Privacy Policy

Translation – only the German version is legally binding.

Privacy notice Meine-Bonuskarten.App

MBK.City is the website for the Meine-Bonuskarten.App. This policy applies to both: to the website and to the app. Where something relates to only one of the two, this is stated.

Thank you for your interest in the Meine-Bonuskarten.App

The Meine-Bonuskarten.App is a customer service offering (hereinafter the "Service" or "Meine-Bonuskarten.App"). Meine-Bonuskarten.App (Webdesign-Oglas) attaches great importance to protecting your privacy and is committed to protecting your privacy and your personal data. This policy describes the information we process to support the products and services offered by Meine-Bonuskarten.App (Webdesign-Oglas) (hereinafter Meine-Bonuskarten.App), including the Meine-Bonuskarten.App website, the Meine-Bonuskarten.App app and the Bonuskarten Manager app. We recommend that you read this policy carefully and contact us by email at info@meine-bonuskarten.app if you have any questions. This data policy applies to all potential / current / former Bonuskarten.App users.

By accepting this data policy, general permission is granted for all processing described in this data policy for which authorisation is required.

The Service is aimed at consumers (hereinafter "users" or "you") who wish to receive personalised information from Meine-Bonuskarten.App about offers and promotions relating to offers, goods and services from selected cooperation partners that match your interests and your purchase history as closely as possible.

With the Meine-Bonuskarten.App you can enjoy a wide range of services tailored specifically to you. These include, among other things, offers geared specifically to your needs and wishes, participation in prize draws and exclusive discount and special promotions.

What types of information do we process?

In order to offer products and services with the Bonuskarten.App, we need to process information about you. We distinguish here between different types of information we collect, as these depend on how you use our services. You can find out how to access the information we collect, or how to delete it, by sending an email to info@meine-bonuskarten.app.

Using Meine-Bonuskarten.App without personal data

It is possible to use Meine-Bonuskarten.App on an anonymous basis. No personal information is provided, with the exception of the consumer habits developed while using Meine-Bonuskarten.App. The processing of these consumer habits is based on legitimate interest, in order to offer you the right loyalty services. When using the services of the Meine-Bonuskarten.App anonymously, bonus points collected at our partners cannot, however, be redeemed.

The types of personal data we use on an anonymous basis are transaction data, such as the place and time of the interaction at the Meine-Bonuskarten.App partner and the bonus points awarded. The recipients of this data are exclusively Meine-Bonuskarten.App and the Meine-Bonuskarten.App partner in aggregated form. The basis for the processing is a legitimate interest on our part and on the part of the partner; the purpose of the processing is that, with these details, the Meine-Bonuskarten.App partner receives an overview of the number of customers collecting bonus points and of the number and type of bonus points awarded, and to detect, prevent, mitigate and investigate fraudulent or illegal activities. After the interaction, these details are made available to the Meine-Bonuskarten.App partner in aggregated form in order to be able to offer customer loyalty and to make the success measurable for the partner.

Personal data processed when registering for the Meine-Bonuskarten.App in the app

At the latest when you wish to redeem your full loyalty card, you are required to provide your name and your email address in the Meine-Bonuskarten.App in order to create a new user account.

The type of personal data concerns exclusively personal identification details such as email address and name. The recipient of this data is exclusively Meine-Bonuskarten.App, with the legitimate interest in authentication as the basis for the processing. The purpose of the processing is the correct and secure creation of a user account. We send an email to your email address to confirm and complete the authentication. If the registration process is not completed correctly, your email address will not be used for any purpose other than the one stated here.

Personal identification characteristics, personal attributes and security characteristics are processed when a complete user account is created. Specifically, this happens after your email address has been confirmed in the Meine-Bonuskarten.App or on the Meine-Bonuskarten.App website. Your personal data is processed here on the basis of your consent and on the basis of the legitimate interest of Meine-Bonuskarten.App in the security of your account.

In addition, personal attributes such as date of birth are collected as a further type of personal data, with Meine-Bonuskarten.App as the recipient. The basis for the processing is consent, and the purpose of the processing is to enable the provision of our products and services, to improve Meine-Bonuskarten.App, and to detect, prevent, mitigate and investigate fraudulent or illegal activities.

