PRIVACY POLICY
of
ANDEAVA GmbH
Tegernseer Landstraße 125
DE-81539 Munich

1. GENERAL
We take the protection and security of your personal data very seriously and collect, process, store and use your personal data exclusively in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the data protection laws in the Federal Republic of Germany.
This privacy policy describes the way in which ANDEAVA GmbH ("we" or "us") collects and processes the personal data we collect. We explain to you in detail what data we collect, how and for what purposes we process it, under what conditions and when it is deleted and what rights you have in relation to the data. If you have any questions about this privacy policy or the processing of your personal data, we will be happy to help you at support@andeava.com.
If you do not wish to provide your personal data on the basis of this privacy policy, you should not enter the relevant information on the website or otherwise provide us with your personal data. However, if you do not provide your personal data, you may not be able to use all services.
Personal data is any information relating to identified or identifiable natural persons, e.g. first name, surname, email address.

2. COLLECTION, PROCESSING, STORAGE AND USE OF YOUR DATA

2.1. COLLECTION, PROCESSING, STORAGE AND USE OF YOUR DATA WHEN YOU USE OUR WEBSITE

2.1.1. LOG DATA WHEN ACCESSING OUR WEBSITE/APP
Each time you access our website www.andeava.com - including any subdomain - and our app, information is sent to the server of our website or app by the respective Internet browser of your end device and temporarily stored in log files.
The stored data records contain the following data, which is stored until it is automatically deleted:
* Date and time of access,
* Name of the page accessed,
* IP address of the requesting device,
* Information on the end device used (operating system/platform, version of the operating system, mobile phone model, app version, browser version)
* Message whether the access was successful,
* Referrer URL (origin URL from which you came to our website),
* amount of data transferred,
* loading time,
* Product and version information of the browser used,
* name of the access provider.

This data is stored by our web server in log files. This data is not stored together with other personal data.
The legal basis for the storage of technically necessary cookies is TTDSG §25.
This data is used by us to enable the use of our website and its technical administration, to ensure the security of our information technology systems, to prevent the misuse of our website and to optimise our website.
The data will be deleted by us as soon as it is no longer required to fulfil the purpose for which it was collected. If the data is stored in log files, it will be deleted after seven days at the latest. Log data may be stored beyond this period if the IP address of your device is deleted or anonymised in such a way that it is no longer possible to assign the IP address to you.

2.1.2 COOKIES
We use cookies, tracking tools, targeting methods and social media plug-ins for our website and app. The exact procedures involved and how your data is used for this are explained below in section 4.1.

2.2. COLLECTION, PROCESSING, STORAGE AND USE OF YOUR DATA WHEN USING THE AREA OF OUR APP THAT REQUIRES REGISTRATION (USER LOGIN)
If you register with ANDEAVA with an account and/or conclude another contract with us, we process the data required for the conclusion, performance or termination of the contract with you:
* First name, surname
* email address
* Information about the transactions you have made
* Log file including player history, e.g. name of the game, date and time of the direct debit
* Information on the payment methods used
The legal basis for this is Article 6 paragraph 1 sentence 1 lit. b) GDPR, i.e. you provide us with the data on the basis of the respective contractual relationship (e.g. management of your user account, processing of a purchase contract) between you and us. We are also obliged to process your email address in the event of a purchase due to legal requirements in the German Civil Code (BGB) to send an electronic order confirmation (Article 6 (1) sentence 1 lit. c) GDPR).
We only store the data collected for contract processing for the duration of the contract. After expiry of this period, we retain the information required under commercial and tax law for the contractual relationship for the periods specified by law. For this period, the data will only be processed again in the event of a review by the tax authorities.
Your payment data will be passed on to payment service providers commissioned by us to process the payment(s). The respective data is transmitted solely for the respective purpose and deleted again after payment has been made.

2.3 Newsletter
To keep you informed about news, we offer you the opportunity to subscribe to our newsletter on our website. To ensure that no errors are made when entering your email address, we use the double opt-in procedure (DOI procedure): After you have entered your email address in the registration field and given your consent to receive our newsletter, we will send you a confirmation link to the email address provided. Only when you click on this confirmation link will your email address be added to our mailing list for sending our newsletter (Article 6(1) sentence 1(a) GDPR).
You can revoke your consent at any time with effect for the future by sending a message to support@andeava.com or by using the unsubscribe option at the end of each newsletter.

