Privacy Policy

Last updated: 21 July 2026 (Version 2.0)

This is a convenience translation of the German original ("Datenschutzerklärung"). The German version is authoritative for its interpretation. This does not deprive you of the protection afforded by mandatory provisions of the law of the country in which you have your habitual residence. The section numbering of this English version follows the German version one to one, so that a cross-reference resolves to the same section in both.

This Privacy Policy informs you about the processing of personal data when you use the mobile application Klaimo (hereinafter "App"), the associated online services and the website https://klaimo.de.

Who this version is for. The English set of legal documents is the fallback version for all locales that do not resolve to German, French, Dutch, Danish or Swedish. It describes the position under the General Data Protection Regulation (GDPR) and, in Section 16, the supplementary and partly different position under the revised Swiss Federal Act on Data Protection (revFADP). If you have your habitual residence outside the EU/EEA and Switzerland, the mandatory data protection rules of your own country continue to apply to you.

1. Controller

The controller within the meaning of the GDPR (in Switzerland: the controller within the meaning of the revFADP) is:

SB-Techworks Karim Belkacem Lilienthalstraße 38 93049 Regensburg Germany

Telephone: +49 941 46395983 E-mail: info@klaimo.de

For all questions about data protection, you can reach us at the e-mail address above.

Representative in Switzerland (Art. 14 revFADP). We have not designated a representative in Switzerland. That duty applies only where the processing of data of persons in Switzerland is, among other things, carried out on a large scale ("umfangreich"). Our processing of data of users resident in Switzerland does not currently reach that scale. We review this assessment regularly and will designate a representative — and name them here — as the number of active users in Switzerland approaches 1,000. Regardless of that, you can reach us directly at the address and e-mail address given above.

2. Overview: what is Klaimo?

Klaimo is a fitness and gaming app in which you conquer geographical "territories" on a map by recording cycling and other outdoor activities, compare yourself with others and organise yourself in teams. The core of the App is therefore the processing of location and activity data.

3. Data processed, purposes and legal bases

3.1 Registration and user account

You have to create a user account in order to use the App. In doing so we process:

• e-mail address
• password (encrypted; we ourselves have no access to it in plain text)
• display name (username)
• time of registration

Alternatively, you can sign in via Google Sign-In or Sign in with Apple. In that case we receive from Google or Apple a unique identifier and — depending on your settings — your e-mail address and your name. With "Sign in with Apple" you can hide your e-mail address (anonymised relay address).

Authentication is carried out via Firebase Authentication (see Section 8).

Purpose: provision and administration of your account. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

3.2 Location data and GPS tracks

To record your activities we process your location data (longitude and latitude, altitude, timestamp) in the form of a GPS track while a recording is running.

• Location is recorded only while a recording you have started is running, but then also in the background, so that your ride is captured completely (including when the screen is locked). On iOS this is indicated by the blue status bar, on Android by a persistent notification.
• On the map, your current position is shown to you in the foreground, provided you have granted the location permission.
• The raw GPS track data are transmitted to our backend for processing and stored there (see Section 8: Google Cloud and IONOS).
• From the tracks we calculate the conquered territory (polygons), the distance covered and the duration.

Please note: tracks that regularly begin or end at the same place allow conclusions to be drawn about your home or work address. See also Section 3.5.

Purpose: recording activities, calculating territories and game scores — the core function of the App. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). Access to the device location additionally requires the permission you grant in the operating system. The operating system permission does not replace consent, and we do not exploit it for any other purpose.

3.3 Motion and activity recognition

While a recording is running we use your device's motion/activity recognition, provided you grant the permission. It serves exclusively to detect and filter out noisy GPS points that arise while you are stationary (e.g. at traffic lights), so that your track is recorded more cleanly. Refusing this permission does not block recording.

Purpose: improving the quality of the recording. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in accurate track data).

3.4 Activity and game score data

In connection with your activities we process:

• calculated territories (polygons) and their area
• distance, duration and time of the activity
• information as to whether heart rate, power or cadence data were present (for imported activities)
• derived statistics (e.g. total area, number of activities, streaks)
• your derived "home region" (from the location of your last activity)
• an automatically calculated plausibility score used to detect unrealistic activities (protection against manipulation) — see Section 6

Purpose: provision of the game and statistics functions and protection of the integrity of the game. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract); for manipulation detection additionally Art. 6 (1) (f) GDPR (legitimate interest in fair competition).

