We appreciate your interest in being part of the yamuntu community. Data protection has a particularly high priority for us and we would like to make it possible for everyone to easily and comprehensibly understand what data we collect and what we need or use it for. The optimal use of the yamuntu platforms is only possible with the provision of personal data. The processing of such data, for example, the name, address, e-mail address, or mobile telephone number of a data subject shall always be in line with the country-specific data protection regulations applicable to the yamuntu GmbH. We have implemented numerous technical and organisational measures to ensure the most complete protection of personal data processed through these platforms. Nevertheless, internet-based data transmissions can always have security gaps, so that absolute protection cannot be guaranteed.
yamuntu's data protection declaration is based on the terms used by the European Directive and Regulation (EC) when adopting the General Data Protection Regulation (GDPR). Our data protection statement should be easy to read and understand for the public as well as for our customers and partners. To ensure this, we would like to explain the terms used in advance.
Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, economic or social identity of that natural person.
Non-personal data is any information that does not relate to an identified or identifiable natural person. This results either from the fact that this data is already originally unrelated to an individual or has subsequently been anonymised.Data Subject (also referred to as "you")
.You, as a user, are an identified or identifiable natural person whose personal and non-personal data is processed by us.
Processing means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.
The yamuntu platforms are composed of the mobile application, the web application and the website of yamuntu GmbH.
Profiling is any form of automated processing of personal data that consists of using that personal data to evaluate certain personal aspects relating to you, in particular to analyse or predict personal preferences, interests, behaviour, location or change of location.
Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be specifically attributed to you as an individual without the addition of further information, provided that this additional information is kept separate and is subject to technical and organisational measures to ensure that your personal data is not attributed.
Responsible party (hereinafter also "we" or "us")
.The controller is yamuntu GmbH, which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or controllers may be designated in accordance with certain criteria laid down in Union or Member State law. In the further course, this term is simplified as "we".
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
The recipient is a natural or legal person, authority, institution or other body to which personal data are disclosed, whether or not it is a third party.
Third parties are exclusively natural or legal persons, authorities, institutions or other bodies other than you, the controller, the processor and the persons who are authorised to process the personal data under the direct responsibility of yamuntu GmbH or the processor. This also includes the providers of tools used by yamuntu (e.g. Google, Facebook and Paypal) and business partners.
Consent is any expression of will in the form of a statement or other unambiguous affirmative action, given by you voluntarily for the specific case in an informed manner and in an unambiguous manner, by which you indicate that you consent to the processing of the personal data relating to you.
Name and address of the person responsible
The responsible party within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:
Recording, collection and use of non-personal data
The yamuntu platforms record a series of general data and information with every call by you or an automated system. This general data and information is stored in the server's log files. The following data may be collected:
(1) the browser types and versions used
(2) the operating system used by the accessing system
(3) your device type
(4) the sub-websites which are accessed via an accessing system on our platforms
(5) the date and time of access to the platforms
(6) the Internet service provider of the accessing system
(7) the application from which an accessing system accesses our application (so-called referrer)
(8) device ID number (e.g. UDID)
(9) device name (e.g. "IP address")
(10) the IP address of the accessing system
(11) mobile phone and Internet provider
(12) language and time zone and
(11) other similar data and information that serve to avert danger in the event of attacks on our information technology systems.
When using these general data and information, the yamuntu GmbH does not draw any conclusions about you as a person. This information is rather required in order to:
(1) correctly deliver the contents of our website
(2) optimise the advertising for this website and
(3) ensure the permanent functionality of our information technology systems and the technology of our website.
Therefore, the anonymously collected data and information is, on the one hand, statistically evaluated and, on the other hand, evaluated with the aim of increasing the data protection and data security of our enterprise so that ultimately an optimal level of protection is ensured for the personal data we process. The anonymous data of the server log files are stored separately from any personal data provided by you. In order to make the yamuntu platforms usable in certain locations, we also use location technologies, such as GPS and other geolocation or presence technologies. These technologies are located in various places and send signals that your device can receive, provided you have set your device to receive such signals, for example by enabling location services. When your device transmits location information, yamuntu platforms will notify you of available campaigns, rewards, an article you previously liked, or other information we think is useful. In addition, we provide advertisers with reports on the types of people who see their ads and the success of their ads, but we do not share personal data and information unless you allow us to do so. For example, we provide advertisers with general demographic and interest information (e.g., that an ad was viewed by a woman between the ages of 25 and 34 who lives in Madrid and is interested in software engineering) to help them better understand their audience. We also confirm to an advertiser which ads have caused you to make a purchase or take an action.
