Privacy Policy

To use the „AIMO gesund bewegt“ app“

Status: July 11, 2022



1. foreword and selected terms

AIMO takes the protection of customer data seriously. The protection of your individual privacy and personal sphere is of the utmost importance to us. Therefore, compliance with the legal provisions on data protection is a matter of course for us. This applies in particular to the „AIMO gesund bewegt“ app that we offer you. It is also important to us that you, as our customer, know at all times when we store which data and how we use it. Our principle is: “You decide what information you want to share - and with whom.”

On the one hand, this privacy policy informs visitors and users of our website about the data processing operations that take place online and in which personal data is processed. On the other hand, you will receive information about our processing operations that do not primarily take place online or via the „AIMO gesund bewegt“ app.

GDPR is the abbreviation for the European General Data Protection Regulation.

BDSG is the abbreviation for the Federal Data Protection Act in its current version.

Personal data are all individual details that allow conclusions to be drawn about a natural person (for definition see Art. 4 para. 1 GDPR). This includes, for example, names, email addresses, telephone numbers, but also data such as IP addresses or customer numbers.

The processing of personal data includes all operations, such as the collection, storage, transmission, archiving or deletion of personal data (definition Art. 4 para. 2 GDPR).

The data subject within the meaning of data protection law is any natural person whose personal data is processed.

Further definitions of terms can be found in the General Data Protection Regulation, which can be found in Art. 4 of the GDPR (Definitions).

2. general data protection guidelines

2.1 Data controller and data protection officer

Name and contact details of the controller

AIMO GmbH
Managing Director: Danny Dressler
Obere Gänsweide 5
73770 Denkendorf

E-mail: danny.dressler(at)aimo-fit.com

Name and contact details of the data protection officer

Fabian Henkel
Diplom-Betriebswirt (FH)
Certified data protection officer
DPO External Data Protection Officer Stuttgart
Kantstrasse 14
71277 Rutesheim

Phone: +49 7152 564 773
Fax: +49 7152 564 771
E-mail: info(at)externer-datenschutzbeauftragter-stuttgart.de

2.2 Principles

The following content gives you a brief overview of the processing of personal data; you will find more detailed information in the respective detailed passages.

Security on our website (SSL Secure Socket Layer)
Our website is equipped with an SSL certificate, which is used to encrypt data transmission processes. This happens, for example, when you send us a message via a form. However, as a precaution, we would like to point out that one hundred percent security in electronic data processing is not possible and that there is always a residual risk.

Data that you transmit to us
On this website, we process the data that you enter yourself, for example in a form. In this case, the purpose of the processing is determined by the type of form and also by this privacy policy. Even if you send us a message by e-mail, for example, or contact us in any other way, we will process your data in accordance with the purpose of the contact.

Automatic server log files
On the other hand, our server automatically records all accesses and therefore also IP addresses (log files). This serves to defend against attacks, analyze access figures and ensure smooth operation.

Use of cookies
Cookies help us to provide various services; you can find more information on this in this privacy policy.

Analysis and tracking tools
In addition to the pure server log files, which also provide us with information on page views, we use analysis tools. These tools give us detailed insights into the content visited on our site, the flow of behavior and, for example, the country from which access took place. For such services to work, cookies must be set for the site visitor or scripts must be executed.

Plugins and content delivery networks
We sometimes use plugins and content delivery networks; well-known examples of such services are the video service YouTube or the map service Google Maps. If such services are integrated via a website, access data is transmitted to the services. As a rule, this is your IP address and other metadata, such as the time and date of access. As a rule, this is provided by setting cookies.

Newsletter / Direct marketing

Direct marketing based on your consent
If you give us your consent (Art. 6 para. 1 lit. a GDPR), we will send you newsletters until you withdraw your consent. You can revoke your consent to us at any time with effect for the future.

Direct marketing in the legitimate interest
We reserve the right to send our customers newsletters on the basis of §7 para. 3 UWG in conjunction with Art. 6 para. 1 lit. f GDPR. You can of course object to receiving direct marketing information at any time.

Other data recipients

  1. a) Use of processors
    We use processors in accordance with the provisions of Art. 28 GDPR, for example in the area of IT services, web hosting, email hosting or printing services. They process personal data for us in accordance with our instructions.
  2. b) Utilization of external specialist services
    If necessary (e.g. for contract execution), we will pass on your data to banks, other payment service providers, shipping service providers, our tax advisor or lawyer, for example.
  3. c) Legal obligations
    In addition, in certain cases we are obliged to make a report to the competent authorities on the basis of the Money Laundering Act. We are also subject to other legal obligations, such as commercial law or tax law, in this context we must pass on certain data to tax authorities, for example.
  4. d) Investigation of criminal offenses
    If necessary for the investigation of a criminal offense, we pass on data to the law enforcement authorities.

