Data Privacy

The following data protection declaration applies to contractual users of the Forevermind app (hereinafter referred to as “app”).

For people who have received a message, it is necessary to register on our Forevermind service. For these, only the data processing operations under Section II 8 (setup data and username for message recipients) are relevant. The further data protection information, in particular on the rights of those affected, also applies to these.

The protection of your personal data (hereinafter referred to as “data”) is a major and very important concern for us. In the following we would therefore like to inform you in detail about the processing of your data when using the platform and the app.


I. Name and contact details of the person responsible

The person responsible within the meaning of the data protection regulations for the processing of personal data is:

Forevermind GmbH

Adress: Friedrich-Eberle-Str. 4d, D-76227 Karlsruhe
E-Mail: info@forevermind.de
Webseite: www.forevermind.de


II. Purpose of processing personal data,  legal basis and storage period

Below we inform you about the processing of your data through the use of the platform and the app. Below we inform you about the processing of your data through the use of the platform and the app. Insofar as we are responsible for the processing of your data, we will inform you below about the data processing operations that take place when using the app (a), their purpose (b), legal basis (c) and the respective storage period (d).

1. Processing of your data within the framework of our contractual relationship and our business relationship in general

a)

We process personal data that we receive from you as part of our business relationship or our contractual relationship, including its initiation.

Relevant personal data are personal details (name, address and other contact details such as e-mail address). In addition, this can also be order data, data from the fulfillment of our contractual obligations, documentation data and other data comparable to the categories mentioned.

b) and c)

We process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG)

aa. to fulfill contractual obligations (Art. 6 Para. 1 b GDPR)

The processing of data takes place to provide our services within the framework of the execution of our contracts with our customers or to carry out pre-contractual measures that take place at their request. The purposes of data processing are primarily based on the specific product or service. In particular, data processing takes place

  • to be able to identify you as our customer;
  • to correspond with you;
  • for invoicing.

Further details on the data processing purposes can be found in the relevant contract documents and terms and conditions.

bb. as part of the balancing of interests (Art. 6 Para. 1 f GDPR)

If necessary, we process your data beyond the actual fulfillment of the contract to protect our legitimate interests or those of third parties. Examples:

  • Advertising, unless you have objected to the use of your data,
  • assertion of legal claims and defense in legal disputes,
  • Ensuring IT security and IT operations,
  • Prevention and investigation of criminal offenses
cc. based on your consent (Art. 6 Para. 1 a GDPR)

If you have given us your consent to the processing of personal data for specific purposes, the legality of this processing is given on the basis of your consent. A given consent can be revoked at any time. The revocation of consent is only effective for the future and does not affect the legality of the data processed up to the point of revocation.

dd. due to legal requirements (Art. 6 Para. 1 c GDPR)

In addition, as a company, we are subject to various legal obligations, i.e. legal requirements (e.g. tax laws). The purposes of processing include, among other things, the fulfillment of tax reporting obligations and the assessment and management of risks within our company.

d)

We process and store your personal data for as long as this is necessary to fulfill our contractual and legal obligations. It should be noted that our business relationship is usually a continuing obligation, which is designed to last for years.

If the data is no longer required for the fulfillment of contractual or legal obligations, they are regularly deleted, unless their – temporary – further processing is necessary for the following purposes:

  • Fulfillment of storage obligations under commercial and tax law, which can result, for example, from: Commercial Code (HGB), Fiscal Code (AO). The retention and documentation periods stipulated there are generally six to ten years.
  • Preservation of evidence within the framework of the statutory statute of limitations. According to §§ 195 ff of the German Civil Code (BGB), these limitation periods can be up to 30 years, whereby the regular limitation period is 3 years.


2. Registration with the Platform and the App

The app is available through distribution platforms operated by third parties, so-called app stores (Google Play Store and Apple Store). Your download may require prior registration with the relevant app store and installation of the app store software. We have no influence on the collection, processing and use of personal data in connection with your registration and the provision of downloads in the respective app store and the app store software. In this respect, the sole responsible body is the operator of the respective app store. If necessary, please contact the respective app store provider directly for more information.

3. Setup Data and Username

a)

After installation, the app requires the following setup data: “Name”, “First name”, “E-mail address”, “Date of birth”, “Password” and “Activation code”.

b)

This setup data is required for the app to function. Your e-mail address acts as a username and is used to uniquely identify you. You also need this user ID to log in to the app.

c)

This setup data is required for using the app and is stored on the basis of Art. 6 (1) lit. f GDPR, unless another legal basis is given. We have a legitimate interest in this setup data for the technically error-free and provision of the app.

d)

This setup data is deleted when the app is uninstalled.


4. Password

a)

Your personal password, which you assigned yourself to participate in our “Forevermind” platform, is also required to log in to the app. If you change your password, the new password also applies to the app.

If your smartphone technically supports biometric registration, a technical password will be generated by the app for identification and stored by us.