3.5 Publicly visible data (leaderboards, map, teams)

Klaimo is a social competition app. The following data are visible to other users:

• your display name and your profile picture
• your conquered territories on the map (location and area)
• your ranking and area in regional leaderboards
• if you are a member of a team: your membership, role and contribution to the team (visible to everyone for public teams, only to team members for private teams)
• who you follow and who follows you
• in the activity feed of the people who follow you: your completed rides with date, distance, duration and the number of "Kudos" received — not your GPS track. Others can give you Kudos there.

Please note that the location of your territories may allow conclusions to be drawn about places you visit frequently, including where you live. Choose your display name and your activities accordingly; if you do not want to reveal your start and finish points, begin and end your recording some distance from your home.

Why Klaimo has no "privacy zones". Some sports apps let you hide a radius around your home address, because they publish the route line you rode, including its start and end point and the time of each point. Klaimo publishes something different: only the territory polygons you have conquered. We do not publish your GPS track, we do not publish where a ride started or finished, and we do not publish per-point timestamps. The outline of an area covering a whole neighbourhood therefore says considerably less about where you live than a published route would. For that reason we have deliberately decided against a privacy-zone function; this is a considered decision, not an oversight. It does not remove the residual risk described in the previous paragraph — an area you conquer again and again still points to the region you ride in — which is why we tell you about it here. You can delete an individual ride at any time (Section 11), and with it its contribution to what is displayed.

Purpose: competition, leaderboard and team functions. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

3.6 Profile picture

You can optionally upload a profile picture. The image is stored in our object storage (IONOS, see Section 8) and delivered via a public URL.

Purpose: personalisation of your profile. Legal basis: Art. 6 (1) (b) GDPR; the upload takes place at your initiative. If the image shows other people, you need their consent.

3.7 Push notifications

If you consent to push notifications (e.g. "your territory is under attack"), we process a device token (Firebase Cloud Messaging). You can deactivate notifications at any time in the App or in your system settings.

Purpose: sending game-related and account-related notifications. Legal basis: Art. 6 (1) (a) GDPR (consent), which you may withdraw at any time; for the storage of, and access to, the token on your device additionally § 25 (1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG – German Telecommunications Digital Services Data Protection Act), see Section 4.

3.8 Analysis of app usage

We use Firebase Analytics to evaluate the use of the App and improve it (e.g. which functions are used, crash frequency, approximate region). Pseudonymous usage and device information is processed in the process.

Purpose: reach measurement and product improvement. Legal basis: Art. 6 (1) (a) GDPR (consent) and § 25 (1) TDDDG for access to information on your device. We ask for your consent when you first start the App. Until you consent, analytics collection is deactivated, so no usage data is collected, evaluated or transmitted for analytics purposes. You can change your decision at any time in the settings (withdrawal with effect for the future, as easy as giving consent), and the App remains fully usable if you refuse.

Please note what this does and does not mean technically: the Firebase platform components on which the App itself depends (including authentication, the database and abuse protection via Firebase App Check) start with the App and communicate with Google in order to provide the App you have asked for. What depends on your consent is the analytics collection, which stays switched off until you turn it on. See Section 4 for the device-side detail.

3.9 Crash and error reports

To improve stability we use Firebase Crashlytics. In the event of a crash, technical diagnostic data (device model, operating system version, time, error stack trace, anonymous installation ID) are recorded.

Purpose: detection and correction of errors. Legal basis: Art. 6 (1) (a) GDPR (consent) and § 25 (1) TDDDG. We ask for your consent when you first start the App. Until you consent, crash reporting collection is deactivated and no crash reports are recorded or transmitted. You can change your decision at any time in the settings. As in Section 3.8, the error handlers are registered when the App starts, but they hand nothing over for collection while collection is switched off.

3.10 In-app purchases (Klaimo Pro)

You can take out a paid subscription ("Klaimo Pro"). The seller is the respective app store (see GTC § 3); we use the service provider RevenueCat to manage purchase entitlements. We receive information about the purchase status (active/expired, product, anonymous identifiers), but not your payment data — these are processed exclusively by Apple or Google.

Purpose: provision and administration of paid functions. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract); retention for tax purposes pursuant to Art. 6 (1) (c) GDPR.