Recording, collection and use of personal data
The yamuntu platforms collect a series of personal data and information with each call by you or an automated system. This data and information is stored in the server's log files. This happens during the following steps:
(1) downloading the app
(2) creating a user profile
(3) contact invitations and requests
(4) linking your social media accounts
(5) buying an item in the partner shop
(6) creating a collaboration
(7) posting a story on Instagram/reel on TikTok and
(8) receiving your cashback.
On the yamuntu platforms, you can earn cashback by using the submission feature of the app and the camera of your phone or other device to submit receipts of purchases of selected products and selected merchants. For this purpose, data and information such as:
(1) surname and first name
(3) IP address
(4) date of birth
(6) contact details
(7) cookie identifiers
(8) external identifiers such as hair colour, shoe size and dress size
(9) Paypal data including email, address information, the transaction amount, date and time and merchant name and location
(10) networks and connections (such as user profiles, hashtags, etc.)
(11) user profiles, hashtags, etc.)
(12) user profiles, hashtags, etc. are collected
(13) campaigns you have seen and used and partner shops you have visited
(14) information you have entered such as search terms you have used or which referral/exit pages brought you to our site.
In addition, we may receive information about you from service providers, our partners, merchants or other third parties, such as your preferences and interests, device information when you download an app originating from the yamuntu platforms, make an online purchase originating from the yamuntu platforms when integrated with the yamuntu platforms (e.g. PayPal information, etc.), for example, when you redeem your cashback, or otherwise when these third parties do business with us. Information we receive from such third parties is subject to the restrictions of those third parties' privacy policies. We also receive information about you that is publicly available, for example, when you submit information to a blog, chat room or social networking site. We encourage you to read the privacy policies of these third parties (listed separately below). The collection and use of this information allows us to:
(1) make your interactions with the yamuntu Platforms easier and more personalised
(2) store information about your account and/or activities for future interactions with the yamuntu Platforms
(3) gain a better understanding of how you interact with the yamuntu Platforms
(4) enable certain features of the Services
(5) count users who have visited, used applications or features on certain websites and pages within websites
(6) analyse your behaviour on our website and applications
(7) determine the effectiveness of advertising or promotional campaigns
(8) constantly update the yamuntu Platforms and improve/optimise the content and user experience
(9) prepare and conduct demographic, benchmarking, advertising, marketing, performance and promotional studies
(10) manage your cashback payments
(11) determine your eligibility to participate in the cashback programme and campaigns
(12) analyse the use and effectiveness of the yamuntu Platforms.
This helps us to personalise your experience of the yamuntu platforms, provide you with software updates and product announcements, better understand your needs and interests, and provide you with other information and offers that we think may be of interest to you, such as targeted advertising and promotions.
General use and storage
The personal and non-personal data you enter will be collected and stored solely for our internal use and for our own purposes. We may arrange for it to be passed on to one or more processors, for example a partner, who will also use the data exclusively for an internal use attributable to us. When you register on one of our platforms, the IP address assigned to you by your Internet service provider (ISP), the date and the time of registration are also stored. This data is stored because it is the only way to prevent misuse of our services and, if necessary, to clarify criminal offences that have been committed. In this respect, the storage of this data is necessary for our own security. As a matter of principle, this data is not passed on to third parties unless there is a legal obligation to pass it on or the passing on serves the purpose of criminal prosecution. The criterion for the duration of the storage of personal data is the respective statutory retention period. After expiry of this period, the corresponding data is routinely deleted if it is no longer required for the fulfilment or initiation of the contract. The criterion for the duration of the storage of personal data is the respective statutory retention period. After expiry of this period, the corresponding data is routinely deleted if it is no longer required for the fulfilment of the contract or the initiation of the contract.
Communication between yamuntu and you
Based on statutory provisions, the platforms of yamuntu GmbH contain data that enable a quick electronic contact to our company as well as direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If you contact us by e-mail, Instagram, WhatsApp or via a contact form, the personal data you provide will be stored automatically. Such personal data transmitted by you on a voluntary basis will be stored for the purpose of processing or contacting you. This personal data will not be passed on to third parties. Occasionally, we may run sweepstakes, contests, surveys or other special promotions where we ask you for personal information and non-personally identifiable information (e.g., postcode or age) to administer contests and other promotions through the yamuntu platforms or a third party. We may also use available and/or provided information to contact participants of such contests and promotions. To contact you, we may from time to time send emails, push notifications and messages/Whatsapp messages to the email address/mobile device you provide to us. You may opt-out of receiving future communications of this nature at any time by following the unsubscribe instructions in any promotional communication or by simply opting out of participating in the yamuntu platforms.
