Source: https://8fit.com/privacy/
Timestamp: 2019-04-23 22:12:59+00:00

Document:
All data required for the processing, preparation and performance of an agreement with 8fit. If other service provides are involved in the performance of the agreement, e.g. payment services, optimization services or hosts, your data will be forwarded to them to the extent required.
When you access our Services, some information is exchanged between your device and our server, or the server of the services we use. This may include personal information. One of the ways in which the information gathered in this way will used is to further improve our Service.
Under the GDPR, you have various rights that you can assert with us. These include the right to selectively object to the use of data, particularly for advertising purposes. The option to object is highlighted in print. Further information on your rights can be found in the additional section below and in the individual descriptions of the respective data uses.
Our Services are only available to users who are 18 years of age or older. If you are not at least 18 years old, you may only use our Services if your parents have given their consent herein, and you have provided sufficient proof of this consent.
Information you enter yourself and that is generated during the use of our Services, such as gender, age, height, weight, training goals, training history, sporting activities, mealtimes, etc.
The legal basis for this is Art. 6(1) a) and b) and Art. 9(2) a) of the GDPR. Unless we use your contact information for customer support or customer service (see details under Section 3.3), the information required to conclude the agreement is stored until it is no longer needed for this purpose and/or until the rights under any guarantee or warranty expire. Subsequently, we retain the required personal information for the periods established by law. During this retention period (usually six to 10 years after conclusion of the agreement), the information is used only in the case of an audit by the tax authority.
If you have signed up for our Services, we manage you as an existing customer. In this case, we process your contact information in order to send you information about new, enhanced or improved features, products and services, etc.
To ensure that you receive only information that corresponds to your interests, we classify and add information to your customer profile. For this purpose, both statistical information as well as information about you (such as basic or historical data from your customer profile) are used. The goal is to optimize our Services by adapting them to your actual or perceived interests and/or needs, and to send you the appropriate recommendations and not bother you with useless ads.
The legal basis for each of the aforementioned data uses is Art. 6(1) b) and f) of the GDPR and Art. 9(2) a) of the GDPR. The use of existing customer data for the company’s own advertising purpose is recognized as a legitimate interest under Recital 47 of the GDPR.
The legal basis for this is Art. 6(1) a) GDPR. We store this information until the contract relationship ends as proof of the legality of sending the newsletter. After the contract relationship ends, we retain the required personal information for the period specified by law. During this period (usually 10 years from the conclusion of the agreement), the data will only be processed again in the event of a tax audit. You can revoke your consent at any time with effect for the future. Simply click on the unsubscribe button in the respective e-mail or send a short note by e-mail. Please use the options to contact the company’s data privacy officer for this purpose.
You may object to the use of your data for the aforementioned purposes at any time free of charge for each communication channel and with effect for the future. An email or a letter sent using the contact information shown under Section 2 is sufficient for this purpose.
Once you submit your objection, we will block the relevant contact address for future advertising data processing. We will process your objection as soon as possible and implement the appropriate blocking measures immediately after it is confirmed. Please note that in some exceptional cases the relevant information or product recommendations may still be received even after receipt of your objection. This is simply due to technical reasons and does not mean your objection has not been processed. Thank you very much for your understanding.
We will not sell or lease your information to third parties for their marketing purposes without your explicit consent. We only disclose certain information to third parties from time to time to be able to offer the best possible product to our customers, improve the quality of our Services and protect the interests of our customers. However, this disclosure will always be subject to strict limitations, which are described in more detail below.
If you already have a customer account and are logged on, the information stored in the cookies are associated with that account.
You can object to this data processing at any time by either clicking on the unsubscribe button of the respective newsletter or simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.
In the event that personal data is processed here, you can object to it at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.
The data processing for advertising on the basis of behaviour and interests is recognized as in our legitimate interest under Recital 47 of the GDPR. The information is stored for the legally established retention periods and then deleted.
More detailed information on this tool is available on the Yahoo Gemini website at https://policies.yahoo.com/ie/de/yahoo/terms/advertising/index.htm. You can object to this data processing at any time by following this link and clicking on the opt-out button: https://aim.yahoo.com/aim/us/en/optout/.
Information collected in this way is anonymous to us and therefore does not provide us with any information about the identity of the respective user. Such processing for behavioural and interest-based advertising purposes is recognized as in our legitimate interest under Recital 47 of the GDPR. The data is stored in accordance with the legally established retention periods and then automatically deleted.