General information on deletion periods for personal data
We process the data for as long as this is necessary for the respective purpose. If necessary, we process your personal data for the duration of our business relationship, which also includes the initiation and execution of a contract; in addition, we are obliged to comply with statutory retention obligations. If the data processing is based on your consent, we will delete your data after your revocation.

Transfer of personal data to a third country
Where possible, we try to have all service providers and services provided by providers within the European Union. A transfer to a third country is possible if you have given us your consent and/or we have concluded a contract for order processing in accordance with Art. 28 GDPR, taking into account suitable guarantees. In individual cases, we may use plugins or tools that are hosted in third countries, but we use them on the basis of our legitimate interests. In these cases, we will point this out if necessary.

Obligation to provide personal data
As a rule, you can use our website without providing personal data. The provision of personal data is regularly required for the initiation, conclusion, execution and reversal of a contract. If you do not provide the required personal data, it will not be possible for us to conclude and fulfill a contract with you. We can also provide services, such as our newsletter, by providing personal data, but you are free to use them.

2.3 Legal bases for the processing of personal data

The legal bases for the processing of personal data are exceptional circumstances that permit the processing of personal data. The main legal bases are set out in particular in Art. 6 GDPR. The legal bases according to which we process personal data are described in the individual processing operations in this privacy policy.

Consent given (Art. 6 para. 1 lit. a GDPR)
Consent is one of these legal bases and requires that the person giving consent does so in an informed manner and on a voluntary basis. Consent on the basis of Art. 6 para. 1 lit. a GDPR can be revoked at any time without giving reasons.

Contract-related data processing (Art. 6 para. 1 lit. b GDPR)
The processing of personal data for the initiation or execution of contracts is also a legal basis and is defined in Art. 6 para. 1 lit. b GDPR.

Legal obligation (Art. 6 para. 1 lit. c GDPR)
The exceptional case of data processing due to a legal obligation can be found in Art. 6 para. 1 lit. c GDPR, for example, we are obliged to comply with certain retention periods under commercial and tax law.

Legitimate interests (Art. 6 para. 1 lit. f GDPR)
The processing of personal data on the basis of a balancing of interests pursuant to Art. 6 para. 1 lit. f GDPR allows the processing after careful consideration of financial or legal interests against the legitimate interests of the data subject.

2.4 Your rights under the General Data Protection Regulation

Every natural person has certain rights, which are defined in particular in Articles 15 to 21 and 77 of the GDPR. In principle, you have the following rights that you can assert against us.

Right of revocation consent granted in accordance with Art. 7 GDPR
You can revoke your consent at any time without giving reasons with effect for the future.

Right to information according to Art. 15 GDPR (restrictions according to § 34 BDSG possible)
You have the right to request information about your processed data and the purposes of processing at any time.

Right to rectification according to Art. 16 GDPR
If you discover that we are processing incorrect or incomplete data about you, you have the right to rectification.

Right to erasure according to Art. 17 GDPR (restrictions according to § 35 BDSG possible)
You have the right to request the erasure of your personal data that we process at any time. If complete erasure is not possible, for example because we have to comply with statutory retention obligations or we can assert legitimate interests for other reasons, we will restrict your data until complete erasure is possible.

Right to restriction of processing according to Art. 18 GDPR
You have the right to request the restriction of the processing of your personal data. To do so, you can contact us at any time at the address given in the legal notice. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we generally need time to check this. For the duration of the review, you have the right to request that the processing of your personal data be restricted.

If the processing of your personal data was/is carried out unlawfully, you can request the restriction of data processing instead of erasure.

If we no longer need your personal data, but you need it for the exercise, defense or assertion of legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
If you have lodged an objection in accordance with Art. 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

Right to data portability according to Art. 20 GDPR
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place if it is technically feasible.

Right to object to certain processing operations and direct marketing according to Art. 21 GDPR
a) If the data processing is carried out on the basis of Art. 6 para. 1 lit. e or f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defense of legal claims (objection pursuant to Art. 21 (1) GDPR).

  1. b) If your personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is associated with such direct marketing. If you object, your personal data will no longer be used for the purpose of direct marketing (objection pursuant to Art. 21 (2) GDPR).

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR in conjunction with Section 19 BDSG
In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement. The right to lodge a complaint is without prejudice to other administrative or judicial remedies.