When using the fingerprint sensor to log in, a native function of your smartphone is accessed. An die App wird ausschließlich des erfolgreichen oder nicht erfolgreichen Ergebnisses der Fingerabdruck-Überprüfung übermittelt.

b)

We store your password to prevent unauthorized access to your account on our platform.

c)

The password is required to use the app and is stored on the basis of Art. 6 (1) lit. f GDPR, unless another legal basis is given. Our legitimate interest lies in preventing unauthorized access to your account through use of the app.

d)

Your personal password will be deleted when you log out of the Forevermind platform.

The technical password that is created when you use biometric login is deleted after the app account is terminated.

5. Profile data of your own profile

a)

After installing the app, you can store your profile data with us. You can optionally store the following information in your user profile:

  • Profile pic
  • Street, house number
  • Additional information address
  • POSTCODE
  • City
  • country
  • Place of birth
  • Mobile phone number
b)

The data is processed by us so that the app can fulfill its contractually agreed functionality. The processing serves to fulfill the contract.

c)

The legal basis for processing is Art. 6 (1) sentence 1 lit. b GDPR.

d)

The data will be deleted when the usage contract ends or when the contractually agreed period of storage and availability ends.

6. Trustee(s) and Recipients

a)

In order to ensure correct functionality when delivering messages, the designation and confirmation of at least one and a maximum of two trusted persons is required. You also have the option of storing the data of message recipients on our platform. However, the scope of data processing also depends on the data you store on the platform.

Please note that the following information with personal reference is – also – personal data that concerns you, since the information stored is linked to your account.

Insofar as this information also has a personal reference to you, we will inform you about the data processing operations that take place when you use the app.

Please note, however, that you alone determine the purpose and means of processing, which data from which people you store on the platform. This means that you are responsible for the data processing you have carried out in this respect.

The following information can be stored for the above-mentioned persons:

  • Profile pic
  • First name
  • Last name
  • Birthday
  • E-mail address

The stored recipients can be added to groups using the grouping function. The relationship of person to group is saved.

b)

The data is processed by us so that the app can fulfill its contractually agreed functionality. The processing serves to fulfill the contract.

c)

The legal basis for processing is Art. 6 (1) sentence 1 lit. b GDPR.

d)

The data will be deleted when the usage contract ends or when the contractually agreed period of storage and availability ends.

7. Setup data and username for message recipients

For people who have received a message, it is necessary to register on our Forevermind service. The following content is saved.

a)

After installation, the app requires the following setup data: “Name”, “First name”, “E-mail address”, “Date of birth”, “Password” and “Activation code”.

b)

This setup data is required for the app to function. Their e-mail address acts as a username and is used to uniquely identify you. Your message recipients also need this user ID to log in to the app.

c)

This setup data is required for using the app and is stored on the basis of Art. 6 (1) lit. f GDPR, unless another legal basis is given. We have a legitimate interest in this setup data for the technically error-free and provision of the app.

d)

This setup data is deleted when the app is uninstalled.

8. Data Collection Consequential to Device Registration

a)

After the app has been installed, it will be linked to your end device (device registration). In the course of this device registration, we collect and store the following data:

  • User ID
  • Bound device model
  • Serial number of the bound device
  • OS type (e.g. ANDROID_x86)
  • OS version (for example 9.0.0)
  • Last login (e.g. 01.08.16 10:47)
  • Installed version of the app (for example 2.0)
b)

The data is collected by us to protect the confidentiality of your data.

c)

The legal basis for processing is Art. 6 (1) sentence 1 lit. f GDPR In the aforementioned purpose, there is also a legitimate interest in the processing of the data.

d)

The data will be deleted if you cancel the connection with your end device via device management, uninstall the app or close your app account with us.

9. Required Permissions

a)

In the settings of your smartphone, you can allow the app access to numerous functions and personal data that is stored on the device.

You will be asked once at the beginning or only when using the respective function to grant the corresponding access authorization.

These are in detail:

Network access & network connections
Network access is required because the app can only be used in online mode.

Camera
In order to send us a document, access to your system camera is required.

Microphone
In order to save a message as an audio message, access to your system microphone is required.

Photo/video gallery
To send a message incl. a photo or video directly from the gallery of your smartphone, access to your system-side photo/video gallery is required.

Storage
As part of device registration, security messages are encrypted and stored locally so that in the event of an unjustified security message, the cause can be investigated. This file is only requested when required and is not sent automatically. Your photo memory is also accessed if you want to send us a photo file that has already been saved.

Device status
For our security check we need access to the device status.

b)

The data mentioned will be processed by us for the following purposes:

allow in order for the app to function properly, it is necessary that you grant access to certain smartphone functions and personal data that is stored on the device.

  • Ensuring proper functioning of the app
  • Evaluation of system security and stability as well
  • for other administrative purposes.
c)

The legal basis for data processing is Article 6 Paragraph (1) sentence 1 lit. b GDPR insofar as this serves to fulfill the contract of use.

