Privacy Policy for PinPoint

This privacy policy applies to the PinPoint mobile application (the "App") as well as the PinPoint website accessible through the App (the "Website"). Both are collectively referred to as "Services".

1) General Information

Regarding the Services, Christoph Heldt is the controller within the meaning of the General Data Protection Regulation ("GDPR").

This privacy policy informs you about how we collect and process personal data in connection with our Services.

2) Access to and Storage of Information on End Devices

By using our App, access to information (e.g., IP address) or storage of information (e.g., cookies) on your end devices may occur. This access or storage may be associated with further processing of personal data under the GDPR.

In cases where such access to information or storage of information is strictly necessary for the technically error-free provision of our Services, this is done on the basis of § 25 para. 1 sentence 1, para. 2 no. 2 TTDSG.

In cases where such processing serves other purposes (e.g., the needs-based design of our App), it is carried out on the basis of § 25 para. 1 TTDSG only with your consent pursuant to Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time with effect for the future.

Further information about the processing of your personal data and the relevant legal bases in this context can be found in the following sections on the specific processing activities on our Website.

3) Data We Collect and Process

a. Registration

Registration with PinPoint is possible via email and password. We use the provided login credentials (email address, password) to create and allow you to manage a PinPoint account. We use the data to authenticate you during the login process. The data you provide during registration or login is used by us to (1) verify your authorization to use the PinPoint account, (2) implement the App's terms of use with all associated rights and obligations, and (3) be able to contact you to communicate technical or legal notices, updates, security messages, or other messages regarding the administration of your PinPoint account.

b. Login Data

Your login data is processed only on PinPoint servers. To identify you, PinPoint generates a random user number that allows us to associate PinPoint activities (posts, replies, etc.) triggered from this device with an account. The user number does not allow any conclusions to be drawn about your identity or other personal data. The processed data is used only in case of legal necessity (e.g., criminal prosecution).

c. Data Association

We associate the following data with your user number and store it:

Your interaction with the App, namely:

• your comments on other users' posts;
• your posts;
• your likes on posts;
• your reports;

Technical data transmitted by your mobile device, namely:

• your IP address;
• the date of your account registration;
• approximate location data, where the accuracy varies with the location services currently used by Apple and Google (Wi-Fi, cell tower query, GPS). Apple and Google each optimize which approach achieves the best result for the mobile user with the lowest possible battery consumption. PinPoint has no influence on this.
• Contact details (email address) when you contact us.

d. Use of User Number

We use your user number to connect activities in the App with your account and thus for identification purposes to implement your rights under the GDPR when you assert your data protection claims. We also use data you provide us when exercising your rights to document that we have implemented the GDPR requirements.

e. Further Use

We use your user number to connect activities in the App with your account and thus for identification purposes to implement your rights under the GDPR when you assert your data protection claims. We also use data you provide us when exercising your rights to document that we have implemented the GDPR requirements.

4) How and Why We Process Data and the Legal Basis for Processing

a. Disclosure of Data

We disclose personal data only when and to the extent required by law or based on a court or official order, except in the cases mentioned below. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR (legal obligation).

b. Registration and User Number

For registration with PinPoint and generation of your random user number, we use only the data provided to us through your registration (email address). We use your user number to connect activities in the App with your account and thus to enable the operation of the App. The legal basis for this is the contractual relationship between you and PinPoint under Art. 6 para. 1 sentence 1 lit. b GDPR.

c. Consent

If we specifically ask for your consent for individual data processing activities, we process the data on the basis of Art. 6 para. 1 sentence 1 lit. a GDPR. You can revoke consents at any time with effect for the future.

d. Identification

We use your user number to connect activities in the App with your account and thus for identification purposes to implement your rights under the GDPR when you assert your data protection claims. We also use data you provide us when exercising your rights to document that we have implemented the GDPR requirements. The legal basis for processing is Art. 6 para. 1 sentence 1 lit. f and lit. c GDPR. Our legitimate interest lies in being able to prove that we have implemented your rights.

e. Further Processing Purposes

The aforementioned data is processed by us for the following purposes and as follows:

• Messages, comments: for the operation of the App, in particular for displaying the content you generate in the App; the legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR (performance of a contract and pre-contractual measures);
• Technical data: to distinguish actual App users from bots, prevent abusive use, and block rule-violating content reported by other users; in anonymized form also for statistical evaluation purposes; the legal basis for processing is Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interests; the legitimate interest consists in distinguishing users from bots, preventing misuse, and blocking illegal content);
• Location data (here: actual location): to provide localized and location-based information in the App and thus ensure the full functionality of the App; the legal basis for processing is Art. 6 para. 1 sentence 1 lit. a GDPR (your consent or voluntary provision);
• Contact details: to respond to your inquiry and examine the situation taking into account the regulations and circumstances applicable in your country; the legal basis for processing is Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interests; the legitimate interest consists in our desire to respond to your inquiries)

5) Use of Analysis, Advertising and Other Third-Party Tools

a. Advertising Identifiers

We use the advertising identifiers IDFA (for iOS devices) and AAID (for Android devices) (together the "Advertising Identifiers"). These advertising identifiers are non-personal, non-permanent identifiers on the mobile device. The advertising identifiers capture the user number and allow us to track how users connect with PinPoint.