3. data processing through the use of the AIMO website

3.1 External hosting

This website and the „AIMO gesund bewegt“ app are hosted by an external service provider (host). The personal data that is collected in the process is stored on the hoster's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website. The hoster is used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). Our hoster will only process your data to the extent necessary to fulfill its performance obligations and follow our instructions with regard to this data.

We have commissioned the following hoster:
Amazon Web Services EMEA SARL,
38 Avenue John F. Kennedy,
L-1855, Luxembourg

In order to guarantee data protection-compliant processing, we have concluded an order processing contract with our hoster.

3.2 Automatic server log files

Our web server automatically logs all accesses and therefore also the IP addresses of visitors. This serves to defend against attacks, analyze access figures and ensure smooth operation. We have a legitimate interest in this (Art. 6 lit. f GDPR).

In addition to the IP address, the server log usually also records other metadata about the session; you will find this data below.

  • Date and time of retrieval
  • Information about the browser type and version used Browser
  • Details of the operating system used
  • Device (client)
  • Refferer URL (from which page you landed on our site)
  • Called hyperlinks

We only process this data for the above-mentioned purposes. We delete server log files after six months at the latest.

3.3 Cookies

General information
When you visit our website, information is stored on your end device in the form of cookies. A cookie is a small data record in the form of a file in which data such as personal page settings and login information are stored. By using cookies, we make it easier for you to use our online offering through various service functions (such as recognizing previous visits) and can thus better tailor the Internet offering to your needs.

In addition, with your consent, we use cookies from third-party providers for analysis and marketing purposes to optimize our website and for interest-based marketing purposes. The stored surfing behavior is analyzed using an algorithm so that targeted interest-based product recommendations can then be displayed in the form of advertising banners or advertisements on third-party websites. The pseudonymized user profiles are not merged with personal data about the bearer of the pseudonym without the separate express consent of the data subject.

You can prevent cookies from being saved and delete existing cookies by making the appropriate settings in your browser. The help function of most browsers explains how you can make these settings. However, if you do not accept cookies, this may impair the service functions of the website.

Further information
You can find information about the cookies we use at https://aimo-fit.com/cookie-richtlinien. Here you can also make individual settings for your cookie preferences. A detailed description of cookies and their use can be found under point 4 of this privacy policy.

3.4 Consent management

CookieLaw
We use the Cookielaw plugin to obtain consent for the use of cookies. Cookies are stored in your browser to save your preferences. The information generated by the Cookielaw cookies is not used to personally identify the visitor to this website and is not merged with personal data about the bearer of the pseudonym.

The following data is automatically logged by Cookielaw:

  • IP number of the end user in anonymized form
    (the last three digits are set to ‚x’)
  • Date and time of consent
  • One user ID
  • Consent status of the end user, which serves as proof of consent

If you do not agree to the storage of this data, you can object to the storage at any time by clicking the mouse as described above. In this case, a so-called opt-out cookie will be stored in your browser, which means that Cookielaw will only provide cookies for the technically error-free and optimized provision of the website. Please note that the complete deletion of your cookies means that the opt-out cookie will also be deleted and may have to be reactivated by you.

We use Cookielaw in the legitimate interest of a functional and user-friendly solution and thus base the processing on Art. 6 para. 1 lit. f GDPR). In addition, the use of Cookielaw serves to fulfill a legal obligation within the meaning of Art. 6 para. 1 lit. c GDPR.

3.5 Data collection and data transfer initiated by the data subject

Communication by e-mail
If you send us an email, we will process your data in accordance with the content and purpose of the message. As a rule, processing is carried out on the basis of pre-contractual measures or in the context of the execution of a contractual relationship on the basis of Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f. GDPR. We have a legitimate interest in processing your request quickly and efficiently.

Insofar as it is a product or service-related message, we generally process your data on the basis of our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR.

Please note that we store all incoming e-mails in accordance with the principles of proper accounting for a period of ten years, starting on the first day of the following year in which the message was received. If you ask us to delete the data, we will restrict the processing of your data from then on and only store it for the purpose of complying with retention periods in our legitimate interest.

Communication by telephone or fax
Even if you contact us by telephone or fax, we process your data either to initiate and execute contractual relationships (if the content is product- or service-related) and/or in our legitimate interest, analogous to contacting us by e-mail.

We do not record the content of conversations, but we may take notes to process your request. These are stored until the purpose of the data processing has been achieved and we no longer have any legitimate interests in the processing. If necessary, the content of the conversation will be stored anonymously for statistical purposes. You can of course request the deletion of your data at any time.

