Privacy Policy

for the mobile app "Woll-eT"

Last updated: 07 April 2026

The protection of your personal data is a central concern for us. This privacy policy informs you in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) about the processing of your personal data when using our app "Woll-eT".

1. Controller

Company: Cmd-GmbH
Address: Billgrund 14a, 21521 Wohltorf
Email: info@cmd-gmbh.com
Website: www.cmd-gmbh.com
Data Protection Officer: Mr. Wolfgang Weber

If you have any questions or concerns about data protection, you can contact us at info@cmd-gmbh.com.

2. What Data We Collect

2.1 App Usage Data (Automatic)

Category	Details
Device Information	Device type, operating system, operating system version, device ID
Connection Data	IP address, time of access, amount of data transmitted
App Usage Data	Functions called, dwell time, crash reports
Language Settings	System language and region of the device

2.2 Registration Data

When you create an account, we collect:

Email address
Username (freely selectable)
Password (stored in encrypted form, never plain text)
Date of registration

2.3 Data for Paid Services

In the case of in-app purchases or subscriptions, payment data is processed exclusively via the respective app store provider (Apple App Store / Google Play Store). We only receive confirmation of the completed purchase, but no complete payment information.

2.4 Optional Data

The following data will only be collected with your express consent:

Location data
Camera and microphone access
Contact access
Push notifications

3. Legal Basis for Processing

Legal Basis	Purpose
Art. 6 (1) (a) GDPR	Consent – e.g. location data, push notifications
Art. 6 (1) (b) GDPR	Performance of contract – app features and account creation
Art. 6 (1) (c) GDPR	Legal obligations
Art. 6 (1) (f) GDPR	Legitimate interests – security, abuse prevention, error analysis

4. Purposes of Data Processing

Deploy and improve app features
Managing user accounts and settings
Technical error analysis and crash reporting
Security and abuse prevention
Processing in-app purchases and subscriptions
Sending service emails
Compliance with legal obligations
Push notifications (with consent)

5. Storage Period

Category	Details
Usage data / logs	90 days, then automatic deletion
Account details	Until the user account is deleted
Transaction data	10 years (commercial and tax law retention obligation)
Proof of consent	3 years after withdrawal of consent
Location data	Only during active session unless otherwise specified

6. Disclosure of Data to Third Parties

6.1 Principle

We do not pass on your personal data to third parties unless necessary for contract performance, legally required, or with your consent.

6.2 Service Providers Used (Processors)

Category	Details
Hosting / Cloud	AWS, Google Cloud, Hetzner – Server infrastructure
Analysis	Firebase Analytics, Matomo – App usage statistics
Crash Messages	Firebase Crashlytics, Sentry – Bug reports
Push Services	Firebase Cloud Messaging – Notification delivery
Email Dispatch	Mailgun, Postmark – Transactional emails
Payment Processing	Apple App Store / Google Play Store / Stripe

6.3 Transfers to Third Countries

Some service providers process data outside the European Economic Area (EEA). In such cases, appropriate safeguards are implemented, such as EU Standard Contractual Clauses.

7. App Permissions

Permission	Purpose
Internet Access	Required for core app functions
Camera	Optional – profile pictures
Location	Optional – local search
Microphone	Optional – voice search
Contacts	Optional – invite friends
Notifications	Optional – push notifications
Photos / Media Storage	Optional – image upload

8. Tracking and Analysis

We use analytics tools to understand app usage and improve the user experience. Collected data is pseudonymized and not linked directly to your account data.

9. Your Rights as a Data Subject

Right	Description
Information (Art. 15 GDPR)	Request a copy of your stored data
Rectification (Art. 16 GDPR)	Correct inaccurate data
Erasure (Art. 17 GDPR)	Request deletion of your data
Restriction (Art. 18 GDPR)	Restrict processing of your data
Data Portability (Art. 20 GDPR)	Receive data in machine-readable format
Objection (Art. 21 GDPR)	Object to processing based on legitimate interests
Revocation (Art. 7 GDPR)	Withdraw consent at any time

To exercise your rights, contact: info@cmd-gmbh.com

10. Data Protection for Minors

Our app is not specifically aimed at children under the age of 16. We do not knowingly collect personal information from minors without parental consent.

11. Data Security

Encrypted data transmission (TLS/HTTPS)
Encrypted storage of sensitive data
Access controls and authorization management
Regular security reviews and penetration tests
Pseudonymization of analysis and log data
Data protection impact assessments

12. Links to Third-Party Services

The app may contain links to third-party services or websites. We are not responsible for their privacy practices.

13. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect legal, technical, or operational changes.

In the event of significant changes, users will be notified via in-app notification or email.

Last updated: 07 April 2026
Cmd-GmbH
info@cmd-gmbh.com