This privacy policy explains the processing of personal data in connection with the Simple Bitcoin app and its associated online offering. The controller is App-Learning GmbH, Lehrer-Wittmann-Straße-2F, 85764 Oberschleißheim, Germany. For privacy enquiries, contact simplebitcoin@app-learning.com. Further provider details are available in our imprint. The terms “personal data” and “processing” have the meanings set out in Article 4 GDPR.
Types of data processed
Usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), processing of special categories of data (Art. 9 para. 1 DSGVO): No special categories of data are processed.
Purpose of the processing
Provision of the online offer, its contents and functions Provision of contractual services, service and customer care, marketing, advertising and market research and security measures.
Applicable legal basis
We process personal data only where an applicable legal basis permits it. Processing necessary to provide our contractual services, administer purchases, or answer pre-contractual enquiries is based on Article 6(1)(b) GDPR. Processing necessary to comply with legal obligations is based on Article 6(1)(c) GDPR. Where we obtain consent, including for analytics where required, processing is based on Article 6(1)(a) and Article 7 GDPR. Processing necessary for our legitimate interests, such as operating and securing the service or handling other enquiries, is based on Article 6(1)(f) GDPR, provided those interests are not overridden by your interests or fundamental rights and freedoms. The analytics section below describes the corresponding purpose in more detail.
We update these privacy notices when the processing described here changes. Where applicable law requires individual notification or renewed consent, we will provide that notification or request consent.
Security measures
In accordance with Art. 32 DSGVO and taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the varying probability of occurrence and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection commensurate with the risk; these measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling the physical access to the data as well as the access, input, transmission, safeguarding of availability and its separation. Furthermore, we have established procedures to ensure that data subjects' rights are exercised, data is deleted, and we respond to any threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by designing technology and by using data protection-friendly default settings (Art. 25 DSGVO). The security measures include in particular the encrypted transmission of data between your browser and our server. Cooperation with contract processors and third parties If, in the course of our processing, we disclose data to other persons and companies (contract processors or third parties), transmit it to them or otherwise grant them access to the data, this will only be done on the basis of a legal permit (e.g. to use your personal data for the purpose of processing your order). e.g. if a transfer of the data to third parties, such as to payment service providers, is necessary for the performance of the contract in accordance with Art. 6 Para. 1 letter b DSGVO), if you have consented, if a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.). If we commission third parties to process data on the basis of a so-called "contract processing agreement", this is done on the basis of Art. 28 DSGVO.
Transfers to third countries
Personal data may be processed outside the European Union or the European Economic Area when we use service providers such as Google. Transfers take place in accordance with Articles 44 et seq. GDPR, on the basis of an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses. For transfers to participating, certified US organisations covered by the EU-U.S. Data Privacy Framework, the applicable adequacy decision may provide the transfer basis. Google LLC states that it is certified under this framework. Where a transfer is not covered by an adequacy decision, Google describes its use of Standard Contractual Clauses where required. Further information is available in Google’s data transfer frameworks and its information on international transfers for analytics services.
Rights of data subjects
Subject to the conditions and limitations set out in the GDPR, you have the right to request access to your personal data (Article 15), rectification (Article 16), erasure without undue delay (Article 17), restriction of processing (Article 18), and data portability (Article 20). You may also lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR. To exercise your rights, contact simplebitcoin@app-learning.com.
Right of withdrawal
You have the right to revoke consents granted in accordance with Art. 7 para. 3 DSGVO with effect for the future.
Right of objection
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation, in accordance with Article 21 GDPR. Where personal data is processed for direct marketing, you may object to that processing at any time.
Retention and deletion
We retain personal data only for as long as necessary for the purpose for which it was collected, unless applicable law requires further retention. Relevant criteria include the duration of the account or contractual relationship, the time needed to handle enquiries or security incidents, and applicable statutory retention obligations. Data that must be retained for another lawful purpose is restricted to that purpose. Account data is handled in connection with account deletion, subject to any applicable retention obligations. The analytics section below explains the separate retention criteria for Google Analytics for Firebase.
Contractual services
We process usage data and content submitted through the service, such as contact enquiries or user-profile entries, to provide our contractual services and handle user enquiries.
Establishment of contact
When you contact us by email or through an available contact channel, we process your message and contact details to handle your enquiry. This is based on Article 6(1)(b) GDPR for contractual or pre-contractual enquiries, or Article 6(1)(f) GDPR for other enquiries. Enquiries may be organised in a CRM or comparable system.
Access data and server logs
Access to our online offering may generate server logs containing information such as the requested page or file, access time, response status, browser and operating-system information, referrer URL, IP address, and provider. We use these data where necessary to operate the service, maintain security, and investigate misuse, based on Article 6(1)(f) GDPR.
Contact through social media
If you contact us through a social media platform, we process your message to handle your enquiry. The platform operator’s own privacy information also applies when you use that platform. We do not track visitors across social media platforms.
Cookies & range measurement
Cookies and similar storage technologies may support necessary functions, such as saving privacy preferences or maintaining a login session. Depending on the purpose, processing is based on Article 6(1)(b), Article 6(1)(f), or, where consent is required, Article 6(1)(a) GDPR. You can manage browser cookies through your browser settings; blocking necessary storage may limit related functions. Analytics processing in the app is described separately in the Google Analytics for Firebase section below.
Google Analytics for Firebase
We use Google Analytics for Firebase to understand how the Simple Bitcoin app is used and to improve it. Analytics may process app interactions, device and app information, and pseudonymous app-instance identifiers. Where consent is required, analytics processing is based on that consent under Article 6(1)(a) GDPR.
Analytics data retention depends on the retention settings applicable to our Google Analytics for Firebase project and Google’s retention and deletion processes. Details about the available controls and the treatment of aggregated reports are provided in Google’s analytics data retention documentation.
Further information about data processing is available in Firebase’s privacy and security information and Google’s privacy policy. Information about international transfers is provided in the “Transfers to third countries” section above.