The company emerging collaborations gmbh, 1220 Vienna, Austria (hereinafter referred to as „operator“) operates under the name „KayX“ mobile apps (KayX app for Android, KayX app for iOS) and a website (www.kayx.vision), hereinafter collectively „KayX“ or „KayX-Services“. The operator is the controller of personal data within the meaning of the General Data Protection Regulation (GDPR). The operator decides on the purposes and means of processing personal data and is ultimately responsible for ensuring that the processing takes place in accordance with governing personal data legislation.
The operator takes data privacy very seriously and wants to reveal openly and transparently how this topic is dealt with.
When KayX is used, the operator is provided with a set of personal data. Personal data means information which can directly or indirectly be linked to a living natural person. Examples of personal data include name, address, telephone number and email address. However, information about IP addresses and user behaviour when using the services may also constitute personal data. Below, the operator explains to the users of KayX (hereinafter referred to as “user” or “users”) how data, what kind of data and for what purpose data is collected and to whom this data may be shared with. Finally, the operator informs users about their rights as well as internal rules for data storage.
II Data collection and processing
The operator collects data in connection with the registration of an account and in connection with subsequent use of the KayX-Services. In order to give a good overview of how the processing of personal data is carried out, the personal data has been divided into three categories based on how it is collected:
1. Data that is provided by the user
When an account is created or activities are carried out through the framework of the account, personal information about the individual user is needed. Personal data in this category is characterised by the fact that the user actively provides the data to the operator by, e.g. completing a web form, reporting incidents to support, or providing feedback through functions created for such purposes.
During the free registration process the user is asked for a minimum set of mandatory data, otherwise the registration cannot be completed. This mandatory data is: Name, phone number and profile photo. The profile data provided by the user must be correct, complete and must continuously be kept up-to-date.
In order to preserve a certain amount of anonymity towards other users, only the profile picture of the user, the first name and the last name abbreviated to the first letter (“John D.”) instead of the full name (“John Doe”) is shown to other users, as long as there exists no individually accepted connection with the other user.
The registration process is validated by SMS confirmation code to the phone number provided by the user. The user is also asked for the following optional data: Hometown, home country, languages and a free text short description. By completing the registration process the user confirms to be 16 years or older.
2. Data collected when using KayX-Services
By using the KayX-Services and carrying out activities, the user provides data which is stored by the operator in its database. This process takes place for user recognition and to ensure the delivery of the service that the user has requested. The operator will also store information when the user contacts the operator, for example when the user emails the operators customer support, so that the operator can assist the user and answer open questions. The operator may use anonymous and aggregated data about such inquiries to improve its services.
By using the KayX-Services, the operator gathers information about individual users activity, e.g. which services and screens are visited within KayX and how they are used. The collected data can be divided into the following types:
a. Technical information about the user’s device and internet connection
Through server logs and other tools the operator records information about the users device and internet connection, including operating system, browser version, IP addresses, cookies and other unique identifiers. The technical information is usually processed as aggregated data in order to analyze how the operators services are used. The operator may, however, link such data to the users account, for instance so that the operator can customize the KayX-Services to the users device.
b. Information about the use of KayX-Services
The operator registers the users account activities such as logging in or out of the user account, and any purchase of products or services through the KayX-Services. The operator also stores information about a user’s visit on KayX. The operator uses this information, amongst other things, to prevent abuse and fraudulent activities, to improve the KayX services and to provide users with personalized services, recommendations and information.
c. Information about user location
When KayX is used, the individual user location may be estimated through the IP address or geo-location detected on the user’s device. This information is, for instance, used to show content or other users that are in the same area, and to improve the KayX-Services. In order to avoid the identification of a user’s actual exact location, other users see only a rough distance, but no exact location of the user.
d. Cookies and locally stored content
3. Information from other sources
The operator may from time to time receive information from other sources such as partners or other third parties that help the operator understand user activity and preferences. This is collected to improve the KayX-Services.
III Processing purpose
The operator uses data of the user for the following purposes:
a. delivering the KayX-Services;
b. improving and developing the KayX-Services;
c. delivering personalized offerings and recommendations to the users;
d. preventing, limiting and investigating abuse of the KayX-Services.
More detailed information about purposes is available here below.
1. Delivery of the KayX-Services
For the usage of KayX-Services it is necessary, that the operator identifies the user’s current location. This allows KayX to show other users that are in the same area. In order to avoid the identification of a user’s actual exact location, other users see only a rough distance, but no exact location of the user.