3.11 Promotional codes and vouchers

If you redeem a promotional or voucher code (in the App or via https://klaimo.de/redeem), we process the code, the time of redemption, your user ID and the resulting unlocked period. To detect misuse we log failed redemption attempts.

Purpose: redemption and administration of codes; abuse prevention. Legal basis: Art. 6 (1) (b) GDPR; for abuse detection Art. 6 (1) (f) GDPR.

3.12 Linking external services (optional)

You can voluntarily connect external accounts or upload files in order to import activities:

• GPX files — you can select and upload a recording as a GPX file from your device. We process the GPS track it contains, together with its timestamps, to create an activity from it. Imported rides count towards your statistics and records, but do not create a territory. No external account is required for this.

• Apple HealthKit (iOS only) — here we process data in two directions, which you grant separately from one another:

  • Reading: we read workout/training data only, in order to create activities in Klaimo from it. We do not read back in entries that Klaimo itself has written.
  • Writing back (optional, Klaimo Pro only): if you turn this on in the settings, once a ride recorded in Klaimo is complete we write it back as a workout to your health app — distance and start and end time only. We do not write any calorie burn, heart rate or other vital data. The feature is switched off by default; you can turn it off in the App at any time or revoke the write permission in the operating system.

  Both directions require your express permission in the operating system. Data read from HealthKit is not passed on to third parties and is not used for advertising.

These links are optional and are not necessary in order to use Klaimo. If you do not connect a service, no data is processed through it. You can disconnect at any time in the App or at the respective provider; we then delete the access tokens.

Purpose: importing activities from external sources and from GPX files, and — only if you turn it on — writing your rides recorded in Klaimo back to your health app. Legal basis: Art. 6 (1) (a) GDPR (consent) and, insofar as health data are concerned, Art. 9 (2) (a) GDPR (explicit consent) — see Section 5.

These are the only import connections that exist. No other provider of activity or training data receives data from Klaimo or supplies data to it, and none is listed in Section 8 or Section 9 for that reason.

3.13 Map display and route geometries

To display the map we use Mapbox. When maps are loaded, technical data (including IP address, requested map section, device information) are transmitted to Mapbox.

Mapbox telemetry — different on iOS and on Android. The Mapbox map component can send de-identified location and usage data ("Mapbox Telemetry") to Mapbox, Inc. in the USA for its own purposes.

• On iOS this function is switched off in Klaimo. The App deactivates it before the map is created, so no such telemetry leaves your device.
• On Android it is currently still active. The Flutter map plugin we use offers no interface for the opt-out that the Mapbox Android SDK documents. You can switch the telemetry off yourself through the information ("i") control on the map — that is Mapbox's own built-in opt-out, and it is visible in Klaimo.

Apart from that, what is transmitted to Mapbox is what is technically needed to fetch the map tiles you are looking at.

Purpose: display of the map — a core function of the App. Legal basis: Art. 6 (1) (b) GDPR.

3.14 Photo access (sharing function and profile picture)

If you share an activity or select a profile picture, the App accesses your photo library after you have granted permission. The selected image is used only for the respective purpose (share graphic or profile picture).

Legal basis: Art. 6 (1) (a)/(b) GDPR; access takes place at your initiative.

3.15 Support and error reports

If you send us an error report via the App or by e-mail, we process your e-mail address, your message and technical details (app version, operating system) in order to deal with your request.

Legal basis: Art. 6 (1) (b) and (f) GDPR.

3.16 Server logs

When our backend services are accessed, technically necessary data (IP address, time, requested resource, status code) are automatically processed in server logs.

Purpose: operation, security and stability of the services. Legal basis: Art. 6 (1) (f) GDPR.

3.17 Website https://klaimo.de

The website essentially provides information and these legal texts. It is hosted on Firebase Hosting, a service of Google; the contracting entity for customers in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The website klaimo.de is served by Firebase Hosting over Google's global content delivery (edge) network; the published pages contain no personal data. When you access the website, the hosting provider processes technically necessary access data (IP address, time, requested page, status code, referrer, user agent) in server logs. No content is loaded from third-party servers and no advertising or tracking cookies are set.

Legal basis: Art. 6 (1) (f) GDPR (secure and stable operation); for technically necessary storage on your device, § 25 (2) no. 2 TDDDG.