2.4 Recommendations by email
As our existing customer, you will regularly receive recommendations from us by email. You will receive these recommendations from us regardless of whether you have subscribed to a newsletter. We use the email address you provided during the purchase process to promote our own product. The legal basis for this data processing is (Article 6 (1) sentence 1 lit. f) GDPR, Section 7 (3) UWG.
You can object to our recommendations at any time with effect for the future by sending a message to support@andeava.com or at the end of each recommendation email, without incurring any costs other than the transmission costs according to the basic tariffs.

2.5 Competition
If you register for competitions organised by ANDEAVA, we may collect, store and process your (user) name and email address in order to carry out the competition and communicate with you in relation to the competition. We will delete your data immediately after the competition has ended. This does not apply to the winners' data. Here, in addition to the above-mentioned data, your name, address and telephone number will also be processed. We will ask for this data separately as part of the prize notification. Detailed information can be found in the respective conditions of participation for each competition. The legal basis for the associated data processing is either Article 6 paragraph 1 sentence 1 lit. b) GDPR, i.e. the processing of your data is necessary for the fulfilment of the agreement on your participation in the competition.

3. DISCLOSURE OF YOUR PERSONAL DATA
Your personal data will not be passed on, sold or otherwise transferred to third parties unless this is necessary for the fulfilment of a contract. Otherwise, we will only pass on your personal data to third parties within the scope of legal permission or on the basis of your consent, which can be revoked at any time for the future, and only to the extent necessary to fulfil our contractual obligations.

3.1 Payment processing
In order to offer you the best possible selection of payment methods, we work together with our partner PayPal (Europe) S. à. r.l. et Cie, S.C.A., 22-24 Boulevard Royal L-2449, Luxembourg and Stripe, Inc, 510 Townsend Street, San Francisco, CA 94103, USA. Your data will be passed on in accordance with (Article 6 (1) sentence 1 lit. b) GDPR exclusively for the purpose of payment processing with the payment service provider PayPal or Stripe. Your data will only be passed on if this is actually necessary for processing the payment. You can find more information on data protection at Stripe, Inc. at https://stripe.com/de/privacy/. You can find more information on data protection at PayPal (Europe) S. à. r.l. et Cie at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

3.2 Authentication
ANDEAVA uses an external identity provider for authentication. ANDEAVA uses a procedure for "delegation of authentication". ANDEAVA uses the Google Firebase authentication software module for your login (more information at https://firebase.google.com ' auth) and transmits the user's e-mail address and password to Google Firebase Authentication for this purpose.

3.4.3 Content Delivery Networks (CDN)
ANDEAVA uses a CDN (Content Delivery Network), namely "Cloud CDN" from Google LLC. A CDN is used in particular to reduce the loading time of the website and app or certain content, e.g. by sending files from a very fast server that is as close as possible to your location. The processing is carried out in order to shorten the loading time of our website. The processing is necessary so that we can provide you with the corresponding service, §25 para. 2 no. 2 TTDSG.

3.4.5 Other reasons for disclosure
Your personal data will not be transferred to third parties for purposes other than those listed below.
We only pass on your personal data to third parties if:
* you have given your express consent to this in accordance with Article 6 paragraph 1 sentence 1 lit. a GDPR.
* the disclosure pursuant to Article 6 (1) sentence 1 lit. f GDPR is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data.
* In the event that there is a legal obligation to disclose the data in accordance with Article 6 (1) sentence 1 lit. c GDPR.
* This is legally permissible and necessary for the processing of contractual relationships with you in accordance with Article 6 (1) sentence 1 lit. b GDPR.

4. EVALUATION OF THE USAGE BEHAVIOUR

4.1 Cookies - General information
We use cookies on our website to make your visit to our website attractive and to enable the use of certain functions as well as to statistically record the use of our website. These are small files that your browser automatically creates and that are stored on your end device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your end device and do not contain any viruses, Trojans or other malware. Information is stored in the cookie that results in each case in connection with the specific end device used. However, this does not mean that we obtain direct knowledge of your identity.
Most of the cookies we use are deleted again at the end of the browser session (so-called session cookies). In addition, we also use temporary cookies to optimise user-friendliness, which are stored on your end device for a specified period of time. If you visit our site again to use our services, it is automatically recognised that you have already visited us and which entries and settings you have made so that you do not have to enter them again. We only set these cookies if you have given your consent Article 6 paragraph 1 sentence 1 lit. a) GDPR, §25 paragraph 1 TTDSG.