Personal data processed when you receive a message from a Meine-Bonuskarten.App partner by email or via the Meine-Bonuskarten.App

For Meine-Bonuskarten.App partners there is a Meine-Bonuskarten.App Manager app for our partners, a campaign tool for setting up manual and automated email campaigns to the respective partner's Meine-Bonuskarten.App users, taking into account individual opt-ins or opt-outs from the personal settings in the app. When this campaign tool is used, no personal data is displayed to the Meine-Bonuskarten.App partner. The subsequent reporting on the success of the campaign also contains only aggregated values and no data by which you can be personally identified or which allow conclusions to be drawn about you as a person.

Personal identification data is processed internally when Meine-Bonuskarten.App sends the campaign. Meine-Bonuskarten.App may use the services of technical service providers for the actual sending of email messages and push notifications. If you have given your consent to receive the newsletter or the push messages of other services operated, we may receive information from these companies about your user behaviour in relation to this newsletter, including information such as the time the newsletter was opened, the links or areas you clicked on, and the duration and frequency of use. Meine-Bonuskarten.App may strictly regulate the type, scope and frequency of campaigns by Meine-Bonuskarten.App partners in order to ensure quality and to send you only the most relevant information possible.

We do not pass on your contact details to Meine-Bonuskarten.App partners – there is therefore no possibility of you being contacted by third parties using contact details you have provided for Meine-Bonuskarten.App. The sending of these messages is based on legitimate interests and takes place within the framework of the existing customer relationship. At the time the electronic contact details are collected, with every single message and also at any time in the Meine-Bonuskarten.App, you have the option of unsubscribing from future messages by unsubscribing from the partner.

The type of personal data concerns personal identification details (email) and electronic identification details (push notification token). The recipient is exclusively Meine-Bonuskarten.App. The basis for the processing is a legitimate interest, and the purpose of the processing is to enable the provision of products and services of Meine-Bonuskarten.App, general customer management and the evaluation of the explicit added value of the Meine-Bonuskarten.App. To this end, within the Meine-Bonuskarten.App you can receive messages from each individual Meine-Bonuskarten.App partner personally assigned to you, or from the partners in your cities, and specify in general whether or not you wish to receive messages. Meine-Bonuskarten.App collects and processes details on the opening of certain content or on click behaviour in messages.

The personal identification details (email) and electronic identification details (push notification token) may be passed on to third-party providers for sending messages on the basis of a legitimate interest. The purpose of the processing is to enable the provision of products and services of Meine-Bonuskarten.App and to ensure customer management. Push notifications are sent to end devices via a Google Firebase service (see below); for this purpose, this provider receives from Meine-Bonuskarten.App the text of the push notification together with the push notification token of your end device, provided you have consented to push notifications in the Meine-Bonuskarten.App app. Emails are sent via the provider / server of the Meine-Bonuskarten.App.

Personal data processed when redeeming a loyalty card

When you redeem a reward (awarded by a Meine-Bonuskarten.App partner) or an offer at a Meine-Bonuskarten.App partner, the Meine-Bonuskarten.App partner does not receive any personal identification data. In doing so, Meine-Bonuskarten.App uses the available data to enable the provision of products and services of Meine-Bonuskarten.App, to improve Meine-Bonuskarten.App, and to detect, prevent, mitigate and investigate fraudulent or illegal activities.

Personal data processed when filling in the contact form on the Meine-Bonuskarten.App website (for partners)

Personal identification data is processed when you contact us via the website's contact form. In this case, the processing of personal data is based on the contractual relationship and on any contacts that may be necessary for it.

For this purpose, Meine-Bonuskarten.App receives personal identification details (name, email address, for B2B contacts additionally: company name, telephone number if applicable) on the basis of the resulting contractual relationship or preceding steps. The purpose of the processing is to enable the provision of products and services of Meine-Bonuskarten.App and to ensure customer management. To this end, this data is used by Meine-Bonuskarten.App to reply to the person concerned or to the partner.

Personal data processed when contacting us via info@meine-bonuskarten.app , telephone support or social media

If you are not (yet) a Meine-Bonuskarten.App user and request information via social media channels (such as Facebook, LinkedIN, Instagram, YouTube, Twitter) or via info@meine-bonuskarten.app, we process personal data such as your name or your telephone number solely for the purpose of answering your questions. The processing is based on the legitimate interest of Meine-Bonuskarten.App in providing a good quality of service. If the reply is sent by email, personal emails are used. In this case, unsubscribing is not possible. The type of personal data concerns exclusively personal identification details (name, email address, for B2B contacts additionally: company name, telephone number if applicable), and the recipient is Meine-Bonuskarten.App, with a legitimate interest in using this personal data to get in touch with the person concerned.