3.18 App Tracking Transparency and advertising attribution (iOS only)

On iOS devices we ask, via Apple's App Tracking Transparency (ATT) framework, for permission to use your device's advertising identifier (IDFA). We use it solely to measure how effective our advertising campaigns are — that is, whether and through which campaign (e.g. Google Ads) new users found Klaimo. The app itself shows no advertising and displays no personalised ads.

The IDFA is only processed if you agree to both: the analytics consent (section 3.8) and the ATT system prompt. If you decline either, no IDFA is collected. In addition we use Apple's SKAdNetwork, which measures campaign success only in aggregated form that cannot be traced back to you and needs no IDFA.

Purpose: measuring the success of our advertising campaigns (attribution). Legal basis: Art. 6(1)(a) GDPR (consent); you give permission in the ATT dialog. You can withdraw it at any time in iOS Settings under "Privacy & Security → Tracking" (effective for the future).

4. Access to information on your device (§ 25 TDDDG)

Irrespective of whether personal data are processed in the course of it, storing information on your device and gaining access to information already stored there is permitted only with your consent (§ 25 (1) TDDDG; in Austria § 165 (3) TKG 2021, in Switzerland Art. 45c (b) FMG). Excepted is access that is strictly necessary for the service you have expressly requested (§ 25 (2) TDDDG).

• Strictly necessary and therefore consent-free: the local storage of your login, your app settings, your consent decision and cached map and activity data.
• Only with consent: identifiers and local storage used by Firebase Analytics, Firebase Crashlytics and Firebase Cloud Messaging (device token).

We obtain your consent when you first start the App, through a selection dialog. In that dialog:

• both options are switched off by default — nothing is pre-selected;
• "Reject all" is offered with equal prominence, on the same level as "Accept all";
• consent is given separately for each purpose;
• collection for the purposes concerned stays deactivated until you consent, and is switched on only for the purposes you have accepted;
• you can change your decision at any time in the app settings; withdrawing is as easy as giving consent;
• the App is fully usable without consent.

To be precise about what this does not mean: the Firebase platform components that the App itself needs in order to run (authentication, database, and abuse protection via Firebase App Check) are initialised when the App starts and communicate with Google for that purpose, on the basis of Art. 6 (1) (b) GDPR and § 25 (2) TDDDG. Your consent decision governs the analytics and crash reporting collection described in Sections 3.8 and 3.9, which remains switched off until you accept it.

For the protection of terminal equipment, authorities other than the data protection supervisory authority may be competent in your country.

5. Health-related data (Art. 9 GDPR)

Certain data we process may be health data within the meaning of Art. 9 (1) GDPR (in Switzerland: sensitive personal data under Art. 5 (c) revFADP):

• training and workout data that you import from Apple HealthKit (iOS only) (e.g. heart rate, training duration, type of training),
• detailed movement and performance profiles that can be derived from your activity data.

We base this processing exclusively on your explicit consent under Art. 9 (2) (a) GDPR. This consent

• is obtained separately from the consent to analytics and crash reports, and separately for each integration, before the connection is established,
• is voluntary: the App and all core functions (recording, territories, leaderboards, teams) are fully usable without these integrations; we do not make access conditional on the consent (Art. 7 (4) GDPR),
• can be withdrawn at any time with effect for the future, by disconnecting the link in the App or at the respective provider.

After withdrawal we delete the imported health data, unless they form part of an activity you have already created; you can delete those activities individually as well.

Writing back to your health app. If you turn on writing back (Section 3.12), we send the distance and the start and end time of a ride recorded in Klaimo to Apple HealthKit on your device. We also base this on your explicit consent under Art. 9 (2) (a) GDPR: it is voluntary, not granted by default, and can be withdrawn at any time. Withdrawal has effect for the future — entries already written then remain in your health app and can only be removed there by you; we have no access to them.

6. Automated decisions and profiling (Art. 22 GDPR)

To protect the integrity of the game we automatically calculate a plausibility score for activities (Section 3.4). It assesses, among other things, speed, acceleration and the geometric consistency of the recorded track, in order to detect manipulated activities (e.g. GPS spoofing).

A conspicuous score can lead to an activity not being counted, to a game score being corrected, or — in repeated or serious cases — to your access being restricted (GTC § 8).