We may share corresponding data with so-called advertising networks to deliver advertising in the App that is more relevant/specific to you. You can disable access to the advertising identifier in your device settings by turning off ad tracking on iOS (under "Settings") or resetting the AAID on Android (under "Settings").

The legal basis for using the advertising identifiers is Art. 6 para. 1 sentence 1 lit. f GDPR (legitimate interests; the legitimate interest in using this data is that we can offer the App to users for free only if we are able to display relevant advertising in the App efficiently).

b. Analysis of Usage Data

We analyze usage data to better understand our users' preferences. For this purpose, we use the following tool:

aa. Google AdMob (with consent)

We use Google AdMob (an advertising service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) exclusively on the basis of your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. AdMob enables the display of personalized advertising in our App and the measurement of its performance.

Processed data (only with consent):

• Device identifiers (Android Advertising ID / IDFA)
• Interactions with advertisements
• Technical device data (operating system, device type)
• Approximate location (at country level, no precise location)

Purposes:

• Personalization of advertisements (targeting)
• Abuse detection (e.g., click fraud)
• Analysis of advertising effectiveness

Consent information:

• The use of AdMob is voluntary and occurs only after your active consent (opt-in) at first App start or in the settings.
• You can revoke consent at any time (e.g., via device settings):
  • Android: Google Settings > Ads > "Opt-out of Ads Personalization"
  • iOS: Settings > Privacy > Tracking > Disable "Allow Apps to Request to Track"
• Upon revocation, no new data will be transmitted to AdMob, existing data will be deleted after max. 14 months.

Data transfer to the USA:
Google also processes data in the USA. As the legal basis for this transfer, we use Art. 45 GDPR in conjunction with the EU-US Data Privacy Framework (DPF) (Google LLC is listed at https://www.dataprivacyframework.gov/). Additionally, we have agreed standard contractual clauses (SCCs).

Further information:

• AdMob Terms of Service
• Google Privacy Policy

6) Contact Form

If you contact us via contact form, the information you provide in the contact form or your email will be stored by us for the purpose of processing the request and in case of follow-up questions. Providing an email address is required for contact. We will not disclose this data to anyone without your consent. The legal basis for processing the data is our legitimate interest in responding to your inquiry. Your data will be deleted after your request has been processed, unless statutory retention obligations prevent this. In the case of Art. 6 para. 1 sentence 1 lit. f GDPR, you can object to the processing of your personal data at any time.

7) Technical Implementation of Third-Party Software

In part, we use service providers who process personal data on our behalf to provide the technical platform for the Services. These service providers process the corresponding data exclusively according to our instructions (order processing). The legal basis for data processing described in this section 4 is Art. 6 para. 1 sentence 1 lit. b GDPR (lawfulness of processing) and Art. 28 GDPR (processor).

8) Duration of Storage of Personal Data

Unless a shorter storage period is specified in this privacy policy, we store personal data for as long as (i) this is necessary for the provision of the services to you and/or (ii) this is necessary with regard to the contractual relationship with you; thereafter, the data is stored only if and to the extent that we are obliged to do so by statutory retention obligations. If we no longer need the relevant personal data for the purposes described above, this personal data will be stored only for the duration of the respective statutory retention obligations and will not be processed for other purposes.

9) Your Rights

You have the following rights regarding your personal data against us:

Right of Access

You have the right to obtain information from us about which data we process concerning you in accordance with Art. 15 GDPR.

Right to Rectification

You have the right to rectification under Art. 16 GDPR of inaccurate or incomplete information, should the data concerning you be incorrect or incomplete.

Right to Erasure ("Right to be Forgotten")

You have the right to erasure of your personal data under the conditions of Art. 17 GDPR. Your claim to erasure may be excluded under this provision due to a conflicting interest.

Right to Restriction of Processing

You have the right to restriction of processing of your personal data under the conditions of Art. 18 GDPR.

Right to Withdraw Consent

You have the right to withdraw any consent given for the processing of your personal data at any time in accordance with Art. 7 para. 3 GDPR.

Right to Data Portability

You have the right, under the conditions of Art. 20 GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us.

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Right to Object

If your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data, insofar as this is done for reasons arising from your particular situation. If the objection is directed against the processing of personal data for direct marketing purposes, you have a general right of objection without the requirement to specify a particular situation.

10) Contact; Data Protection Officer

Controller within the meaning of the GDPR:

How to reach us:

• Contact form in the App or on our Website
• Direct contact via email to the above address

Note on the Data Protection Officer:
Since we do not carry out any special type or scope of data processing that makes the appointment of a data protection officer mandatory under Art. 37 GDPR, the controller (Christoph Heldt) is your direct contact for all data protection inquiries.

11) Security of Personal Data

We place great importance on the security of all personal data associated with the App or its use. We have security measures in place to prevent loss, misuse and alteration of the data we store. Our security measures and privacy policy are reviewed regularly and updated and improved as appropriate. Only authorized employees have access to personal data. We have taken additional extensive precautions regarding the App and its use. Nevertheless, users should be aware that, despite all security measures, the exchange of information over the Internet can never be completely secure. We cannot guarantee the security of data transmitted via the App while it is being transmitted over the Internet.

Last Updated: March 28, 2025