4.1.1 Google Analytics & Google Firebase Analytics
We use Google Analytics, a web analysis service of Google Inc. ("Google"), on the basis of Article 6 (1) sentence 1 lit. a) GDPR for the purpose of demand-oriented design and continuous optimisation of our website. Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyse how users use the site. In this context, pseudonymised usage profiles are created and cookies are used. The information generated by the cookie about your use of this website, such as browser type/version, operating system used, referrer URL (the previously visited page), host name of the accessing computer (IP address) and time of the server request.
Google will use this information on behalf of the operator of this website to analyse your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
ANDEAVA also uses Google Firebase Analytics. Firebase Analytics is a service that can be used to collect and analyse app usage data from smartphones. For this purpose, selected actions during the use of the app are transmitted to Firebase Analytics in encrypted and pseudonymised form in order to analyse general user behaviour with regard to efficiency and similar considerations and to draw conclusions about the continuous improvement of the app in the course of the evaluation.
You can find more information on the use of data by Google in the company's privacy policy: https://www.firebase.com/terms/privacy-policy.htm

4.1.2. Firebase Remote Config
The "ANDEAVA" app uses Firebase Remote Config so that we can change the app on the end devices on which it is installed without having to completely reinstall it from the respective app store each time a change is made. For this purpose, your device information, your language settings and your country settings are transferred to Google in the USA and processed there.
Information about how Remote Config works can be found here: https://firebase.google.com/products/remote-config/.

4.1.3 Use of Fabric (including Crashlytics)
We use Fabric in our app, including Crashlytics, a web analysis service operated by Twitter Inc. 795 Folsom St., Suite 600, San Francisco, CA 94107 ("Twitter"), to improve the app and correct errors such as crashes. The data collected for this purpose is made available to us in anonymised form and becomes the property of Twitter. We are notified of crashes and see the line of code that caused the crash, the type of mobile device and operating system installed, the amount of free RAM and flash memory, and whether the operating system has been jailbroken. We use this data to reproduce the error as well as possible and then fix it in one of the next versions.The data stored by Fabric itself is described in Fabric's terms and conditions (https://fabric.io/terms).

4.1.4 Push notifications
If you use the "ANDEAVA" app, we have also provided the technical option of sending you push notifications in addition to emails if you have consented to the transmission of push notifications (Article 6 (1) sentence 1 lit. a) GDPR). You can revoke your consent at any time for the future and you can delete your account at any time. A push notification is a notification that new information is available for the app. You can then decide to view or ignore it. When a push notification is sent, your device data is forwarded to the push notification system of the operating system of your smartphone or tablet computer so that the push notification can be sent and received by you. As a rule, this is Firebase Cloud Messaging from Google, Inc. based in the United States. A data processing addendum has been concluded with Google and Google is self-certified under the Privacy Shield. The general privacy policy and terms of use of Google (https://policies.google.com/privacy?hl=de), for Firebase the terms of use (https://firebase.google.com/terms/) are available in English. Firebase Cloud Messaging provides us with anonymised and aggregated statistics and analyses of usage behaviour in order to identify possible errors and improve the apps (Article 6 (1) sentence 1 lit. a) GDPR). If you do not wish to receive push notifications from us in the future, you can change your settings in the ANDEAVA app at any time.

5. RESPONSIBLE BODY
The controller responsible for processing your personal data is
ANDEAVA GmbH
Tegernseer Landstraße 125
DE- 81539 Munich, Germany
Email address: support@andeava.com

6. DATA PROTECTION OFFICER
We do not have an external data protection officer, but are responsible for the processing ourselves as the controller and can be contacted using the contact details provided under no.

7. LOCATION OF YOUR DATA / DATA SECURITY
Our servers and data centres are located in Frankfurt / Germany.
As a rule, we process your personal data within the European Union. However, we also use the services of some third-party providers. If these third-party providers are located in territories that do not provide a level of data protection equivalent to the regulations applicable within the European Union, we take all necessary steps to ensure that your personal data is adequately protected. We achieve this either by concluding data protection contracts (in particular the standard contractual clauses of the EU Commission). We also ensure that any third-party providers work according to appropriate security standards and are certified.
We take various physical, technical, organisational and administrative security measures to protect your data to the appropriate extent, depending on the sensitivity of the data.
We use SSL encryption on our website for security reasons, in particular to protect your personal data. You can recognise the encrypted connection by the lock symbol in the address bar of your browser.