There is no decision based solely on automated processing which produces legal effects or similarly significantly affects you: before a correction or a suspension becomes permanently effective, a natural person reviews it. Independently of that, you have the right

• to obtain human intervention,
• to express your point of view, and
• to contest the decision (Art. 22 (3) GDPR).

A message to info@klaimo.de is sufficient. On the complaints procedure, see GTC § 8 (5).

7. Obligation to provide data and consequences of not providing it (Art. 13 (2) (e) GDPR)

• Necessary for the contract: e-mail address or the identifier from the social login, and display name. Without these data we cannot provide an account.
• Necessary for the core function: location data during a recording. Without the location permission no activities can be recorded and no territories conquered; the remaining functions stay usable.
• Voluntary, with no disadvantage: profile picture, push notifications, motion recognition, analytics, crash reports, linking external services. If you refuse these, you suffer no disadvantage other than the loss of the function concerned.

There is no statutory obligation to provide data.

8. Recipients and processors

We pass on personal data only insofar as this is necessary for the provision of our services. We have concluded contracts pursuant to Art. 28 GDPR with every one of the processors listed below (in Switzerland: processors under Art. 9 revFADP); where a transfer to a third country takes place, those contracts include the standard contractual clauses described in Section 9. The following are used:

Apple and Google are independent controllers in respect of the subscription, not our processors: they sell Klaimo Pro in their own name (see GTC § 3), and their own privacy policies apply to the payment data they process in that role.

9. Transfers to third countries

Some of the providers named process data in the United States of America:

• Google LLC (Firebase Analytics, Crashlytics, Cloud Messaging, App Check and support/maintenance access): USA
• Mapbox, Inc.: USA
• RevenueCat, Inc.: USA
• Apple Inc. (technical support for the store services): USA

For Google LLC and Mapbox, Inc. the transfer is covered by the adequacy decision of the European Commission of 10 July 2023 on the EU-US Data Privacy Framework: both are on the official list of certified participants.

Apple Inc. and RevenueCat, Inc. are not certified under the EU-US Data Privacy Framework. The transfer to them is therefore not covered by that adequacy decision. The transfer to these two recipients is instead based on the EU standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, which we have agreed with each of them, together with a transfer impact assessment and the additional measures resulting from it.

You can obtain a copy of the guarantees relied upon by writing to info@klaimo.de.

10. Retention periods

• Account data are stored for as long as your account exists.
• Activity, track and game score data are stored for as long as your account exists or for as long as this is necessary for the operation of the game.
• Crash and analytics data are deleted or anonymised in accordance with the respective provider's periods (as a rule, at most 14 months).
• Imported health data are deleted when you withdraw your consent or when the associated activity is deleted.
• Purchase and invoicing data are retained for up to 10 years on the basis of tax and commercial law obligations.
• Redemption and abuse logs relating to promotional codes: up to 12 months.
• Server logs are generally deleted within 30 days.
• Records of consent are kept for as long as we process the data based on them, plus the applicable limitation periods.

After your account has been deleted, your personal data are deleted or anonymised, unless statutory retention obligations prevent this.

11. Deleting a single ride, and deleting your account

You do not have to delete everything in order to remove something. In the App you can delete an individual ride at any time; its track, the territory derived from it and its contribution to your statistics and to the leaderboards are removed with it.

You can delete your account and the associated data at any time — in the App via your profile ("Delete account") or by e-mail to info@klaimo.de. On deletion, your profile, your activities, GPS tracks, territories, leaderboard entries, team memberships and your profile picture are removed; statutory retention obligations (e.g. for purchase records) remain unaffected.

Important: deleting your account does not end a running paid subscription. You have to cancel that separately in the Apple App Store or on Google Play (see GTC § 14 (4)).

12. Your rights

You have the following rights under the GDPR:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)
• rights in connection with automated decisions (Art. 22 GDPR, see Section 6)

A message to info@klaimo.de is sufficient to exercise your rights.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority with lead competence for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany https://www.lda.bayern.de

You may equally address the supervisory authority of your own country or of your place of residence, of your workplace, or of the place where the alleged infringement occurred. A list of the national authorities is published by the European Data Protection Board at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

Please note that the rules on storing information on, and accessing information stored in, your device (Section 4) are enforced in several countries by an authority other than the data protection authority. Your national authority can tell you which one is competent.

