Privacy Policy
The Places You Love
iOS Application | Apple App Store | Germany
1. Controller (Data Responsible Party)
The controller responsible for personal data processing within the meaning of the EU General Data Protection Regulation (GDPR) is:
- Company: The Places You Love GbR
- Partners: Thomas Kröber, Kee Cheng, Mark Foligno, Daniel Seyde, Mariia Vodopyanova
- Address: Weserstraße 39, 10247 Berlin, Deutschland
- Email: info@theplacesyoulove.com
- Website: www.theplacesyoulove.com
- App: The Places You Love – iOS (Apple App Store)
2. Data We Collect
The following personal data is collected when you use The Places You Love — including data collected by integrated third-party SDKs (analytics, advertising).
| Data Type | Category | Purpose | Legal Basis | Linked to User | Tracking |
|---|---|---|---|---|---|
| Email Address | Contact Info | Account creation, auth, marketing | Art. 6(1)(a),(b) GDPR | Yes | Yes |
| Name | Contact Info | Account creation, auth, marketing | Art. 6(1)(a),(b) GDPR | Yes | Yes |
| User ID | Identifiers | App functionality, account management | Art. 6(1)(b) GDPR | Yes | Yes |
| Photos or Videos | User Content | Core app function (user-generated content) | Art. 6(1)(b) GDPR | Yes | No |
| Performance Data | Diagnostics | App stability & performance monitoring | Art. 6(1)(f) GDPR | No | No |
| Other Diagnostic Data | Diagnostics | Technical diagnostics, app improvement | Art. 6(1)(f) GDPR | No | No |
| Crash Data | Diagnostics | Bug fixes, app stability | Art. 6(1)(f) GDPR | No | No |
3. Legal Bases (Art. 13 GDPR)
We process your personal data on the following legal bases:
- Art. 6(1)(a) GDPR – Consent: marketing communications and third-party tracking. Consent can be withdrawn at any time.
- Art. 6(1)(b) GDPR – Contract performance: processing required to provide app services and manage your account (email, name, user ID, photos/videos).
- Art. 6(1)(f) GDPR – Legitimate interests: anonymised diagnostic data (crashes, performance) for technical stability. Our interests are not overridden by your rights since no data is linked to your identity.
Where tracking relies on consent, we will request this explicitly via Apple's App Tracking Transparency (ATT) framework. Declining has no consequence for core app functionality.
4. Purposes of Processing
4.1 Contact Info (Email & Name) — Used for: account creation & authentication; marketing & communications (with your consent; opt-out at any time via unsubscribe link or by emailing info@theplacesyoulove.com); customer support.
4.2 User ID — Generated on account creation to identify your account across sessions, associate your content and settings, and enable personalised features.
4.3 Photos & Videos — Used solely for the core function of The Places You Love — documenting and sharing places that matter to you. Not used for advertising or tracking.
4.4 Diagnostics — Crash Data, Performance Data, and Other Diagnostic Data are collected in anonymised form to maintain app stability. Not linked to your identity. Legal basis: Art. 6(1)(f) GDPR.
5. Tracking & Third-Party Data Use
Email Address, Name, and User ID may be used for tracking — i.e., linking app data with data from other companies' apps or websites for targeted advertising or measurement purposes. Tracking occurs only with your explicit consent (Art. 6(1)(a) GDPR) via Apple's ATT prompt.
Withdraw consent at any time via: iOS Settings > Privacy & Security > Tracking (toggle off for The Places You Love); in-app privacy settings; or writing to info@theplacesyoulove.com. Withdrawal does not affect the lawfulness of prior processing.
6. Cookies & Tracking Technologies (TTDSG)
The app does not use browser cookies. Where tracking SDKs access identifiers stored on your device, this requires consent under § 25 TTDSG (German Telecommunications & Telemedia Data Protection Act), which we obtain before such access occurs.
7. Sharing of Personal Data
7.1 Processors (Art. 28 GDPR) — We use trusted service providers under Data Processing Agreements (DPA). They process data only on our behalf:
- Supabase – authentication, database, and file/photo storage hosting.
- MongoDB Atlas – database hosting for application data.
- Railway – hosting of our backend application services (Python).