In addition, the legal basis for data processing is Article 6 (1) sentence 1 lit. f GDPR Our legitimate interest follows from the data processing purposes listed above. If consent to authorization was requested, processing takes place exclusively on the basis of this consent (Article 6 (1) (a) GDPR); the consent can be revoked at any time.

d)

The above data will be saved until the app is uninstalled.

You can track which permissions you have already granted and revoke them at any time in the app in the “Settings > Security > System Permissions” area. However, in order for the app to function properly, it is necessary for you to grant access to certain smartphone functions and personal data stored on the device.


10. Data collection when using push notifications

a)

You can receive notifications of new messages in your mailbox. To do this, after downloading the app, your smartphone registers with the respective push service (Apple Push Notification or Google Cloud Messaging). The service then sends a token to your device. The token is sent to us by the app and stored there in a database. If a notification is to be sent, we send the message with the token to the push service, which forwards it to your device.

b)

The storage of the token in our database serves to send you push messages.<

c)

The legal basis is Article 6 Paragraph (1) sentence 1 lit. a GDPR if you want to use the push service function; the consent may be revoked at any time.

d)

As soon as you switch off push notifications in the settings, we will delete the token from the database.

11. Analysis to ensure accuracy and needs-based further development

a)

To ensure that the app is error-free, we use crash reporting and an analysis tool. Crash reporting ensures that if an error occurs, it can be traced afterwards at which point it happened so that the cause can be determined. The analysis tool provides valuable information to further develop the app based on needs. You can change your approval or rejection of the analysis to ensure freedom from errors and needs-based further development under “App analysis” in the settings.

The following data is collected:

  • Client IP (abbreviated)
  • Device ID for device binding and crash reporting
  • End device ID for recording user sessions (a randomly generated number every time the app is started, which does not allow assignment of device and person)
  • Track ID (account number from us with our service provider)
  • App version
  • Operating system
  • Screen resolution
  • Mobile device
  • Date and Time
  • Content and features accessed
b)

The transmission of the analysis data is necessary to improve the functionality of the app.

c)

We have a legitimate interest in processing the analysis data for the technically error-free and optimized provision of the app. If consent to the transmission of analysis data was requested, processing takes place exclusively on the basis of this consent (Article 6 (1) (a) GDPR); the consent can be revoked at any time.

d)

If you delete your account or revoke your consent, the analysis data will also be deleted.


III. Cooperation with processors and third parties

In some cases, we use external service providers (processors) to process your data. These have been carefully selected and commissioned by us, are bound by instructions and are regularly checked. These are external service providers who provide us with technical support (web hosts, programmers). This is done on the basis of order processing contracts in accordance with  Art. 28 GDPR.

Otherwise, we only pass on your data to third parties if:

  • you have given your express consent in accordance with Art. 6 Para. (1) sentence 1 lit. a GDPR,
  • the disclosure in accordance with Art. 6 Para. (1) sentence 1 lit. f GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data,
  • There is a legal obligation for the transfer in accordance with Article 6 Paragraph (1) Sentence 1 Letter c GDPR, or
  • This is legally permissible and is necessary for the fulfillment of contractual relationships with you in accordance with Article 6 Paragraph (1) Sentence 1 Letter b GDPR.

A commissioning of service providers in a third country only takes place if the special requirements of Art. 44 et seq. GDPR are fulfilled.


IV. Rights of data subjects

You have the right:

  • in accordance with Art. 15 DSGVO to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
  • in accordance with Art. 16 DSGVO to immediately demand the correction of incorrect or completion of your personal data stored by us;
  • pursuant to Art. 17 DSGVO to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
  • to request the restriction of the processing of your personal data in accordance with Art. 18 DSGVO, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defense of legal claims or you have objected to the processing in accordance with Art. 21 DSGVO;
  • pursuant to Art. 20 DSGVO to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller;
  • complain to a supervisory authority in accordance with Art. 77 DSGVO. As a rule, you can contact the supervisory authority of your habitual residence or place of work or the place of the alleged infringement for this purpose.

V. Right to object

If your personal data is processed on the basis of legitimate interests in accordance with Article 6 (1) sentence 1 lit , which arise from your particular situation; This also applies to profiling based on these provisions. We will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. This also applies to profiling insofar as it is associated with such direct advertising.


VI. Right to withdraw consent under data protection law

In accordance with Art. 7 (3) DSGVO, you have the right to revoke your consent at any time. This has the consequence that we may no longer continue the data processing based on this consent for the future. The lawfulness of the processing carried out on the basis of the consent until the revocation is not affected by this.

VII. Up-to-dateness and changes to this data protection declaration

This privacy policy is dated August 2023.

Due to the further development of our app and offers about it or due to changed legal or official requirements, it may become necessary to change this data protection declaration. You can call up and print out the current data protection declaration at any time on the website at www.forevermind.de