How do we use your information?

We use the information available to us to provide and support the Meine-Bonuskarten.App products and services. This is done as follows:

Providing, personalising and improving our products

Information across different Meine-Bonuskarten.App products and devices

We collect information from and about the smartphones and computers you use. We then combine this information across the different devices you use. For example, we use information we collect when you open emails from our partners to better personalise the content (including advertisements) of the Meine-Bonuskarten.App on your smartphone.

Product development

We use the information available to us to develop, test and improve our products, including by carrying out tests and troubleshooting and problem-solving for new products and features.

Advertisements and other sponsored content

Offers and promotions in the app come from the businesses whose loyalty card you have – you see them because you have added the card, not because we build a profile of you.

There are no advertising networks, no personalised advertising and no trading in your data.

Security, integrity and protection of the Meine-Bonuskarten.App platform

We use the information available to us to verify all activities (such as transactions and the redemption of offers) and user accounts on the Meine-Bonuskarten.App platform, to combat harmful behaviour and to detect and prevent other negative experiences.

For communication

We use the information available to us to send you marketing messages (e.g. information about new Meine-Bonuskarten.App partners), to communicate with you about our products and services and to inform you about our policies and terms of use. We also use your information to reply to you when you contact us.

How is your information shared?

As a matter of principle, we do not share with anyone – i.e. not with Meine-Bonuskarten.App partners, customers or third parties – any information by which you can be personally identified or which allows conclusions to be drawn about you as a person. Specifically, this means: no one outside Meine-Bonuskarten.App can see your email address or other personal identification details or personal attributes (e.g. gender, date of birth, language). Within Meine-Bonuskarten.App, access to your data by our staff is strictly regulated and limited to the absolute minimum, and every access is logged.

What data do Meine-Bonuskarten.App partners receive?

When collecting bonus points, you use the technology of Meine-Bonuskarten.App. Naturally, the respective Meine-Bonuskarten.App partner may view the success of Meine-Bonuskarten.App in its business. For this purpose, it receives detailed evaluations of the use of Meine-Bonuskarten.App products and services. At no time can information about individual customers such as you be viewed. We provide aggregated, i.e. summarised, information from which it is impossible to draw conclusions about you as a person. There is one single exception to this: to prevent, detect or investigate illegal activities, fraud or security breaches, Meine-Bonuskarten.App partners may view the transactions in detail, although even here no information is shared that identifies you personally (information such as your email address which, taken on its own, can be used to contact or identify you).

With which other parties does Meine-Bonuskarten.App share data?

Meine-Bonuskarten.App uses a number of third-party providers to provide our products and services. The use of this processing on our behalf is based on our legitimate interest where we do not have the means to carry out tasks such as sending emails or delivering push notifications ourselves. Where we commission third parties to process data on the basis of a so-called "data processing agreement", this is done on the basis of Art. 28 GDPR (DSGVO). When we do so, we always ensure that your data is processed confidentially and used securely. The processor is thus never able to use your data on its own initiative and is obliged to delete your data once the assignment has been completed.

Hosting

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services, which we use for the purpose of operating Meine-Bonuskarten.App. In doing so, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of users, customers and prospective customers of Meine-Bonuskarten.App on the basis of our legitimate interests in the efficient and secure provision of this online service pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement). Our hosting provider is hoststar.ch. We use a GDPR-compliant hosting product.

Google Firebase (app only)

The app uses A/B Testing, Analytics, Cloud Messaging, Crashlytics, Dynamic Links, In-App Messaging, Performance, Predictions and Remote Config, analysis services from Google ("Firebase"), which are used, among other things, to analyse the use of the app. When you install the Mein-Bonuskarten.App, Firebase records when and for how long the app is used, which pages of the app are accessed, which functions are clicked and which content is displayed. This enables us to understand how you interact with our app. Furthermore, based on your user behaviour, we can continually improve the app and provide you with more relevant offers/services. In addition, we can run several app tests in parallel and carry out further, data-based app development.

