Privacy policy Klar app

For legal interpretation, the German version of this Document is legally binding. This English translation is provided for convenience only and is a result of automated processing.

Specific privacy policy for Klar app

This privacy policy provides specific information about processing your data that is collected when you use the Klar app of Klar Insights GmbH. Your data is processed in accordance with the statutory data protection regulations.

General part

You can find the general section of the privacy policy, which includes the data subjects rights and the contact details of the data controller or data protection officer, here: https://www.getklar.com/data-protection

Data Subject Rights

Data Subject Rights under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

Right of access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and to obtain information about this data and further information and a copy of the data in accordance with the legal requirements.

Right to rectification: In accordance with the statutory provisions, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.

Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to demand that data concerning you be erased immediately or, alternatively, to demand that the processing of the data be restricted in accordance with the statutory provisions.

Right to data portability: You have the right to receive the data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format in accordance with the legal requirements or to request its transmission to another controller.

Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on lit. (f) of Article 6(1) GDPR, including profiling based on those provisions. If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Right to withdraw consent: You have the right to withdraw your consent at any time with effect for the future.

Complaint to the supervisory authority: You have the right to lodge a complaint with the supervisory authority if you believe that your personal data is being processed unlawfully. The address for the competent supervisory authority is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) (address: Promenade 18, 91522 Ansbach, telephone: +49 (0) 981 180093-0).

To exercise your rights, please contact our data protection officer via [email protected].

Klar app

Provision of the app

Klar uses a hosting service provider to provide the app. During the provision of this app, it is possible that data (operating system and IP address) is collected each time the server on which this service is located is accessed. However, this data is not stored. The app is hosted via the computing capacity of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) with a server location in Germany.

We have concluded a data processing agreement with our hosting service provider. This contract ensures that the service provider processes the data in accordance with the GDPR and guarantees the protection of the data subject rights.

Possibility of objection and removal

The collection of technical data is absolutely necessary for the provision and operation of the app. Consequently, the user has no option to object.

Providers and services used in the course of business activities

As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers ("services" for short) in compliance with legal requirements. Their use is based on our interests in proper, lawful and efficient business processing, the improvement of our service quality and the optimisation of our business processes. These services help us to process data securely and effectively, improve communication channels, maintain customer relationships and continuously optimize our services. They are carefully selected to comply with data protection requirements and to ensure the confidentiality, integrity and availability of data.

Use of cookies

Klar uses the well-known technology of so-called cookies. These are small files that your browser automatically creates and stores on your end device (laptop, tablet, smartphone, etc.). Cookies do not cause any damage to your end device and do not contain any viruses, Trojans or other malware. They store information relating to the specific end device that uses them. This allows us to gain indirect knowledge of your identity.
Two types of cookies are used on this website: Session cookies, which are related to a single session, and persistent cookies, which remain stored on your end device for longer periods of time.

Most of the cookies used on this website are so-called first party cookies.
These are placed directly by Klar or its service providers and are used exclusively by them. However, third-party cookies may also be used to track user behaviour.

You have the option of deactivating the storage of cookies in your browser. You can find more information about these settings in the documentation or help section of your browser. Please note, however, that you may not be able to use some parts of the website or certain functions, or only to a limited extent, if you refuse the use of cookies.

The specific cookies used when using this website are described below.

Technically necessary cookies

Cookies are used on this website that are necessary to provide the site without disruption. These technically necessary cookies are already stored on your end device when you access the website. Unfortunately, it is not possible to use the website without these cookies, which are listed below. If personal data is processed in connection with these cookies, this is done in accordance with Art. 6 Para. 1 S.1 lit. f) GDPR. The trouble-free display of the website constitutes a legitimate interest within the meaning of this provision. A balancing of interests has shown that the interests of the users in excluding this data processing do not outweigh the legitimate interests.

Cloudflare

We use the services of Cloudflare Germany GmbH to manage our domains, DDOS protection and many other services.

