Privacy Policy

Introduction

This privacy policy explains the types of personal data (also referred to as "data") we process, for which purposes and to what extent. It applies to all processing of personal data carried out by us in providing our services, particularly on our websites, in mobile applications and on external online presences such as our social media profiles (collectively referred to as our "online services"). The terms used are not gender-specific.

Contents

• Introduction
• Controller
• Overview of Processing
• Registration and User Accounts (Apps)
• Location Data and Google Maps
• Premium Features and In-App Purchases
• Finanzentracker
• Legal Bases
• Security Measures
• Transfer and Disclosure of Personal Data
• Processing in Third Countries
• Use of Cookies
• Provision of the Website and Web Hosting
• Contacting Us
• Your Rights
• Definitions

Controller

Son Hai Vu
Hai Tech Solutions
Stuttgarter Str. 134
73312 Geislingen
Germany
Phone: +49 152 37349594
Email: info@haitechsolutions.com

Overview of Processing

The following overview summarises the types of data processed, the purposes of processing and the people concerned.

Types of Data Processed

• Basic data (e.g. names and addresses).
• Content data (e.g. text entries, photographs and videos).
• Contact data (e.g. email addresses and telephone numbers).
• Metadata and communication data (e.g. device information and IP addresses).
• Usage data (e.g. pages visited, interest in content and access times).
• Location data (e.g. GPS coordinates when using location-based app features).
• Purchase and subscription status (no payment details, as payments are processed by Apple or Google).

Categories of Data Subjects

• Communication partners.
• Users (e.g. website visitors and users of online services).
• Users of our mobile applications Finanzentracker, Neo Seichi and Omakase GO.

Purposes of Processing

• Responding to enquiries and communicating.
• Providing our online services and improving usability.
• Providing and personalising our mobile apps and location-based features.
• Providing paid premium features.
• Security measures (e.g. protecting our servers against misuse and overload).

Registration and User Accounts (Apps)

Certain features of our mobile apps Neo Seichi and Omakase GO require a user account (profile). You may register using an email address and password or a single sign-on service, such as "Sign in with Google" or "Sign in with Apple". When you use single sign-on, the provider supplies the data needed to create your account (e.g. name, email address and a unique identifier), where you have previously consented to its disclosure. Within your account, we process in particular your email address, display name, profile picture (if provided), progress, stamps or achievements and settings. You may request deletion of your account at any time through the app's settings or by contacting us at the address in the legal notice.

• Data subjects: users of our applications.
• Data types: basic data, contact data and usage data.
• Purposes: providing user accounts, personalisation and performance of a contract.
• Legal bases: performance of a contract (Art. 6(1)(b) GDPR); for single sign-on, additionally consent (Art. 6(1)(a) GDPR).

Location Data and Google Maps

Core app features, such as searching for nearby places, check-ins and map views, require location data. GPS coordinates are processed only if you grant the corresponding permission on your device. You can revoke permission at any time in your operating system's settings.

To display maps and location-based content, we use Google Maps Platform, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Location and usage data may be transmitted to Google servers, including outside the EU/EEA (e.g. in the USA). Google processes this data under its own privacy policy, available at policies.google.com/privacy. Transfers to the USA rely on the European Commission's Standard Contractual Clauses or, where applicable, Google's certification under the EU-U.S. Data Privacy Framework.

• Data subjects: users of our applications.
• Data types: location, device and usage data.
• Purposes: location-based features (nearby searches, check-ins and map displays).
• Legal bases: consent (Art. 6(1)(a) GDPR) through operating system location permissions; performance of a contract (Art. 6(1)(b) GDPR).

Premium Features and In-App Purchases

Our apps offer optional paid premium features through the Apple App Store or Google Play Store in-app purchase systems. Payments are handled entirely by Apple Inc. or Google Ireland Limited. We do not receive or store payment or credit card details. We receive only confirmation of a purchase or subscription status (e.g. active, expired or cancelled) to enable the relevant features in your account. For details of their data processing, see the privacy policies of Apple and Google.

• Data subjects: users of our applications with premium subscriptions.
• Data types: purchase and subscription status (no payment details).
• Purposes: enabling paid features and handling contracts.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Finanzentracker (com.hdmstuttgart.financemanager)

The mobile app Finanzentracker is provided by Hai Tech Solutions. It requires no user account and does not process or store personal data on external servers.

• Local storage: all financial data and settings you enter remain exclusively on your device until you delete them.
• No tracking: no analytics services, advertising networks or tracking tools are used. The app does not transmit app data to us or third parties. We have no access to it.
• Data deletion: you can remove all local app data in Android settings under "Apps", "Finanzentracker", "Storage", "Clear data" (labels may vary).

Information about user accounts, location data, Google Maps and in-app purchases concerns Neo Seichi and Omakase GO, not Finanzentracker. Hosting, cookies and reCAPTCHA concern this website.

Legal Bases

We process personal data on the following bases under the General Data Protection Regulation (GDPR). National data protection rules in your country or ours may also apply. Where a more specific legal basis applies, it is identified in the relevant section of this policy.

• Consent (Art. 6(1)(a) GDPR): the data subject has consented to processing their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR): processing is necessary to perform a contract with the data subject or to take steps at their request before entering into a contract.
• Legitimate interests (Art. 6(1)(f) GDPR): processing is necessary for the legitimate interests of the controller or a third party, unless overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data.

