii) the version of Pal that you are using; (iv) system language; (v) general device data, such as voice and regional settings; (vi) IP address of the terminal; (vii) date and time of use; and (viii) application ID to identify your installation of Pal.
To improve Pal, Pal also sends us error messages in the event of a crash (that is, after Pal has unexpectedly quit because of a program error or it has stopped responding to your input). The error messages contain only the above Usage Data, as well as information about which part of Pal’s software code has caused the error.
We use the Usage Data and, if applicable, the error messages, to enable Pal to function, to detect and correct any security risks or malfunctions and to ensure the stability of our systems. We rely on the legitimate interests processing ground to collect this information. It is in our legitimate interests to collect this information because this is necessary in order to secure Pal’s functionality, detect errors resolve them, and to help us to detect and prevent cyberattacks.
2.4. When you open Pal for the first time, you will be asked if Pal is allowed to send push notifications. If you allow this feature, we will send you push notifications, for example, to inform you about our news updates. Such push notifications are controlled by the software components of your operating system (so-called “tokens”). You can configure and turn our push notifications off via your device settings at any time.
2.5. If you want to permit location settings via Pal, you will be asked if Pal is allowed to access your location. If you allow this feature, we will determine your location to provide you with site-specific functions of Pal. You can configure and turn location settings off via your device settings at any time. We rely on consent to process this information as it is your choice as to whether to allow us to access such information or not.
2.6. If you want to use other features of Pal, such as your microphone input, your camera or photo and video upload function, you will be asked if you want to use this function before using it for the first time. If you allow any such feature, you can use the corresponding function to perform the desired interaction on Pal. You can enable or disable access to these functions at any time via your device settings. We rely on consent to process this information as it is your choice as to whether to allow us to access such information or not.
2.7. If you contact us for questions or feedback, we will process the details of your request for follow-up queries. We rely on contractual necessity to process this information as we need this information in order to answer your question or respond to your feedback.3. Data processing - Pal account / profile
3.1. If you want to use the features of Pal, you need to create a Pal account and create a profile. You cannot use the features of Pal anonymously. To create a Pal account, you must register with your name and email address, or via your Facebook or Google profile and password. Please make sure to enter your real name and valid email address, or choose the log-in via Facebook or Google profile and choose a secure password. You must keep your password safe, and change it at regular intervals. As soon as your Pal account is created, you must be willing to voluntarily enter certain mandatory and other voluntary information about yourself in the input fields, or, if you prefer/have selected that option, to import such information from one of your social media profiles. We rely on contractual necessity for the mandatory information as it is necessary for you to create an account and provide us with this information in order to be able to use the features of Pal. We rely on consent for the voluntary information as it is your choice as to whether to allow us to access such information or not.
Please note that you will have the option to submit certain specific (and sensitive) types of personal data to us (e.g., racial or ethnic origin, political opinions, religious or philosophical convictions, trade union membership, health or details about your sexual life). As a general rule, any information that you submit to Pal is made public to other users. Therefore, please be careful, at all times, to enter only the information and content that you really want to share with other users or make public. If you enter any sensitive personal data, you explicitly consent, and we rely on such consent, to collect, store and process this information according to applicable data protection law.
You can, of course, always view, edit, or share with other users any information, or delete this information at any time. If you want to change your name or e-mail address, you can contact us.
3.2. Once you are logged in to Pal, you will be able to use the features of Pal. You may, however, have to provide us with certain additional details to use additional features, for example when you purchase Pal Coins. In this event, we will of course point out to you what further data we require. We rely on the legitimate interests processing ground to collect this information. It is in Pal’s legitimate interests to collect this information because this is necessary in order to provide these features of the Pal App to you. The items of personal data collected are limited and therefore not of a nature whereby your rights and freedoms as a data subject are outweighed by such data collection.
3.3. When you use Pal, we collect, store, and process all of your information (whether it be the information that you must supply to us to use Pal, other voluntary information that you choose to submit to Pal, IP address, shared device information, etc.) to allow you to personalize Pal and for Pal to tailor Pal as appropriately as possible to you. In addition to your data and content, we will also collect information about your use of Pal (e.g., your requests to other Pals, your set events or activities) as well as your interactions with us (e.g., contact requests).4. Data processing - External services
Pal shall not pass your information to any third party (other than as described in this paragraph). A transfer of the data collected by us takes place only if:you have given explicit consent; disclosure is required to assert, exercise or defend legal claims and there is no reason to assume that you have a predominantly legitimate interest in refraining from passing on your data; we are required by law to disclose such data; or such disclosure is legally permissible and required in relation to contracts, or pre-contractual measures, related to our engagement with you, which are carried out at your request.
For us to offer you all the functions of Pal, we use certain third party and external service providers and provide your personal data to them as follows:
4.1. We host Pal via our hosting partner AWS (Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, United States). We will provide AWS with the data that you have entered into your Pal account (whether it be the information that you must supply to us to use Pal or other voluntary information that you choose to submit to Pal), as well as data (e.g., Facebook or Google integrations) from the services you use. This data is hosted by AWS on our behalf on an AWS server within the European Union, so we can provide Pal to you and other users. This data is not visible to AWS and does not allow AWS to draw conclusions about you and your usage behavior. Further information on AWS can be found at https://aws.amazon.com.
4.2. If you permit them, we will send you push notifications. For this, we use OneSignal's push service (OneSignal Inc., 2194 Esperanca Avenue, Santa Clara, CA 95054, USA). We provide OneSignal with our identification number and the content of the push notification so that we can send you the push notification via OneSignal. Our identification number for you does not allow OneSignal to access your data and your usage behavior. More information about OneSignal can be found at https://onesignal.com/privacy_policy.