Categories of personal data: IP address
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany
Server location: Germany, USA
Website: https://www.cloudflare.com/
Privacy policy: https://www.cloudflare.com/
Data protection addendum: https://www.cloudflare.com/de-de/cloudflare-customer-dpa/
Appropriate safeguards: EU-US Data Privacy Framework & standard contractual clauses

The processing of the data required to achieve the aforementioned purposes is to be classified as a legitimate interest within the meaning of this provision. A balancing of interests has shown that the overriding interests of the users in the exclusion of this data processing are not to be assumed.

Google Fonts

Google Fonts makes it possible to use fonts on your own website without having to store them on your own server. The fonts are loaded via a Google server when the website is loaded, whereby user data, including the user's IP address, is transmitted to Google.

Categories of personal data: IP address
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Server location: EU
Website: https://www.google.com/intl/de_de/business/
Privacy policy: https://policies.google.com/privacy
Data protection addendum: https://cloud.google.com/terms/data-processing-addendum/

The processing of the data required to achieve the aforementioned purposes is to be classified as a legitimate interest within the meaning of this provision. A balancing of interests has shown that the overriding interests of the users in the exclusion of this data processing are not to be assumed.

Google Tag Manager

With the user's consent, we deliver our JavaScript snippets via Google Tag Manager.

Categories of personal data: Online identifiers (including cookie identifiers) and IP addresses
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Server location: EU
Website: https://www.google.com/intl/de_de/business/
Privacy policy: https://policies.google.com/privacy
Data protection addendum: https://cloud.google.com/terms/data-processing-addendum/

The processing of the data required to achieve the aforementioned purposes is to be classified as a legitimate interest within the meaning of this provision. A balancing of interests has shown that the overriding interests of the users in the exclusion of this data processing are not to be assumed.

Technically unnecessary cookies

In addition to technically necessary cookies, we also use technically unnecessary cookies and pixels on this website to enable us to analyse the surfing behaviour of our website visitors. For example, the following data is stored and processed:

The legal basis for this processing is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR. Cookies, pixels and other tracking technologies that are not technically necessary are automatically deleted after a specified period, which may vary depending on the tracking method. If we integrate third-party cookies or pixels and similar tracking technologies into our website, we will inform you of this separately below.

Microsoft Clarity

Microsoft Clarity is a session recording and heat mapping service provided by Microsoft Corporation. We are constantly endeavouring to improve our software for our customers and use Clarity for quality control of recently introduced functions.

Categories of personal data: IP address
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: Microsoft Corporation, One Microsoft Way, Redmond, USA
Server location: Germany
Website: https://www.microsoft.com/de-de/
Privacy policy: https://www.microsoft.com/de-DE/privacy/privacystatement
Data protection addendum: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=18

The processing of the data required to achieve the aforementioned purposes is to be classified as a legitimate interest within the meaning of this provision. A balancing of interests has shown that the overriding interests of the users in the exclusion of this data processing are not to be assumed.

HubSpot / HubSpot Analytics

We use Hubspot software for customer relationship management (CRM) and also use it to analyse our website activities.

Categories of personal data: First name, surname, e-mail address
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: Hubspot, Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141, USA
Website: https://www.hubspot.com/
Privacy policy: https://legal.hubspot.com/de/privacy-policy
Data protection addendum: https://legal.hubspot.com/dpa
Appropriate safeguards: EU-US Data Privacy Framework & standard contractual clauses

The processing of the data required to achieve the aforementioned purposes is to be classified as a legitimate interest within the meaning of this provision. A balancing of interests has shown that the overriding interests of the users in the exclusion of this data processing are not to be assumed.

Intercom

We use Intercom for our support chat. Intercom is a service for the management of knowledge base articles and for communication via chat and e-mail, which is offered by Intercom R&D Unlimited Company or by Intercom Software UK Limited.
Intercom Messenger can use trackers to recognise and track user behaviour.

Categories of personal data: Data transmitted when using the service, e-mail address, tracker, Universally Unique Identifier (UUID), usage data
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: Intercom R&D Unlimited Company, 124 St Stephen's Green, Dublin 2, Ireland
Server location: USA
Website: https://www.intercom.com/
Privacy policy: https://www.intercom.com/legal/privacy
Data protection addendum: https://www.intercom.com/legal/data-processing-agreement
Appropriate safeguards: EU-US Data Privacy Framework & standard contractual clauses

The processing of the data required to achieve the aforementioned purposes is to be classified as a legitimate interest within the meaning of this provision. A balancing of interests has shown that the overriding interests of the users in the exclusion of this data processing are not to be assumed.