For this analysis, Firebase accesses your customer number from the time registration has been completed. You can find further information on data protection in connection with Google Firebase on the website of Google Firebase.

The legal basis is our legitimate interest in analysing, troubleshooting and improving the app pursuant to Art. 6(1)(f) GDPR; for push messages, it is your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time in your device's settings.

Google also processes data outside the European Union. Details on this and on your options to object can be found in Google's privacy policy: https://policies.google.com/privacy

Firebase is not used on the MBK.City website.

Mapbox (app only)

The Meine-Bonuskarten.App uses the Mapbox map service via an API. The provider is MapBox Inc., 740 15th St NW, Washington, DC 20005, USA. To use the functions of Mapbox, it is necessary to store your IP address. This information is usually transferred to a Mapbox server in the USA and stored there. The provider of this site has no influence on this data transfer.

Mapbox Maps is used in the interest of an appealing presentation of our online offerings and of making the places indicated by us on the website easy to find. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

You can find more information on how user data is handled in Mapbox's privacy policy: https://www.mapbox.com/privacy/

Visit counting on MBK.City (without cookies, without identifiers)

In order to recognise which content on our website is in demand, we count page views ourselves on our own server. No third-party service is used for this (i.e. neither Google Analytics nor any comparable tool), and no data is transferred to third parties.

When a page is accessed, your browser sends a short message to our server. Only the following is stored:

• the path of the page accessed (e.g. `/preise.html`) and its title,
• the date of access (no time),
• for business pages, the name of the business,
• the source, and only in the form of a summarised designation of the previous service (e.g. "Google", "WhatsApp", "Entered directly"). The full address of the previously visited page is not stored.

Not stored are: your IP address, cookies, an identifier or user ID, time of day, device type, operating system or browser identifier. No information is stored on or read from your device for the counting; § 25 TDDDG therefore does not apply and consent is not required.

The result is a simple tally per day from which individual persons can neither be identified nor recognised. These are page views, not visitor numbers. The legal basis is our legitimate interest in designing and improving our online service in line with demand pursuant to Art. 6(1)(f) GDPR.

The daily figures are retained for 13 months and then automatically deleted.

MBK-Map: OpenStreetMap and Leaflet (your IP address)

On our web pages (home page, MBK-Map and the pages of the participating businesses) we display a map. The map is displayed using the Leaflet program library. Leaflet is located entirely on our own server – so no data is transferred to third parties when Leaflet is loaded.

The map image itself consists of individual tile images loaded from the servers of OpenStreetMap (tile.openstreetmap.org). The operator is the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

What data is transferred in the process: As soon as a map tile is loaded, your browser establishes a direct connection to the OpenStreetMap servers. In doing so, your IP address is transferred to OpenStreetMap, together with the usual connection data such as date and time, the requested map sections, the previously visited page (referrer) and the browser and operating system identifier (user agent). We have no influence on this transfer, as it takes place directly between your browser and OpenStreetMap. A transfer to a third country cannot be ruled out, as OpenStreetMap uses a worldwide server network.

Legal basis and your choice: The map is loaded only after your express consent. On your first visit, a notice appears for this purpose in which you can allow or decline the map. Before that, only a placeholder is displayed in this position and no connection to OpenStreetMap is established. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

We store your decision exclusively locally in your browser (in the so-called local storage, key mbkCityKarte). No cookie is set for this and the information does not leave your device. You can withdraw your consent at any time with effect for the future: you will find a switch for this on our page Cookies and map. Alternatively, it is sufficient to delete the website data in your browser. Without consent, you can use all other content of our pages without restriction – only the map image is not shown.

The purpose of the processing is to display the locations of the participating businesses and to make these places easy to find.

You can find more information on how user data is handled in the privacy policy of the OpenStreetMap Foundation at https://osmfoundation.org/wiki/Privacy_Policy and at https://www.openstreetmap.de. You can find more information on the Leaflet library used at https://leafletjs.com

Online presences on social media

We maintain online presences within social networks and platforms in order to communicate with the customers, prospective customers and users active there and to inform them about our services there. When accessing the respective networks and platforms, the terms and conditions and data processing policies of their respective operators apply.

Unless otherwise stated in our privacy policy, we process the data of users insofar as they communicate with us within the social networks and platforms, e.g. write posts on our online presences or send us messages.