4.3. When you purchase Pal Coins, your in-app purchase will be billed by your app store provider (such as Apple or Google), your payment method (such as your credit card), and according to the payment terms of the relevant app store. Please note that as a rule we do not have any direct influence on the extent of the data that is transferred or transferred to us during payment processing. For more information about Apple Store privacy, visit https://www.apple.com/privacy/privacy-policy/ and visit Google at https://www.google.com/intl/en/policies/.
4.4. We also incorporate integrations from Facebook (Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA) and Google (Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA). Among other things, these Connect-features are there so you can log into Pal with one of your social media profiles. Please note that we generally do not have a direct impact on the amount of data that is or will be transferred to or from us through these integrations, depending on your account settings on the applicable social media platform. As far as we do have influence on the structure of the integrations, we collect, save and process your personal data only according to applicable data protection law. The login integrations only transfer the public profile information (e.g., profile, name, e-mail address, age, occupation, place of residence, gender) specified by you, as well as your automatic account identification numbers that are stored on the applicable site. We do not have access to your Facebook or Google profile, and cannot post anything to your timelines. For more information on the terms and conditions of use and your account settings, please visit Facebook at https://www.facebook.com/policy.php and go to Google at https://www.google.com/intl/en /policies /.
4.5. We also include Google Maps so you can use Pal's location-specific features (such as location suggestions). If you use Google Maps on Pal, it means that Google is processing the IP address of your device because Google will not be able to display the map view without it. We have no influence on how Google processes the IP address. For more information on Google privacy, please visit https://www.google.com/intl/en/policies/.
4.8. You can recommend Pal to your friends, for example via social media integrations, e-mail, SMS and WhatsApp. We would like to point out to you, however, that if you do this, your respective contact details and the recipient of your choice as well as your recommended content will be transmitted to the selected service provider, over which we have no influence. Please inform yourself about the nature and extent of this data transfer with the corresponding service provider (e.g., your e-mail or mobile service provider, WhatsApp etc.)
4.9. Other service providers of ours, including, in particular, data centers storing Pal and its associated databases, and IT service providers who maintain our systems. If we pass on data to our service providers, they are only permitted to use such data to fulfill their tasks. These service providers have been carefully selected and commissioned by us, are only allowed to process such data on our instructions and in accordance with our agreement with them and have appropriate technical and organizational measures to protect your rights. We also regularly monitor such service providers.5. Storage time
As a matter of principle, we store personal data only as long as necessary to fulfill the contractual or legal obligations for which we have collected the data and, as mentioned above, we store this personal data in the EEA. Once our obligations to you are complete we delete the data immediately, unless we need to keep it for other legal reasons. Note that we must retain contract information for three years from the end of the year in which the business relationship ends with you (the end of such period being the earliest date at which claims become statute barred). Thus, if you close your Pal account, we will still keep your data until three years after such closure and, in certain instances, we sometimes have to save your data for longer for accounting reasons (a period of up to ten years).6. Your rights
6.1. You have the right to request information about the processing of your personal data by us at any time. We will explain our data processing practices to you and provide an overview of the personal data that we hold on you.
6.2. If data stored with us is incorrect or out-of-date, you have the right to have this information corrected.
6.3. You can also request the deletion of your data. If the deletion is not possible e.g., for legal reasons, the data will be blocked, so that it is only available for such purposes.
6.4. You can also restrict the processing of your data, e.g. if you believe that the information we hold is incorrect.
6.5. You have the right to data portability for any data where we have relied on consent to collect it (as indicated above). This means that we will will send you a digital copy of such personal data if you request it.
6.6. In addition, you have the right to object to data processing in certain circumstances.
To exercise your rights as described here, you can contact us using the details in paragraph 1 above. You also have the right to complain to the applicable data protection regulator at any time. You may assert this right with a regulatory authority in the Member State of your residence, your place of work or the place of alleged infringement. As we are incorporated in the UK, our regulatory authority is: https://ico.org.uk7. Right of revocation and opposition
In accordance with Article 7 (2) of the GDPR, you have the right to revoke any consent given to us at any time. If you do this, we will not continue any data processing based on such consent for the future. If you would like to exercise your right of revocation you can contact us using the details in paragraph 1 above.8. Data Security
10.1. We may, in the future, be a party to a sale of some or all of our business, our assets or as part of any business restructuring or reorganisation and in relation to which your data may be transferred to the third party acquirer. If such a transaction occurs, we will take steps with the aim of ensuring that your rights under applicable data protection law continue to be protected.
10.2. The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to Pal; any transmission is at your own risk. Once we have received your data, we maintain appropriate security measures to protect your personal data including use of as strong, up-to-date and secure encryption techniques as possible for all data transmissions. Nevertheless, you should be careful not to pass your login data to third parties.11. Technical information
Operating system Android:Settings - Google Ads - "Reset Advertising ID" and / or "Disable About location settings: http://support.google.com/nexus/answer/6179507?hl=en and http://support.google.com/pixelphone/answer/3467281 and general http://support.google.com/accounts/answer/3118621?hl=en
Operating system iOS (Apple):Settings - Privacy - Advertising - "Ad-ID reset" and / or "no ad-tracking" Privacy and location information also available at: http://support.apple.com/en-US/HT203033
© Pal App Limited – Version 1.1. / as of May 2018