Meta Events Manager (Meta Pixel)

We use the functionality of Facebook's Meta Events Manager to operate so-called conversion tracking, i.e. a mapping of user processes from interaction with the advert to the conclusion of a purchase (conversion).
The Meta Events Manager helps us to measure interactions on our website and derive actions for our company from this.

Categories of personal data: URL, referrer URL, shortened or hashed IP address, device and browser properties (user agent) and timestamp
Legal basis: Consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR
Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Website: https://www.meta.com/de/
Privacy policy: https://www.facebook.com/privacy/policy/?entry_point=about_fb
Data protection addendum: https://www.linkedin.com/legal/l/dpa
Appropriate safeguards: EU-US Data Privacy Framework,

Google OAuth

To use the Klar app, we offer the option of authentication via Google OAuth. By logging in via the Google OAuth 2.0 process and subsequently confirming access, personal data is sent to us by Google.

Categories of personal data: Name, e-mail address
Legal basis: Pre-contractual or contractual fulfilment pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR
Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Server location: EU
Website: https://www.google.com/intl/de_de/business/
Privacy policy: https://policies.google.com/privacy
Data protection addendum: https://cloud.google.com/terms/data-processing-addendum/

Microsoft OAuth

To use the Klar app, we offer the option of authentication via Microsoft OAuth. By logging in via the Microsoft OAuth procedure and subsequently confirming access, personal data is sent to us by Microsoft.

Categories of personal data: IP address
Legal basis: Pre-contractual or contractual fulfilment pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR
Service provider: Microsoft Corporation, One Microsoft Way, Redmond, USA
Server location: Germany
Website: https://www.microsoft.com/de-de/
Privacy policy: https://www.microsoft.com/de-DE/privacy/privacystatement
Data protection addendum: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=18

Shopify OAuth

To use the Klar app, we offer the option of authentication via Shopify OAuth. By logging in via the Shopify OAuth procedure and subsequently confirming access, personal data is sent to us by Shopify.

Categories of personal data: Name, e-mail address
Legal basis: Pre-contractual or contractual fulfilment pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR
Service provider: Shopify International Ltd. ,Intertrust Ireland, 2nd Floor 1-2, Victoria Buildings,
Haddington Road, Dublin 4, D04 XN32, Ireland
Server location: CAN, USA
Website: https://www.shopify.com/de
Privacy policy: https://www.shopify.com/de/legal/datenschutz
Data protection addendum:https://www.shopify.com/legal/dpa

OPENBRIDGE

We use the services of OPENBRIDGE, Inc. for data synchronisation between Amazon and Klar.

Categories of personal data: Name, e-mail address, IP address, device and browser properties
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: OPENBRIDGE Inc, 119 Braintree St Ste 413 Boston, MA, 02134-1697, USA
Server location: USA
Website: https://www.openbridge.com
Privacy policy: https://www.openbridge.com/privacy/
Data protection addendum: https://docs.openbridge.com/en/articles/5979774-gdpr?_gl=1*1hf9k3s*_ga*NzM3ODk4OTc5LjE3MzE0MTkwMTI.*_ga_2CV7WQN881*MTczMTQxOTAxMS4xLjEuMTczMTQxOTAyMi40OS4wLjA.*_ga_3VMKMZKY8Y*MTczMTQxOTAxMS4xLjEuMTczMTQxOTAyMi40OS4wLjA
Appropriate safeguards: standard contractual clauses

Data synchronisation by Amazon is of essential importance to us and therefore constitutes a legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.

Sentry

We use the services of Sentry to log any errors in the execution of the Java Script source code of our app.

Categories of personal data: IP address, device and browser properties
Legal basis: Legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR
Service provider: Sentry Inc, 45 Fremont St, 8th Floor, San Francisco, CA 94105, USA
Server location: USA
Website: https://sentry.io/welcome/
Privacy policy: https://sentry.io/privacy/
Data protection addendumhttps://sentry.io/legal/dpa/
Appropriate safeguards: EU-US Data Privacy Framework & standard contractual clauses

The processing of the data required to achieve the aforementioned purposes is to be classified as a legitimate interest within the meaning of this provision. A balancing of interests has shown that the overriding interests of the users in the exclusion of this data processing are not to be assumed.