Newsletter Pre Sign-Up and Newsletter
You have the option of giving us your consent to receive direct marketing content. If you give your consent (Art. 6 para. 1 lit. a GDPR), for example to receive our email newsletter, we will process your data for the specific purpose of direct marketing measures by email.

As we are obliged to verify the accuracy of the e-mail address you provide when registering for the newsletter and want to ensure that it is correct, we use procedures that enable us to verify the ownership of the e-mail address. As a rule, this verification is carried out using the double opt-in procedure. After registering, you will receive an e-mail with a link that you must click to confirm. If the double opt-in procedure is not available due to temporary technical reasons, we will send you an e-mail to which you can reply without text to confirm your identity.

You can revoke your consent at any time with effect for the future. You will find an „Unsubscribe“ link in every newsletter. Alternatively, you can send us an e-mail with the subject „Unsubscribe from newsletter“. We will process your data until you withdraw your consent. Statutory retention periods remain unaffected.

Use of MailChimp
This website uses the services of MailChimp to send newsletters. The provider is Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

MailChimp is a service with which, among other things, the sending of newsletters can be organized and analyzed. If you enter data for the purpose of subscribing to the newsletter (e.g. email address), this data is stored on MailChimp's servers in the USA.

Standard contractual clauses have been concluded with MailChimp. These clauses ensure that compliance with European data protection standards is guaranteed in the USA.

With the help of MailChimp, we can analyze our newsletter campaigns. When you open an email sent with MailChimp, a file contained in the email (known as a web beacon) connects to MailChimp's servers in the USA. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked on. Technical information is also collected (e.g. time of access, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients.

If you do not wish to be analyzed by MailChimp, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message. You can also unsubscribe from the newsletter directly on the website.

The data processing takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

The data you provide us with for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from our servers as well as from the servers of MailChimp after you unsubscribe from the newsletter. Data stored by us for other purposes remains unaffected by this.

You can find more details in MailChimp's privacy policy at:
https://mailchimp.com/legal/privacy/

Conclusion of a data processing agreement
We have concluded a so-called „Data Processing Agreement“ with MailChimp, in which we oblige MailChimp to protect the data of our customers and not to pass it on to third parties.

3.6 Press distribution list

Registration for the press mailing list
If you are interested in receiving press releases and information electronically, you can be added to our press mailing list. To do so, please send us a message to info@aimo-fit.com with your contact details. In this case, the processing of your data for inclusion in the press distribution list and the sending of press releases is based on your consent (Art. 6 para. 1 lit. a GDPR).

You can revoke your consent to receive our press releases at any time. Please send us a message with the subject „Revocation press mailing list“ and we will delete your data from our press mailing list. The legality of the data processing operations that have already taken place remains unaffected by the revocation.

The data you provide us with for the purpose of receiving press information will be stored by us until you unsubscribe from the press distribution list and deleted after you unsubscribe from the press distribution list. Data stored by us for other purposes will remain unaffected by this.

3.7 Information for applicants

Data protection provisions Application procedure
If you apply to us, whether for an advertised position or on your own initiative, we will process your data to carry out the selection process. It is irrelevant to us whether you apply by post, by e-mail or, if available for the respective position, by online form.

As a matter of principle, we only process the data that you have sent us yourself as part of an application process. Other sources may be consulted after informing and consulting with you. For example, whether we may contact a former employer.

The legal basis for the implementation of an application procedure is § 26 BDSG in conjunction with Art. 6 para. 1 lit. b GDPR (initiation of an employment contract). If you give us your consent to store your data for a longer period of time, this is done on the legal basis of Art. 6 para. 1 lit. a GDPR.

Deletion periods for applicant data
We delete applicant data no later than 4 months after the end of the application process (once a candidate has been selected and all applicants have been informed of the outcome). The purpose of the data processing is generally no longer given with the end of the selection process, but we have a legitimate interest (Art. 6 para. 1 lit. f GDPR) in being able to defend ourselves against any claims by rejected applicants. If you have the impression that your interests in an immediate deletion outweigh ours, you have the possibility to request us to do so. We will then review your request and provide you with feedback.

After the above-mentioned period has expired, your data will be deleted, unless we have to defend ourselves in ongoing proceedings, for example due to a complaint under the General Equal Treatment Act. In this case, we will delete your data once the proceedings have been concluded, provided there are no statutory retention periods.

If we are allowed to store your data for a longer period of time on the basis of your consent, we will delete your data if you ask us to do so and revoke your consent. If necessary, we will also delete your data before you withdraw your consent if it is foreseeable that no position will be available.