National Data Protection Rules in Germany

German national data protection rules apply in addition to the GDPR, particularly the Federal Data Protection Act (BDSG). This includes specific provisions on access, erasure, objection, processing special categories of data, processing for other purposes, transfers and automated individual decision-making, including profiling. Data protection laws of the individual German states may also apply.

Security Measures

In accordance with legal requirements, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. We consider the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the varying likelihood and severity of risks to individuals' rights and freedoms. Measures include protecting confidentiality, integrity and availability through controls on physical and electronic access, data entry, disclosure, availability and separation. We have procedures for exercising data subject rights, deleting data and responding to threats to data security. We also consider privacy by design and by default when developing or selecting hardware, software and processes. This website is transmitted exclusively over an encrypted SSL/TLS connection, identified by "https://" in the address bar.

Transfer and Disclosure of Personal Data

When processing personal data, we may transfer it to or disclose it to other bodies, companies, legally independent organisational units or individuals. Recipients may include IT service providers, such as our hosting provider, or providers of services integrated into this website. We comply with legal requirements and enter into appropriate contracts or agreements to protect your data, such as data processing agreements, with recipients.

Processing in Third Countries

Processing in a third country outside the European Union (EU) or European Economic Area (EEA), including through third-party services or disclosure to other people or organisations, takes place only in accordance with legal requirements. Subject to explicit consent or transfers required by contract or law, we process data in third countries only where there is a recognised level of data protection, such as a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework for certified US processors), or appropriate safeguards, such as the Commission's Standard Contractual Clauses, certifications or binding corporate rules (Articles 44 to 49 GDPR). See the European Commission's information on international data transfers.

Use of Cookies

We store your consent choice locally on your device in Local Storage for 180 days. Optional services such as Google reCAPTCHA are loaded only after your consent. You can change your choice and withdraw consent for the future at any time using "Cookie settings" in the footer. On withdrawal, the page reloads to stop previously loaded Google content from continuing to run. Cookies already set by Google can be deleted in your browser settings.

Cookies are text files containing data from visited websites or domains, stored by a browser on the user's computer. They primarily store information about a user during or after a visit, such as language settings or login status. We also use the term to cover technologies serving the same purposes, such as pseudonymous online identifiers, also known as user IDs.

Current use on this website: we do not currently use analytics, marketing or tracking cookies. If we introduce cookies or similar technologies in the future, we will provide separate information here and obtain prior consent where required.

Withdrawal and Objection (Opt-Out)

Depending on whether processing is based on consent or statutory permission, you may withdraw consent or object to processing using cookie technologies at any time (collectively, "opt-out"). You can initially express your objection through your browser settings, for example by disabling cookies, although this may limit the functionality of our online services.

Provision of the Website and Web Hosting

To provide our online services securely and efficiently, we use one or more web hosting providers whose servers, or servers they manage, deliver the website. Services may include infrastructure and platform services, computing capacity, storage, databases, security and technical maintenance. Data processed may include all information about users arising from use and communication, particularly IP addresses needed to deliver content to browsers and any information entered on our website.

Hosting provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

Domain registrar: this website's domain was registered through Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA.

Access Data and Log Files

We, or our hosting provider, collect data about each server access in server log files. These may contain the address and name of pages and files requested, date and time, data volumes transferred, whether retrieval succeeded, browser type and version, operating system, referrer URL (the previously visited page), and generally the IP address and requesting provider. Logs are used for security, including preventing server overload from abusive attacks such as DDoS, and ensuring server capacity and stability.

• Data types: content data, usage data, metadata and communication data.
• Data subjects: users, such as website visitors.
• Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

Contacting Us

When you contact us, for example by email, we process the information you provide as necessary to answer your enquiry and take any measures requested. Enquiries relating to contractual or pre-contractual relationships are handled to fulfil our contractual obligations or respond to pre-contractual requests. Other enquiries are handled on the basis of our legitimate interest in responding.

Google reCAPTCHA

With your consent, we use Google reCAPTCHA v2 to protect our contact form against automated requests and spam. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading and using the check transmits data including your IP address, browser and device information, and interaction data to Google. Google may set cookies and process data in the USA. Messages through the form are sent only after successful verification. Alternatively, you can contact us directly by email. The legal basis is your consent (Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG). You can withdraw consent at any time through the cookie settings in the footer. Further details are in Google's privacy policy and terms of service.

• Data subjects: communication partners.
• Purposes: responding to enquiries and communicating.
• Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
• Data types: basic data, contact data and content data.

Your Rights

You have the right to obtain information free of charge about the origin, recipients and purposes of your stored personal data, and to request rectification, erasure or restriction of processing. You also have rights to data portability, to withdraw consent and to object to processing. To exercise these rights or ask questions about data protection, contact us at the address in the legal notice. You also have the right to lodge a complaint with the competent supervisory authority.

Definitions

This section explains terms used in this privacy policy. Many are defined by law, particularly in Article 4 GDPR. The statutory definitions are binding; the explanations below aid understanding.

• Personal data: any information relating to an identified or identifiable natural person (the data subject). A person is identifiable directly or indirectly, particularly through an identifier such as a name, identification number, location data, online identifier (e.g. a cookie), or factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
• Controller: the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
• Processing: any operation or set of operations performed on personal data, whether or not automated. It covers virtually all handling of data, including collection, analysis, storage, transmission and deletion.
• Processor: a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
• Third party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorised to process personal data under the direct authority of the controller or processor.
• Consent: a freely given, specific, informed and unambiguous indication of the data subject's wishes, expressed by a statement or clear affirmative action, agreeing to the processing of their personal data.