8. YOUR RIGHTS

8.1. Right to information
You are entitled to request information from us at any time and free of charge as to whether personal data concerning you is being processed by us. If this is the case, you have a right to information about this personal data and to the following information:
* the purposes for which the personal data concerning you are processed;
* the categories of personal data being processed
* the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed
* the envisaged period for which the personal data concerning you will be stored, or, if not possible, the criteria used to determine that period
* the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by us as the controller and a right to object to such processing

* the existence of a right to lodge a complaint with a supervisory authority
* all available information about the origin of the data if the personal data is not collected from you
* the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
You are also entitled to request information from us as to whether your personal data is transferred to a third country or to an international organisation. In this context, you may request to be informed by us about the appropriate safeguards pursuant to Art. 46 GDPR.
To protect your data, we reserve the right to request proof of identity.
We can provide the data protection information in a common electronic format.

8.2. Right to rectification
You also have the right to request that we rectify inaccurate personal data. Furthermore, taking into account the purposes of the processing of your personal data, you have the right to request that we complete incomplete personal data.

8.3. Right to restriction of processing
You have the right to obtain from us restriction of processing of your personal data where one of the following applies:
* if you contest the accuracy of the personal data concerning you, for a period enabling us to verify the accuracy of the personal data;
* if the processing is unlawful and you oppose the erasure of the personal data concerning you and request the restriction of their use instead;
* we no longer need the personal data concerning you for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims
Or
* you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether our legitimate grounds override yours.
If the processing of your personal data has been restricted, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
If you have obtained a restriction on the processing of your personal data, you will be informed by us before the restriction is lifted.

8.4. Right to erase (“The right to be forgotten”)
You have the right to obtain from us the erasure of your personal data without undue delay where one of the following grounds applies:
* The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
* You withdraw your consent on which the processing is based according to point (a) of Article 6(1) sentence 1 GDPR, or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing;
* You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR;
* The personal data concerning you has been processed unlawfully;
* the erasure of personal data concerning you is necessary for compliance with a legal obligation in Union or Member State law to which we are subject
* The personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
If we have made personal data public and we are obliged to delete it in accordance with Art. 17 para. 1 GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process your personal data that you have requested us to delete all links to your personal data or copies or replications of your personal data.
The right to erasure of your personal data does not exist if the processing is necessary:
* to exercise the right to freedom of expression and information
* for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us
* for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR
* for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing
or
* for the establishment, exercise or defence of legal claims.
If you have asserted your right to rectification, erasure or restriction of processing of your personal data against us, we are obliged to notify all recipients to whom your personal data has been disclosed of the rectification, erasure or restriction of processing of your personal data, unless this proves impossible or involves a disproportionate effort. You have the right to be informed by us about the recipients of your personal data.

8.5. Right to data portability
You have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, provided that:
* the processing is based on consent pursuant to Article 6 (1) sentence 1 lit. a GDPR or Article 9 (2) lit. a GDPR or on a contract pursuant to Article 6 (1) sentence 1 lit. b GDPR and
* the processing is carried out by automated means.
In exercising your right to data portability, you also have the right to have your personal data transmitted directly from us to another controller without hindrance from us, where technically feasible. The freedoms and rights of others must not be affected by this.
The right to data portability does not apply to the processing of your personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

8.6. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
We will no longer process your personal data after your objection unless we can demonstrate compelling legitimate grounds for the further processing of your personal data which override your interests, rights and freedoms, or the further processing of your personal data serves the establishment, exercise or defence of legal claims.

8.7. Right to withdraw consent under data protection law
You have the right to withdraw your data protection consent at any time. Your revocation does not affect the legality of the processing of your personal data carried out on the basis of your consent until revocation.

8.8. Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the provisions of the GDPR. The supervisory authority with which you have lodged your complaint will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

9. UPDATING
We reserve the right to amend this Privacy Policy from time to time. We will inform you in advance of any significant changes to the privacy policy.
The use of your personal data is subject to the current version of the Privacy Policy, which can be accessed via "PRIVACY POLICY" on our websites. If you continue to access our websites after the changes come into force, you declare your consent to the updated privacy policy.
If you have any questions or comments about the above privacy policy, please do not hesitate to contact us. Please send an email to support@andeava.com

Status: January 2024