Inclusion in our applicant pool
If we are unable to offer you a position at the present time, we may ask you for your consent to continue storing your data. The purpose of this is to offer you a suitable position at a later date. The legal basis for the processing of your data in our applicant pool is your consent (Art. 6 para. 1 lit. a GDPR). Of course, you can withdraw your consent at any time with effect for the future. If you do not revoke your consent yourself within a period of two years, we will delete your data from our applicant pool at the latest.

3.8 Data processing of support data

AIMO GmbH works together with Freshworks GmbH, Rauchstraße 9-11, 81679 Munich, Germany, to process support requests and revocations. Freshworks acts as a processor in accordance with Art. 28 GDPR.

Scope of data processing:
As part of the processing of support data by Freshworks GmbH, the following personal data is processed:

  • E-mail addresses
  • Insurance numbers
  • Names of the insured persons

 

Purpose of data processing:
This data is processed exclusively for the following purposes:

  • Answering support requests: Support for insured persons with questions or technical problems in connection with the services of AIMO GmbH.
  • Processing of revocations and terminations: Management and implementation of revocations within the framework of legal provisions and our contractual obligations.

 

Legal basis:
The processing of the aforementioned data is carried out in accordance with Art. 6 para. 1 lit. b GDPR (fulfillment of a contract) and Art. 6 para. 1 lit. f GDPR (legitimate interest in the efficient processing of support requests and revocations).

Disclosure and protective measures:
Freshworks GmbH has undertaken to process personal data only in accordance with our instructions and in compliance with the applicable data protection regulations. The data is protected by technical and organizational measures to prevent unauthorized access and data loss.

Duration of storage:
The support data is only stored for as long as is necessary for the stated purposes or as long as we are legally obliged to store it.

Rights of data subjects:
In accordance with Art. 15-22 GDPR, data subjects have the right to obtain information about the processing of their personal data, to have inaccurate data rectified, to request the restriction of processing or erasure of data and to object to processing.

4. data processing through the use of the „AIMO gesund bewegt“ app“

4.1 Registration of an AIMO account

You can use our login system to create your AIMO account, which you can use to log in to all our offers after your initial registration. We use cookies to identify you. All the data you enter in your account is stored in an AIMO GmbH database at the service provider named below.

You can only use our offers if you set up an AIMO account. We ask for the data listed below when you register (some of which is mandatory). In addition to our privacy policy, you must also accept our general terms and conditions and terms of withdrawal.

After entering your details, you will be sent a registration link to the e-mail address you have provided. The registration link is valid for 14 days. If you do not confirm your registration, your personal data will be deleted immediately after the registration link expires. If you would still like to open an AIMO account after the seven days have expired, please register again.

4.1.1 Registration with Facebook or Google

We also offer you the option of creating your AIMO account via your Facebook account or your Google account or linking it to your Facebook profile or Google profile. You can register or log in with us using your Facebook or Google account if you simply use the Facebook or Google button instead of other options when registering your AIMO account. You will then be redirected to Facebook or Google (where you must be logged in or have an account) and will be told what data we need from you from Facebook or Google - in particular your public profile information, such as first name, surname, gender and your e-mail address, which you have stored there. This is necessary for identification purposes in order to create a secure AIMO account for you. If you log in via your Facebook account, this also allows us to show you which of your friends are already registered with AIMO. Your Facebook or Google profile and your AIMO account are permanently linked via the e-mail address. We store your e-mail details and will contact you at this address with information if necessary. We also remember that you have registered with us via Facebook or Google. As soon as

If you log in to Facebook or Google, you can also log in to us. We will not pass on any data about you to Facebook or Google without your consent. We will not find out your Facebook or Google access data at any point and will not be able to post anything on your Facebook profile or Google profile without your separate consent. You can find out how Facebook handles privacy settings in Facebook's data protection information and terms of use; the valid provisions for the above-mentioned option of logging in and registering with us are also shown there. You can find out how Google handles privacy settings in Google's privacy policy and terms of use; the valid provisions for the above-mentioned option of logging in and registering with us are also shown there.