Links to social networks

On our website and in the app there are links to our pages on Facebook, Instagram, YouTube and LinkedIn – as well as to the pages of participating businesses, if they have provided any.

These are ordinary links: no content from these networks is embedded, no buttons from the providers are loaded and no data is transferred to them unless you tap on them yourself. Only then do the terms of the respective network apply.

The same applies to a business's video message: it opens in your device's browser; we do not embed any video.

PayPal (app only)

If a business has stored a PayPal.Me address, the app shows a button for it. If you tap it, PayPal opens in your browser; the payment takes place solely between you and the business via PayPal.

We are not involved in this, do not receive any payment data and do not transfer any data to PayPal. PayPal's privacy statement applies (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg): https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Premium subscription via the App Store and Google Play (for partners)

A business can take out a Premium subscription in the app. The purchase takes place entirely via Apple's App Store or Google Play – that is where the contract and payment are concluded, and that is also where it is cancelled.

We do not receive any payment data from Apple and Google, only the information that a valid subscription exists for an account. The privacy policies of Apple (https://www.apple.com/de/legal/privacy/) and Google (https://policies.google.com/privacy) apply.

For Community cards, Event passes and Explorer passes, as well as for businesses with several branches, we make a personal offer and issue an invoice; in doing so, we process the business's billing data.

On what legal basis do we process data?

Through the use of our products and services, we gain access to your personal data, which is processed on the basis of the (European) General Data Protection Regulation (also referred to as the GDPR) (http://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX:32016R0679).

Under European law, companies need a legal basis for processing data. Depending on which legal basis we use, you are entitled to certain rights, which we explain in the next section. You should know that, regardless of the applicable legal basis, under the General Data Protection Regulation you always have the right to access, rectification and erasure of your data.

The most important uses of data for providing our contractual services are: providing, personalising and improving the Meine-Bonuskarten.App products and services, promoting safety, integrity and security, and communicating with you, e.g. regarding product-related topics and messages and offers from your favourite shops. You can find the basis for the respective processing in the section "What types of information do we process?".

The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing in order to perform our services and carry out contractual measures and to respond to enquiries is Art. 6(1)(b) GDPR; the legal basis for processing in order to comply with our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing in order to safeguard our legitimate interests is Art. 6(1)(f) GDPR. In the event that vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.

We use the data available to us to provide you with our products and services. If you decide against providing or allowing the use of certain data, the quality of your experience when using Meine-Bonuskarten.App may be impaired.

Where we process data you have provided to us on the basis of your consent, you have the right under the GDPR to withdraw your consent at any time and to have such data you have provided to us transferred.

Rights of the data subject

a) Right to confirmation

Every data subject has the right, granted by the European legislator, to obtain from the controller confirmation as to whether or not personal data concerning him or her is being processed. If a data subject wishes to exercise this right to confirmation, he or she may contact an employee of the controller at any time.

b) Right of access

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to obtain from the controller at any time, free of charge, information about the personal data stored about him or her and a copy of this information. Furthermore, the European legislator has granted the data subject access to the following information:

• the purposes of the processing
• the categories of personal data concerned
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the right to request rectification or erasure of personal data concerning him or her, or restriction of processing by the controller, or to object to such processing
• the existence of the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject: any available information as to their source
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and — at least in those cases — meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Furthermore, the data subject has a right to obtain information as to whether personal data have been transferred to a third country or to an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to exercise this right of access, he or she may contact an employee of the controller at any time.

c) Right to rectification

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to obtain without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed — including by means of providing a supplementary statement.

If a data subject wishes to exercise this right to rectification, he or she may contact an employee of the controller at any time.

d) Right to erasure (right to be forgotten)

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies and insofar as the processing is not necessary:

• The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
• The data subject withdraws the consent on which the processing is based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR.
• The personal data have been unlawfully processed.
• The erasure of the personal data is required for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

If one of the above grounds applies and a data subject wishes to request the erasure of personal data stored by the Meine-Bonuskarten.App, he or she may contact an employee of the controller at any time. The employee of the Meine-Bonuskarten.App will arrange for the erasure request to be complied with without undue delay.