Right to confirmation
You have the right granted by the European Directive and the Regulation to request confirmation as to whether your personal data is being processed. If you would like to make use of this right of confirmation, you can contact our Customer Support at any time.Right of access
You have the right, granted by the European Directive and Regulation, to receive free information from us at any time about the personal data stored about you and a copy of this information. Furthermore, the European Directive and Regulation-maker has granted you access to the following information: - the purposes of the processing- the categories of personal data processed- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations- if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration- the existence of a right to rectification or erasure of the personal data concerning you or to restriction of processing by us or a right to object to such processing- the existence of a right of appeal to a supervisory authority- if the personal data are not collected from you: All available information about the origin of the data- The existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) DS-GVO and - at least in these cases - meaningful information about the logic involved as well as the scope and the intended effects of such processing for you. Furthermore, you have the right to be informed whether personal data has been transferred to a third country or to an international organisation. If this is the case, you also have the right to obtain information about the appropriate safeguards in connection with the transfer. If you would like to make use of this right to information, you can contact one of our employees at any time.
Right of rectification
For any of your personal data, you have the right granted by the European Directive and Regulation to request the immediate rectification of any inaccurate personal data concerning you. You also have the right to request that incomplete personal data be completed, including by means of a supplementary declaration, taking into account the purposes of the processing. If you would like to make use of this right of correction, you can contact one of our employees at any time.
Right to erasure
You have the right granted by the European Directive and Regulation to request that we erase your personal data concerned without undue delay, provided that one of the following reasons applies and to the extent that the processing is not necessary:The personal data were collected for such purposes or otherwise processed for which they are no longer necessary.You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) DS-GVO or Art. 9(2)(a) DS-GVO and there is no other legal basis for the processing.You object to the processing pursuant to Art. 21(1) DS-GVO and there are no overriding legitimate grounds for the processing.The personal data was collected in relation to information society services offered in accordance with Art. 8 (1) DS-GVO.If one of the above reasons applies and you wish to arrange for the deletion of your personal data stored by us, you can contact our Customer Support at any time. They will ensure that the request for deletion is complied with immediately. If the personal data have been made public by us and our company as the controller is obliged to erase the personal data pursuant to Article 17 (1) of the Data Protection Regulation, we shall implement reasonable measures, including technical measures, taking into account the available technology and the cost of implementation, in order to inform other data controllers which process the published personal data that you have requested from them to erase all links to or copies or replications of such personal data, unless the processing is necessary. An employee of the yamuntu GmbH will arrange the necessary in individual cases.
Right to restriction of processing
You have the right, granted by the European Directive and Regulation Maker, to request us to restrict processing if one of the following conditions is met:You dispute the accuracy of the personal data for a period of time that enables us to verify the accuracy of the personal data.The processing is unlawful, you object to the erasure of the personal data and request instead the restriction of the use of the personal data.We no longer need the personal data for the purposes of processing, but you need it to assert, exercise or defend legal claims.You have objected to the processing pursuant to Article 21 (1) of the GDPR and it is not yet clear whether our legitimate reasons outweigh yours.If one of the above conditions is met and you would like to request the restriction of personal data stored by us, you can contact our Customer Support at any time. They will arrange for the restriction of the processing.
Right to data portability
You have the right granted by the European Directive and Regulation to receive the personal data concerning you that has been provided by us in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another controller without hindrance from us to whom the personal data has been provided, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. Furthermore, when exercising your rights to data portability pursuant to Article 20(1) of the GDPR, you have the right to have the personal data transferred directly from one controller to another controller, insofar as this is technically feasible and insofar as this does not adversely affect the rights and freedoms of other individuals. To assert the right to data portability, you can contact our Customer Support at any time.
Right of objection
You have the right granted by the European Directives and Regulations to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) DS-GVO. This also applies to profiling based on these provisions. We will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If we process personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling, insofar as it is connected with such direct advertising. If you object to us processing for the purposes of direct advertising, we will no longer process the personal data for these purposes. In addition, you have the right to object, on grounds relating to your particular situation, to the processing of personal data which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the Data Protection Regulation (DS-GVO), unless such processing is necessary for the performance of a task carried out in the public interest. To exercise your right to object, you can contact our Customer Support directly. You are also free to exercise your right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.
Automated case-by-case decisions including profiling
You have the right granted by the European Parliament and the Council not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision (1) is necessary for entering into, or the performance of, a contract between you and yamuntu, or (2) is authorised by Union or Member State law to which we are subject, and that law provides for adequate measures to safeguard your rights and freedoms and legitimate interests, or (3) is based on your explicit consent. If the decision (1) is necessary for the conclusion or performance of a contract between you and yamuntu, or (2) is made with your explicit consent, we will take reasonable steps to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person responsible, to express your point of view and to contest the decision. If you wish to exercise your rights in relation to automated decisions, you can contact our Customer Support at any time.
Right to withdraw consent under data protection law
You have the right granted by the European Parliament and the Council to withdraw your consent to the processing of personal data at any time. If you wish to exercise your right to withdraw consent, you can contact our Customer Support at any time.