Data

  1. Purpose of the processing
  2. Legal basis of the processing
  3. Storage duration
  4. Platform

First name

  1. Direct approach & presentation
  2. Implementation of the contractual relationship
  3. Up to 30 days after deletion of the customer account
  4. Facebook / Google

Last name

  1. Direct approach & presentation
  2. Implementation of the contractual relationship
  3. Up to 30 days after deletion of the customer account
  4. Facebook / Google

E-mail address

  1. Identification of the customer account
  2. Implementation of the contract of use
  3. Up to 30 days after deletion of the customer account
  4. Facebook / Google

IP address at login

  1. Data transfer to web server during registration
  2. Implementation of the contract of use
  3. For an indefinite period
  4. Facebook / Google

Gender

  1. Suitable user experience
  2. Implementation of the contract of use
  3. For an indefinite period
  4. Facebook

 4.1.2 Registration with Apple

We also offer you the option of registering and logging in via your Apple account using „Apple Login“. When you register for the first time using your Apple ID, the app will ask you for your name and email address so that an account can be set up for you.

You will then be redirected to Apple (where you need to be logged in or have an account) and will be told what data we need from you from Apple - in particular your public profile information, such as first name, surname, gender and your e-mail address, which you have stored there. This is necessary for identification in order to create a secure AIMO account for you.

We will store your e-mail details and may contact you at this address with information. While you are using the „Register with Apple ID“ function, Apple itself will not track you or create a profile of you. Apple only collects the information necessary to ensure that you can sign in and manage your account. As long as you remain logged in on your device, you will automatically remain logged in to our app.

Data

  1. Purpose of the processing
  2. Legal basis of the processing
  3. Storage duration
  4. Platform

First name

  1. Direct approach & presentation
  2. Implementation of the contractual relationship
  3. Up to 30 days after deletion of the customer account
  4. Apple

Last name

  1. Direct approach & presentation
  2. Implementation of the contractual relationship
  3. Up to 30 days after deletion of the customer account
  4. Apple

E-mail address

  1. Identification of the customer account
  2. Implementation of the contract of use
  3. Up to 30 days after deletion of the customer account
  4. Apple

IP address at login

  1. Data transfer to web server during registration
  2. Implementation of the contract of use
  3. For an indefinite period
  4. Apple

Gender

  1. Suitable user experience
  2. Implementation of the contract of use
  3. For an indefinite period
  4. Apple

4.2 Data processing when using the „AIMO gesund bewegt“ app“

AIMO offers you access to a technology that allows you to receive information about your fitness status. In order to grant you this access, we need information from you. These include.

  • Name
  • Mail address
  • Date of birth
  • Gender
  • Weight
  • Size
  • Profile picture
  • IP address
  • Usage data (such as various time stamps)
  • Everyday working life (physically active in %, sedentary in %)
  • Sport type
  • Indicated pain before or after the movement scan
  • Health insurance
  • Insured person number

In addition, the „AIMO gesund bewegt“ app records videos of you in order to analyze your movements. AIMO is aware that this is all very personal and confidential information. We take organizational and technical measures to protect your data in the best possible way. These include the following technical and organizational measures:

Technical measures

  • Personal data such as your name, e-mail address or date of birth are stored in an encrypted database so that only AIMO administrators can access them for maintenance purposes.
  • Your password never leaves your device and can therefore never be viewed by AIMO employees or attackers.
    Your videos are stored in encrypted storage on our servers so that they can only be viewed by the AIMO software and a highly restricted group of administrators and researchers who must have appropriate access authorization.
  • All data transmission between the „AIMO gesund bewegt“ app and AIMO servers is end-to-end encrypted, which means that your data cannot be viewed or changed by anyone on its way through the Internet.
  • The server-internal data transfer is also end-to-end encrypted, so attackers cannot take advantage of data streams within the AIMO server infrastructure, assuming they even get there.
  • We have deployed three different types of firewall on three different levels on our servers. This makes access considerably more difficult for attackers.
  • To log in to the „AIMO gesund bewegt“ app, you can activate Touch ID/Face ID to log in using a biometric factor that only you have.
  • Every change that could affect the ownership of your account, such as changing your password or email address or deleting your account, requires additional confirmation of the process via a second factor, i.e. via email. This means that even if someone gets hold of your password, they cannot change the basic settings of your account unless they have access to your e-mails.
  • Your „AIMO gesund bewegt“ app automatically logs you out after 14 days of inactivity, so you will need to log in again.
  • All data subject rights under the GDPR have been implemented directly in the „AIMO gesund bewegt“ app and can therefore be exercised by yourself via the app without the intervention of AIMO Support.

Organizational measures

  • Customer data is hosted within Germany in the Amazon data center in Frankfurt am Main.
  • Access rights to customer data are very limited and can only be viewed by a few AIMO administrators trained in data protection for maintenance purposes if necessary.
    To make it more difficult for attackers, personal data and health data are stored separately on independent, encrypted databases and file storage systems.
  • Our deletion concept ensures that only the data that is necessary for your use and our further development of the app is stored.
    Our backup concept ensures that we can restore your data in the shortest possible time should something go wrong.
  • An emergency management system has been established so that we can act as quickly as possible in crisis situations.
    A process for reporting data breaches has been established to ensure that you, as well as the authorities, are informed of data breaches in good time and as quickly as possible should they occur.