- TelemetryDeck – privacy-focused, anonymised app analytics and diagnostics.
7.2 Advertising & Analytics Partners — Third-party SDKs may receive data as described in Section 5. See those partners' privacy notices for details.
7.3 Legal Obligations — We may disclose data when required by law or official order (Art. 6(1)(c) GDPR).
7.4 Business Transfers — In a merger or acquisition, data may transfer to the acquiring entity. We will notify you in advance.
8. International Data Transfers (Art. 44 ff. GDPR)
Where data is transferred outside the EEA (e.g. US-based servers), we rely on:
- EU Standard Contractual Clauses (SCC) per Commission Decision (EU) 2021/914;
- An EU Commission adequacy decision (e.g. EU–US Data Privacy Framework where applicable);
- Other supervisory-authority-approved safeguards.
A copy of the applicable safeguards is available on request.
9. Retention & Deletion (Art. 5(1)(e) GDPR)
- Account data (email, name, user ID): until account deletion or consent withdrawal, plus statutory retention periods (e.g. 10 years under German commercial/tax law).
- Photos & videos: until actively deleted by you or account closure.
- Diagnostic data: anonymised; auto-deleted after a maximum of 12 months.
10. Your Rights (Art. 15–22 GDPR)
- Access (Art. 15) – obtain confirmation and a free copy of your data.
- Rectification (Art. 16) – correct inaccurate or incomplete data.
- Erasure (Art. 17) – request deletion where no legitimate basis for retention exists.
- Restriction (Art. 18) – limit processing in certain circumstances.
- Portability (Art. 20) – receive your data in a structured, machine-readable format.
- Objection (Art. 21) – object to processing based on legitimate interests or for direct marketing at any time. If you object to direct marketing, we will cease that processing immediately.
- Withdrawal of consent (Art. 7(3)) – withdraw consent at any time, with future effect.
- Complaint (Art. 77) – lodge a complaint with the competent supervisory authority (see Section 12).
Submit requests to: info@theplacesyoulove.com. We respond within one month (Art. 12(3) GDPR), extendable by two months for complex requests.
11. Children's Privacy
The app is not directed at children under 16 (Art. 8 GDPR — Germany applies the 16-year threshold). If we discover data has been collected from a child without parental consent, we will delete it immediately. Contact: info@theplacesyoulove.com.
12. Competent Supervisory Authority
As we are based in Berlin, our competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI – www.datenschutz-berlin.de). You also have the right to lodge a complaint with the authority for your own German federal state (Bundesland):
| Region | Authority |
|---|---|
| Bavaria | BayLDA – www.lda.bayern.de |
| Berlin | BlnBDI – www.datenschutz-berlin.de |
| Baden-Württemberg | LfDI BW – www.lfd.bwl.de |
| Hamburg | HmbBfDI – www.datenschutz.hamburg.de |
| North Rhine-Westphalia | LDI NRW – www.ldi.nrw.de |
| Federal (BfDI) | www.bfdi.bund.de |
13. Data Security (Art. 32 GDPR)
We implement appropriate technical and organisational measures (TOMs) including: TLS/SSL encryption in transit; access controls and role-based permissions; regular security reviews. No electronic storage or transmission method is 100% secure.
14. Apple App Store Privacy Nutrition Label
- Data Used to Track You: Email Address, Name, User ID
- Data Linked to You: Email Address, Name, User ID, Photos or Videos
- Data Not Linked to You: Performance Data, Crash Data, Other Diagnostic Data
15. Third-Party Links
The app may link to third-party services. This policy does not apply to those. Please review their privacy notices.
16. Changes to This Policy
We may update this policy periodically. The "Last Updated" date at the top will reflect changes. For material changes, we will notify you via the app or email.
17. Contact
- Company: The Places You Love GbR
- Partners: Thomas Kröber, Kee Cheng, Mark Foligno, Daniel Seyde, Mariia Vodopyanova
- Address: Weserstraße 39, 10247 Berlin, Deutschland
- Email: info@theplacesyoulove.com
- Website: www.theplacesyoulove.com
This Privacy Policy was prepared in compliance with the GDPR, the German Federal Data Protection Act (BDSG), the TTDSG, the UWG, and Apple App Store requirements.