To optimize targeting and track the conversion of our Facebook campaigns, in compliance with Art. 6(1) a) of the GDPR, we use the option of developing Facebook lookalike audiences offered to us by Facebook. You can find more information about the Facebook Lookalike Audiences at: https://www.facebook.com/business/help/365463786964246.
The data processing for advertising on the basis of behaviour and interests is recognized as in our legitimate interest under Recital 47 of the GDPR. If you belong to the Facebook Lookalike Audience, we send your email address and your device’s ID to Facebook. You can object to this special data processing at any time by changing your Facebook settings at https://www.facebook.com/settings/?tab=ads or simply inform us that you no longer want this processing in the future. Please use the contact options for our company’s data privacy officer for this purpose.
The legal basis of the aforementioned data processing is Art. 6(1) a) of the GDPR and Art. 9(2) a) of the GDPR. The purpose of the data collection above is the simplified login and the establishment and fulfilment of an agreement. This information is required for the conclusion of the agreement in order to be able to identify it. For the purpose and scope of Facebook’s data collection and the further processing and use of the information, as well as the associated rights and setting options to protect your privacy, please consult the Facebook privacy information.
When you log in to your Pinterest account after visiting our website while logged on, Pinterest might store and process this information, which is why we would like to inform you about this. Pinterest can link this data with your Pinterest account and use it for its own advertising purposes. You can read more about Pinterest’s data policy at https://policy.pinterest.com/de/privacy-policy. You can object to this special data processing at any time by disabling the relevant settings in your Pinterest account https://help.pinterest.com/de/articles/edit-your-settings#Web under “Personalization” or enabling the “Do not track” setting in your browser.
Events in the app and the use of individual features, such as your personal training plan, the activities you enter, access to recipes, or the period of use.
Data processed in this way to optimize our Services is considered to be in our legitimate interest. The information is stored in compliance with the legally established retention periods and then automatically deleted. You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.
This information is sent to a Google server in the U.S. and stored there. The information is used to evaluate the use of our Services, to compile reports on the activities, and to provide other related services for purposes of market research and customized design. This information may also be sent to third parties if required by law or if third parties process this data on behalf of Google. Under no circumstances will your IP address be merged with any other Google data. The IP addresses are anonymised so that assignment is not possible (IP masking).
You can prevent the installation of the cookies in advance by configuring your browser software accordingly or object to the continued processing of your data with the cookies by clicking on the opt-out link. Please note that if you disable cookies, it will not be possible to fully take advantage of all of the features of our Services. You can also prevent Google from collecting and processing the data generated by the cookies and related to your usage (including your IP address) by downloading and installing this browser add-on. On mobile devices, we recommend using private mode. You can find more information on protecting your privacy in relation to Google Analytics on the Google Analytics website.
For the custom design and continuous improvement of our App, and for purposes of our own market research, we use the Adjust usage analytical tool of Adjust GmbH, Saarbrücker Str. 36, 10405 Berlin (hereinafter “Adjust”). We use Adjust to help us understand how our users find us and install our app. If you click on a link operated by Adjust, it will take you to the App Store via an Adjust server. Here, Adjust processes anonymous IP and MAC addresses, as well as the associated installation and event data. It is not possible for us or for Adjust to draw conclusions about an individual. The information collected in this way is used solely for the aforementioned evaluation purposes, specifically to analyse the feature and the use of the app by creating anonymous evaluations and graphics on the number of visits, the number of pages viewed per user, etc.
Events in the app and the use of individual features,, such as your personal training plan, the activities you enter, access to recipes, or the period of use.
Data processed in this way to optimize our app is considered to be in our legitimate interest. The information is stored in compliance with the legally established retention periods and then automatically deleted. You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose.
User profiles may be created from this information, which we use exclusively for the aforementioned purpose. Amplitude is certified in compliance with the Privacy Shield Framework and therefore meets European standards for lawful order data processing. You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose. You can find more information about data processing by Amplitude at https://amplitude.com/privacy. You can also send your questions directly to the Amplitude data privacy officer at: contact@amplitude.com.