In order for you to use the „AIMO gesund bewegt“ app, we need your consent to process the health data you provide and to record and process videos. You provide the following declaration when you start the app:

„I hereby consent to AIMO GmbH, Obere Gänsweide 5, 73770 Denkendorf, Germany, collecting and processing the personal data I have provided, my health data with exercise videos and the results of the analysis for the purpose of operating the „AIMO gesund bewegt“ app. I am aware that I can revoke this consent at any time by sending an informal declaration to AIMO GmbH, Obere Gänsweide 5, 73770 Denkendorf by e-mail to support@aimo-fit.com or by letter to AIMO GmbH, Obere Gänsweide 5, 73770 Denkendorf.“

The „AIMO gesund bewegt“ app uses your data to determine your personal AIMO™ movement score and inform you of it. The AIMO™ movement score is determined automatically. The processing is based on your consent; Art. 6 para. 1 lit. a) GDPR.

4.2.1 Sending e-mails in the app

E-mails are sent automatically. For this purpose, we use the e-mail dispatch service of Mailjet, 4, rue Jules Lefebvre, 75009 Paris, France. Mailjet is a European provider and therefore also complies with all technical and organizational measures required by the GDPR.

4.3 Push notifications in the app

If you would like to receive our push notifications on your mobile device, even if you are not currently in our app, we ask for your consent. Our app only uses these push notifications if you have expressly consented to them. You can deactivate push notifications at any time in the settings. If you use an Android device, push notifications are automatically allowed as long as you do not deactivate them in your settings.

Amazon Web Services

  • Service provider type: Processor
  • Data transfer to third countries: No (server in Germany in Frankfurt am Main)
  • Guarantees pursuant to Art. 44ff GDPR: EU standard contractual clauses

Google Firebase

  • Service provider type: Processor
  • Data transfer to third country: Yes
  • Third country: USA
  • Guarantees pursuant to Art. 44ff GDPR: EU standard contractual clauses

Data

Device Token

  • Purpose of processing: Transmission to your end device
  • Legal basis for processing: Consent
  • Storage period: Until withdrawal of consent

User data that is also accessible in your public profile

  • Purpose of processing: Direct contact
  • Legal basis for processing: Consent
  • Storage period: Until withdrawal of consent

5. analysis, cookies and performance tracking

Google Analytics
AIMO uses Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; „Google“). Google Analytics uses cookies, which enable your use of the website to be analyzed. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. We only use Google Analytics with activated IP anonymization. This means that Google will truncate the IP address of users in member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The IP address transmitted by the user's browser will not be merged with other Google data. Users can prevent the storage of cookies by adjusting the settings in their browser software accordingly. We have made data protection-friendly default settings.

The storage of Google Analytics cookies and the use of this analysis tool are based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the analysis of user behavior in order to optimize both its website and its advertising. If a corresponding consent has been requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time. Google will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. Pseudonymous user profiles can be created from the processed data.

The legal basis for the use of Google Analytics is § 15 para. 3 TMG or Art. 6 para. 1 lit. f GDPR. Users can also prevent Google from collecting the data generated by the cookie and relating to their use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser add-on. Opt-out cookies prevent the future collection of your data when you visit this website. If you click here, the opt-out cookie will be set: Deactivate Google Analytics. As a guarantee according to Art. 44 ff. GDPR, Google has signed the EU standard contractual clauses. Further information on data processing by Google Analytics can be found in the provider's privacy policy.

If you no longer wish to be tracked by Google Analytics in the future, you can send an email to support@aimo-fit.com at any time.

Facebook Pixel
AIMO uses Facebook Pixel, a web analytics service provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Facebook Pixel uses cookies that enable your use of the website and the app to be analyzed. The information generated by the cookie about your use of this website and app is usually transferred to a Facebook server in the USA and stored there.

We only use Facebook Pixel with activated IP anonymization. This means that Facebook will truncate the IP address of users in member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Facebook server in the USA and truncated there. The IP address transmitted by the user's browser is not merged with other Facebook data. Users can prevent cookies from being saved by adjusting the settings in their browser software accordingly. We have made data protection-friendly default settings.