Stripe

We use the services of Stripe Payments Europe to process payments for paid subscriptions.

Categories of personal data: Name, address (of the company), e-mail address, telephone number (if applicable) and IP address
Legal basis: Pre-contractual or contractual fulfilment pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR
Service provider: Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
Server location: Ireland
Website: https://stripe.com/de
Privacy policy: https://stripe.com/de/privacy
Data protection addendumhttps://stripe.com/de/legal/dpa
Appropriate safeguards: EU-US Data Privacy Framework & standard contractual clauses

Demodesk

We use the service Demodesk (Demodesk GmbH, Isartorplatz 8, 80331 Munich, Germany) for our virtual meetings. Demodesk is GDPR compliant and hosted in data centers within the EU.

Categories of personal data: Meeting data (audio and, if applicable, video recordings, transcribed texts, meeting summaries, and depending on the content, other personal data), Usage data (data on the use of the platform for functions such as scheduling, CRM integration, and analytics) Legal basis: Consent according to Art. 6 Para. 1 S. 1 lit. a) GDPR, particularly for meeting recordings (your explicit consent will be obtained before a recording) Service Provider: Demodesk GmbH, Isartorplatz 8, 80331 Munich, Germany Website: https://demodesk.com/de/ Privacy Policy: https://demodesk.com/de/privacy-policy Data Processing Agreement: A data processing agreement has been concluded with Demodesk. Appropriate Safeguards: The service provider's server location is within the EU.

Google Workspace

We use Google Workspace applications to store documents and information in tabular form.

Categories of personal data: Name, email address, possibly phone number Legal basis: The processing is based on our legitimate interest in accordance with Art. 6 (1) (1) (f) GDPR for the provision of our services or for the fulfillment of the contract in accordance with Art. 6 (1) (1) (b) GDPR. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Website: [https://workspace.google.com/] (https://workspace.google.com/) Privacy policy: [https://policies.google.com/privacy?hl=en] (https://policies.google.com/privacy?hl=en) Data processing agreement: A data processing agreement (DPA) has been concluded with Google in connection with the use of Google Workspace. Appropriate safeguards: Data is stored and processed within the EU/EEA, unless the requirements for a transfer to third countries are met. Such transfers are secured by standard contractual clauses and other measures.

Data Processing as a Data Processor (Klar Insights Tracking Pixel)

Klar Insights GmbH provides eCommerce companies with an analytics solution ("Klar Insights") for traffic measurement, statistical analysis, and marketing attribution. When you visit the website of an online shop that uses our services and have given your consent there, Klar processes your data solely as a data processor within the meaning of Art. 28 GDPR on behalf of and according to the documented instructions of the respective shop operator.

Scope of Data Processing and Data Categories

The tracking script integrated into the shop ("Klar Pixel") collects and transmits pseudonymized data regarding current web sessions. This includes:

Use of Cookies

To provide this analytics service, the following first-party cookies of the respective online shop are set on your end device:

Objection Mechanism (Opt-Out)

If you wish to object to the collection of your data by the Klar Insights Pixel entirely, you can do so via the opt-out link provided by the respective shop operator (/donottrack/me). This will place the september_do_not_track cookie on your end device. Please do not delete this cookie, as otherwise your objection cannot be recognized when you visit the shop again.

Since we do not control this data as a data controller and have no authority over the purposes of processing, please contact the operator of the respective online shop directly on whose site the data was collected to exercise your data subject rights (such as access, rectification, or erasure).

Duration of data storage

The storage period of personal data depends on the relevant statutory retention periods and the purpose of the processing. As soon as the statutory retention period ends or the purpose of processing no longer applies, the personal data will be deleted unless it is required for the fulfilment or initiation of a contract. Justified deviations may occur in the context of individual processing procedures, which we will inform you of separately.

Changes to the privacy policy

This Privacy Policy may be amended and replaced by us at our own discretion. The most recent version available on our website or app is valid.