To more efficiently manage the photos uploaded by you via the app and display them in your profile, in compliance with Art. 6(1) a) and Art. 9(2) a) of the GDPR, we use the Cloudinary cloud-based optimization tool of Cloudinary Ltd., 111 W Evelyn Ave, Suite 206, Sunnyvale, CA 94086, USA (hereinafter “Cloudinary”). When you upload a photo using the app, it is saved on Cloudinary’s servers. Cloudinary is certified in compliance with the Privacy Shield Framework and therefore meets European standards for lawful order data processing. In addition, Cloudinary guarantees us by contract that we have exclusive access to these data. You can object to this processing at any time by simply informing us that you no longer wish to have such processing in the future. Please use the contact options of our company data privacy officer for this purpose. You can find detailed information on data protection and your privacy at the Cloudinary website: http://cloudinary.com/privacy and http://cloudinary.com/tos.
As indicated above under 3.4 and 3.5, data may also be sent to recipients located outside the European Union or the European Economic Area. This applies in particular to the aforementioned processing of analysis and/or targeting technologies, which can result in data transmission to the servers of the service providers. Other recipients may be affiliated service providers that we need in order to provide our services, e.g. hosts, CRM tools, analytical service providers. These servers may be outside the EU, especially in the US. We make absolutely sure that these service providers guarantee data protection standards equivalent to those of the GDPR and that they comply with the applicable directives. Therefore, we only work with those service providers who are certified by the EU-US Privacy Shield. In case number C(2016) 4176), the European Commission established the suitability of this data protection level for certification in compliance with Art. 45 GDPR. The use of these certified service providers thus meets European standards for lawful data processing. In addition, we have obtained suitable contractual guarantees from all service providers based in other EU countries, which ensure compliance with these EU standards and the enforcement of the rights of affected persons, for example based on the standard contractual clauses of the European Commission.
As indicated above under 3.4 and 3.5, data may also be sent to recipients located outside the European Union or the European Economic Area. This applies in particular to the aforementioned processing of analysis and/or targeting technologies, which can result in data transmission to the servers of the service providers. Other recipients may be affiliated service providers that we need in order to provide our services, e.g. hosts, CRM tools, analytical service providers. These servers may be outside the EU, especially in the US. We make absolutely sure that these service providers guarantee data protection standards equivalent to those of the GDPR and that they comply with the applicable directives. Therefore, we only work with those service providers who are certified by the EU-US Privacy Shield Framework. In case number C(2016) 4176), the European Commission established the suitability of this data protection level for certification in compliance with Art. 45 of the GDPR. The use of these certified service providers thus meets European standards for lawful data processing. In addition, we have obtained suitable contractual guarantees from all service providers based in other EU countries that they are in compliance with these EU standards and protect the rights of affected persons, for example by using the standard contractual clauses of the European Commission.
The right to data portability, pursuant to Art. 20 of the GDPR.
Under the provisions of Art. 21(1) GDPR, the data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data.
We apply the highest standards to data security for our infrastructure and the processing of your data. For example, we use protection mechanisms for computers such as firewalls and data encryption. Our buildings and data are subject to physical access controls. Access to the personal information of our customers is only possible for those employees who need them to carry out their activities.
All personal data sent by you, including your payment information, is also transmitted using the generally accepted and secure SSL (Secure Socket Layer) standard. SSL is a secure and proven standard, e.g. it is also used for online banking. You will recognize a secure SSL connection with the placement of an “s” at the end of http (i.e. https: // …) in the address bar of your browser, or with the lock icon at the bottom of the browser.
We also apply suitable technical and organizational security measures to protect your personal data stored with us against manipulation, partial or complete loss, and against unauthorized access by third parties. Our security measures are continuously monitored using the latest technology, and regularly adapted to the relevant risk, and improved if necessary.
Protecting the privacy of young children is especially important. For that reason, we do not knowingly collect or solicit personal information from anyone under the age of 16 or knowingly allow such persons to register. If you are under 16, please do not send any information about yourself to us, including your name, address, telephone number, or email address. No one under age 16 is allowed to provide any personal information to or on the Services. In the event that we learn that we have collected personal information from a child under age 16 without verification of parental consent, we will delete that information as quickly as possible. If you believe that we might have any information from or about a child under 16, please contact us at datenschutz@8fit.com.
We are not a “covered entity” under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The HIPAA privacy rules and regulations apply to health plans, health care clearinghouses, any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (collectively, “covered entities”), and their service providers (“business associates”). This means that the personal data that you provide to us is not protected by the HIPAA privacy rules and regulations.

References: Art. 6
 Art. 9
 Art. 6
 Art. 9
 Art. 6
 Art. 6
 Art. 6
 Art. 9
 Art. 6
 Art. 9
 Art. 45
 Art. 45
 Art. 20
 Art. 21