The legal basis for the use of Facebook Pixel is § 15 para. 3 TMG or Art. 6 para. 1 lit. f GDPR. Users can also prevent the collection of data generated by the cookie and related to their use of the website (including your IP address) to Facebook and the processing of this data by Facebook by downloading and installing the browser add-on. Opt-out cookies prevent the future collection of your data when you visit this website. If you click here, the opt-out cookie will be set: Deactivate Facebook Pixel.

If you no longer wish to be tracked by Facebook Pixel in the future, you can send an email to support@aimo-fit.com at any time.

n8n (process automation)

We use n8n as an automation platform for the technical processing of data streams.
Personal data is processed exclusively temporarily passed through, to carry out defined processing steps.
One n8n does not permanently store personal data.

Legal basis:
Art. 6 para. 1 lit. a GDPR (consent) or Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient process design).

OpenAI (ChatGPT)

As part of automated processes, the service OpenAI (ChatGPT) is used within n8n. The service is used exclusively to receive a message transmitted by the AIMO app. Name string technically divided into first and last name.

It takes place No independent storage of the data by us for this purpose.
Processing is used exclusively for the technical structuring of data.

Legal basis:
Art. 6 para. 1 lit. a GDPR (consent).

Google Sheets

To the temporary caching For further processing we use Google Sheets.

The following data is processed:

  • Timestamp

  • IP address

  • First name, last name and e-mail address exclusively in hashed (cryptically unreadable) form

The data is used exclusively for technical processing in the context of advertising tracking and is not used for other purposes.

Legal basis:
Art. 6 para. 1 lit. a GDPR (consent).

Facebook (Meta Platforms)

The hashed data cached in Google Sheets is sent to Facebook (Meta Platforms Ireland Ltd.) transmitted in order to Assignment to Facebook advertising campaigns to make this possible.

Facebook uses this data to measure the success and optimization of Facebook Ads.
Processing only takes place for users who have consented to advertising tracking.

Legal basis:
Art. 6 para. 1 lit. a GDPR (consent).

Hyros (advertising and conversion analysis)

We use Hyros to analyze and evaluate our advertising campaigns.
Hyros records website visits to the AIMO website and links these to purchase and activation events in the AIMO app.

Only data from users who have expressly consented to advertising tracking is collected, including

  • E-mail address

  • IP address

  • First and last name

  • visited subpages of the AIMO website

The aim is to evaluate which advertising campaigns are successful and how users interact with our offers.

Legal basis:
Art. 6 para. 1 lit. a GDPR (consent).

Profiling
With the help of the Google Analytics tracking tool, the behavior of visitors to the website can be evaluated and their interests analyzed. We create a pseudonymized user profile for this purpose.

IP anonymization
We have activated the IP anonymization function on this website. This means that your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Objection to data collection
You can prevent the collection of your data by Google Analytics by clicking on the following button. An opt-out cookie will be set to prevent your data from being collected on future visits to this website:

Decline cookies

You can find more information on how Google Analytics handles user data in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Order processing
We have concluded an order processing contract with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Storage duration
Data stored by Google at user and event level that is linked to cookies, user IDs or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) will be anonymized or deleted after 14 months. Details can be found at the following link: https://support.google.com/analytics/answer/7667196?hl=de

Google Ads and Google Conversion Tracking
This website uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland.

As part of Google Ads, we use what is known as conversion tracking. When you click on an ad placed by Google, a cookie is set for conversion tracking. These cookies lose their validity after 30 days and are not used to personally identify users. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page.

Each Google Ads customer receives a different cookie. The cookies cannot be tracked via the websites of Google Ads customers. The information collected using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information with which users can be personally identified. If you do not wish to participate in tracking, you can object to this use by deactivating the Google conversion tracking cookie via your Internet browser under user settings. You will then not be included in the conversion tracking statistics.

The storage of „conversion cookies“ and the use of this tracking tool are based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising. If a corresponding consent has been requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

You can find more information about Google Ads and Google Conversion Tracking in Google's privacy policy: https://policies.google.com/privacy?hl=de.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

Amplitude
Amplitude is an analysis tool of Amplitude EMEA Headquarters, Keizersgracht 277 1016ED Amsterdam The Netherlands.
With the help of Amplitude, we can find out how our users use the AIMO app. Amplitude helps us to improve or expand the content, navigation and general app structure and processes within the app. The data collected for this purpose is pseudonymized. This means that only AIMO can trace the data collected in Amplitude back to your account, and only with great effort. From Amplitude's perspective, the data is anonymous and therefore cannot be traced back to a specific person.
Amplitude complies with all technical and organizational measures required by the GDPR.