Where the personal data have been made public by the Meine-Bonuskarten.App and our company, as the controller, is obliged pursuant to Art. 17(1) GDPR to erase the personal data, the Meine-Bonuskarten.App, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure by such other controllers of any links to, or copies or replications of, those personal data, insofar as the processing is not necessary. The employee of the Meine-Bonuskarten.App will arrange the necessary measures in individual cases.

e) Right to restriction of processing

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Art. 21(1) GDPR, pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by the Meine-Bonuskarten.App, he or she may contact an employee of the controller at any time. The employee of the Meine-Bonuskarten.App will arrange for the restriction of the processing.

f) Right to data portability

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format. He or she also has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising his or her right to data portability pursuant to Art. 20(1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To assert the right to data portability, the data subject may contact an employee of the Meine-Bonuskarten.App (Webdesign-Oglas) at any time.

g) Right to object

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

In the event of an objection, the Meine-Bonuskarten.App will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

Where the Meine-Bonuskarten.App processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to the Meine-Bonuskarten.App to processing for direct marketing purposes, the Meine-Bonuskarten.App will no longer process the personal data for these purposes.

In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her carried out by the Meine-Bonuskarten.App for scientific or historical research purposes or for statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

To exercise the right to object, the data subject may contact any employee of the Meine-Bonuskarten.App or another employee directly. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject is also free to exercise his or her right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling

Every data subject affected by the processing of personal data has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning him or her or similarly significantly affects him or her, provided that the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is based on the data subject's explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is based on the data subject's explicit consent, the Meine-Bonuskarten.App (Webdesign-Oglas) shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

If the data subject wishes to exercise rights relating to automated decisions, he or she may contact an employee of the controller at any time.

i) Right to withdraw consent under data protection law

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise his or her right to withdraw consent, he or she may contact an employee of the controller at any time.

How can I exercise my rights?

You can exercise your rights by sending an email to info@meine-bonuskarten.app. In order to prevent any unauthorised disclosure of your personal data, your request must come from the email address linked to your Meine-Bonuskarten.App user account. Meine-Bonuskarten.App then has 30 days to respond to your request. This period begins when Meine-Bonuskarten.App has received your request and has all the information from you necessary to be able to respond to your request.

Meine-Bonuskarten.App provides the requested information free of charge. If requests are unfounded or excessive, in particular because of their repetitive character, Meine-Bonuskarten.App may charge a reasonable fee or refuse the request.

If, for any reason, you believe that Meine-Bonuskarten.App has not handled your request properly, you can contact the data protection officer of Meine-Bonuskarten.App by email at info@meine-bonuskarten.app.

Cookies

MBK.City does not set any cookies. What the site needs in order to work remains in your browser's local storage and is never transferred to us: whether you read in light or dark mode, your language, your decision on the MBK-Map and – if you log in as a merchant – your login.

You can delete this at any time via your browser settings ("Clear website data"). Exactly which entries these are is listed on the Cookie settings page.

The same applies in the app: your details remain on your device until you delete them yourself or remove the app.

Collection of access data and log files

On the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, we collect data on every access to the servers on which the Meine-Bonuskarten.App services and products are located (so-called server log files). The access data include the name of the web page accessed, the file, the date and time of access, the amount of data transferred, notification of successful access, the browser type and version, the user's operating system, the referrer URL (the previously visited page), the IP address and the requesting provider.

Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum period of 7 days and then deleted. Data whose further retention is required for evidential purposes is excluded from deletion until the respective incident has been finally clarified.

How do we notify you of changes to this policy?

A change to this privacy notice may become necessary due to changes in the legal situation or in the circumstances of data processing by Meine-Bonuskarten.App. Should the purposes of the collection, processing or use of your personal data, the identity of the controller or the categories of recipients change, we will inform you of this via the app, the website and by email and, where necessary, ask for your consent.

Body responsible for data protection

You can contact our data protection contact person by email at info@meine-bonuskarten.app if you have any questions about data protection and regarding the processing of your personal data and the exercise of your rights.

You can reach the contact person by post:

Meine-Bonuskarten.App (DeNiko-Solutions) Vanesa Nikolajevic Westernachstr. 42 87719 Mindelheim Deutschland

Small and micro-enterprises are not required to appoint a data protection officer unless 20 persons are constantly engaged in the processing of personal data. Record of processing activities for small enterprises (Article 30 GDPR).

This data policy was last amended on 16.12.2020.