Applications and application procedures
We collect and process the personal data of applicants for the purpose of processing the application procedure. The processing may also take place electronically. This is particularly the case if an applicant submits relevant application documents to us electronically, for example by e-mail or via JOIN. If we conclude an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with the statutory provisions. If no employment contract is concluded with the applicant, the application documents are automatically deleted two years after notification of the rejection decision, provided that no other legitimate interests of ours oppose deletion. Other legitimate interest in this sense is, for example, a duty to provide evidence in proceedings under the General Equal Treatment Act (AGG).Legal basis of processingArt. 6 I lit. a DS-GVO serves as the legal basis for our company for processing operations in which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which you are a party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Art. 6 I lit. b DS-GVO. The same applies to processing operations that are necessary for the implementation of pre-contractual measures, for example in the case of enquiries about our products or services. If our company is subject to a legal obligation by which the processing of personal data becomes necessary, such as for the fulfilment of tax obligations, the processing is based on Art. 6 I lit. c DS-GVO. In rare cases, the processing of personal data might become necessary in order to protect vital interests of you or another natural person. This would be the case, for example, if a visitor were to be injured on our premises and as a result his or her name, age, health insurance details or other vital information had to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6 I lit. d DS-GVO. Finally, processing operations could be based on Art. 6 I lit. f DS-GVO. Processing operations which are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject are not overridden. Such processing operations are permitted to us in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if you are a customer of the controller (recital 47, sentence 2 of the GDPR).
Legitimate interests in the processing pursued by the controller or a third party
Third Party Privacy Agreements
. In view of the discussion about the use of analytics tools with full IP addresses, yamuntu uses Google Analytics with the extension "_anonymizeIp()". Therefore, IP addresses are only processed in abbreviated form in order to exclude direct personal references. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.
Facebook Social Plugin
This website uses social plugins ("plugins") of the social network facebook.com
, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). We use these plugins to make it easier for you to share interesting content with your Facebook friends. The plugins are recognisable by one of the Facebook logos (white "f" on a blue tile or a "thumbs up" sign) or are marked with the addition "Facebook Social Plugin". You can see the list and the appearance of the Facebook social plugins here: http://developers.facebook.com/plugins
Facebook, Custom Audiences and Facebook marketing services
We have integrated components of the Instagram service on this website. Instagram is a service that qualifies as an audiovisual platform and allows you to share photos and videos and also to distribute such data in other social networks. The operating company of the Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA. Each time you call up one of the individual pages of this website operated by the controller and on which an Instagram component (Insta button) has been integrated, the internet browser on your information technology system is automatically prompted by the respective Instagram component to download a representation of the corresponding component from Instagram. As part of this technical process, Instagram receives information about which specific subpage of our website you are visiting. If you are logged in to Instagram at the same time, Instagram recognises which specific sub-page you are visiting with each of your calls to our website and for the entire duration of your respective stay on our website. This information is collected by the Instagram component and assigned to your Instagram account by Instagram. If you click on one of the Instagram buttons integrated on our website, the data and information thus transmitted will be assigned to the personal Instagram user account of the person concerned and stored and processed by Instagram. Instagram always receives information via the Instagram component that you have visited our website if you are logged into Instagram at the same time as calling up our website; this takes place regardless of whether you click on the Instagram component or not. If you do not want this information to be transmitted to Instagram, you can prevent the transmission by logging out of your Instagram account before accessing our website. Further information and the applicable data protection provisions of Instagram can be found at https://help.instagram.com/155833707900388
On the yamuntu platforms, we use technology from Google Firebase (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, "Google") with various functionalities. Firebase Analytics enables the analysis of the use of our offer. This means that completely anonymised information about the use of our app is collected and transmitted to Google and stored there. Google uses the advertising ID of the end device for this purpose. Google will use the aforementioned information to evaluate the use of our app and to provide us with further services related to the use of apps. You can restrict the use of the advertising ID in the device settings (iOS: Privacy/ Advertising/ No ad tracking; Android: Account/ Google/ Ads). Google Analytics for Firebase (Google Inc.). Furthermore, we use Firebase Remote Config, which allows us to run A/B tests and adjust the behaviour and appearance of the app without having to download a new version. Personal data is not stored. Google Inc. is certified under the Privacy Shield agreement, thereby providing a guarantee of compliance with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active
). Subcontractors that Google may use can be found at the following link: https://firebase.google.com/terms/subprocessors
. The legal basis for the use and evaluation of the data and use of Firebase is a legitimate interest (i.e. interest in the analysis, optimisation and economic operation of our apps) within the meaning of Art. 6 (1) (f) DSGVO).
Conditional right to change