13. Data security

We take technical and organisational measures to protect your data against loss, misuse and unauthorised access. Transmission between the App and the backend is encrypted (TLS). Access to the backend is secured by authentication, and access rights are limited to what is necessary.

14. Minors

The App is not directed at children. For use of the App, GTC § 4 (3) sets a minimum age of 16; persons aged between 16 and 18 need the consent of their parent or legal guardian. This single threshold applies in every country in which Klaimo is available, and it is asked and checked during registration.

The data protection age threshold for a child's own valid consent differs from country to country. Art. 8 (1) GDPR permits Member States to set it anywhere between 13 and 16 years (for example 16 in Germany, 15 in France and Denmark, 14 in Austria, 13 in Belgium and Sweden); in Switzerland there is no fixed age limit and what matters is the capacity of judgement (Art. 16 Swiss Civil Code). Our uniform contractual minimum registration age of 16 is therefore at least as protective as your national rule, but it is a contractual minimum age and not a statement of what your national law requires.

If we learn that an account has been created contrary to these requirements, we delete it and the associated data.

15. Additional information for users resident in the EU/EEA

• In addition to the BayLDA, the supervisory authority of your own Member State is competent for you; see Section 12.
• The age at which a child can validly consent on their own to information society services is set by national law (Section 14).
• Access to your terminal equipment (Section 4) is governed in your country by the national implementation of Art. 5 (3) of Directive 2002/58/EC rather than by § 25 TDDDG; in Austria, for example, this is § 165 (3) TKG 2021.
• If you upload a profile picture on which other people are recognisable, note the national rules on the protection of a person's image (in Austria, for example, § 78 UrhG).

16. Additional information for users resident in Switzerland (revFADP)

The Swiss Federal Act on Data Protection (revFADP / revDSG, in force since 1 September 2023) applies to you. In addition to, and by way of derogation from, the sections above:

Terminology. Where the above refers to "personal data", "processing" and "processors", the Swiss terms are Personendaten, Bearbeitung and Auftragsbearbeiter. Health data and data from which profiles can be derived are sensitive personal data (Art. 5 (c) revFADP).

Controller. SB-Techworks Karim Belkacem, Lilienthalstrasse 38, 93049 Regensburg, Germany, info@klaimo.de.

Disclosure abroad (Art. 19 (4) revFADP). We disclose personal data in particular to the following states:

• Ireland (EU): Google Ireland Limited, Apple Distribution International Ltd., Google Commerce Limited
• Germany (EU): IONOS SE, Google Cloud region Frankfurt (backend)
• Belgium and the Netherlands (EU): Cloud Firestore database (Google EU multi-region eur3)
• United States of America: Google LLC, Mapbox Inc., RevenueCat Inc., Apple Inc.

For the EU states there is an adequacy decision of the Swiss Federal Council. For the USA we rely on the Federal Council's recognition of the Swiss-U.S. Data Privacy Framework (in force since 15 September 2024), insofar as the provider concerned is certified under it. Apple Inc. and RevenueCat, Inc. are not on the Data Privacy Framework list; the disclosure to them is therefore not covered by that framework. It is based instead on the standard contractual clauses with the Swiss addendum recognised by the FDPIC (Art. 16 (2) (d) revFADP), which we have agreed with each of them.

Consent. For the processing of sensitive personal data (Section 5) and for high-risk profiling we obtain your explicit consent (Art. 6 (7) revFADP).

Age. The revFADP sets no fixed age limit for consent; what matters is your capacity of judgement (Art. 16 Swiss Civil Code). The contractual minimum age of 16 for using Klaimo applies to you nonetheless.

Your rights. You have in particular the right of access (Art. 25 revFADP), the right to data portability (Art. 28 revFADP) and the claims under Art. 32 revFADP (rectification, erasure, objection). A message to info@klaimo.de is sufficient.

Supervision. You can report a matter to the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), Feldeggweg 1, 3003 Bern, https://www.edoeb.admin.ch

Representative in Switzerland. See the note in Section 1.

17. Changes to this Privacy Policy

We adapt this Privacy Policy when the data processing changes or legal requirements make it necessary. The current version is available in the App and at https://klaimo.de/datenschutz. We additionally inform you about material changes in the App or by e-mail.