In addition, the operator uses other personal information to personalize a user’s account and offer a good user experience. This relates primarily to user experience in connection with registration, login, interaction with other users and the overall user experience.
2. Improvement and further development of the KayX-Services
The operator uses information to improve its services and make them as user-friendly as possible. The analysis is usually carried out at an aggregated and anonymized level, but the operator may also use identifiable data to provide technical support and to understand how each user uses the KayX-Services.
To improve the KayX-Services and to detect and analyze errors, the operator uses certain tracking-tools. Therefore, the operator traces user behavior independently as well as via third-party suppliers (e.g. Google Analytics, Firebase, Crashlytics).
The operator may inform the user about changes to or improvements of the KayX-Services by using his email address or through push notifications on mobile devices. In addition, the user will recurrently receive the KayX newsletter. The newsletter can be unsubscribed by directly clicking on the unsubscribe link within the newsletter. Push notifications can be easily turned off directly in the settings of the used mobile device.
3. Personalized content and recommendations
The operator uses information to personalize and tailor services, and to also provide the users with a content that may be relevant to them. Sometimes the operator serves content based on the user’s explicit wishes, such as if the user opts in or confirms certain topics of interest. The operator may also serve content and recommendations based on user activities.
4. Preventing, limiting and investigating abuse of the KayX-Services
The operator uses information to restrict various forms of abuse of the KayX-Services, such as fraudulent activities, denial of service attacks, spamming, unauthorized logins and other actions that are prohibited by law.
IV Legal basis for data processing
If the operator processes personal user data, such processing is necessary for the performance of the contractual services or for the purposes of the legitimate interests pursued by the operator.
Any further data processing not necessary for the aforementioned purposes will be only carried out if the user has given consent to the processing or if required for compliance with a legal obligation to which the operator is subject.
V Transfer of data
However, the operator may collaborate with service providers who process data based on corresponding data processing agreements. Service providers processing user data on behalf of the operator will only do so for the purposes as prescribed in the data processing agreement and as explicitly instructed by the operator.
Personal data may be transferred due to the following reasons:
1. Transfer of personal data within emerging collaborations gmbh
2. Disclosure of personal data to third parties
If there is suspicion of illegal activities in connection with the use of KayX-Services, information may be disclosed to the police and other public authorities subject to a court or administrative order. The operator may share information with other third parties if they can prove an overriding interest in the identity verification of a user as well as in the determination of certain unlawful facts. Further third parties have to substantiate that the knowledge of this information is essential evidence for a prosecution act.
3. Data processors
The operator collaborates with service providers (data processors within the meaning of the GDPR) especially for displaying adverts, to analyze user behavior and to integrate third party services. The operator enters into data processor agreements according to Article 28 GDPR with such service providers.
4. Transfer of personal data to a country outside the EU or the EEA
The operator transfers personal data only to a third country, i.e. a country outside the EU or the EEA where there is either a decision of the European Commission on sufficient data protection standards, or there is an agreement on the EU Standard Contractual Clauses (http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm; and https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en) or they are certified under the privacy shield (https://www.privacyshield.gov/welcome).
The KayX website uses “Cookies” in order to enable all functionalities of the KayX website and to facilitate the use of the page. Cookies are small text files that allow the operator to store specific information on the user’s PC while using the operator’s website.
The user may disable Cookies in general, restrict them from certain websites or adjust the browser to notify about Cookies. Cookies can be removed from a PCs hard disk at any time. Please note that in this case the display of the website might be restricted and that the user guidance might be limited.
VII User rights
1. Right of information
The user has the right to be informed on if and what personal data of the user the operator processes and to request a copy of such data.
To exercise this right the user can send an e-mail to email@example.com with the request. The data takeout may take up to a few days. As soon as the data takeout is ready there will be an information via e-mail.
2. Right of rectification, restriction and deletion
The user has the right to rectification, restriction, addition or deletion of personal data.
To exercise the right of deletion the user has to open the „Menu“ in the KayX app, then click on „Account“ and „Delete account“. The deletion request will be processed within 30 days at the latest. As soon as the deletion is completed the user will be informed accordingly.
3. Right to object
The user is in certain cases entitled to object against processing personal data concerning him and to withdraw consent where consent has been given.
The right to object can be exercised by account deletion. The user has to open the „Menu“ in the KayX app, then click on „Account“ and „Delete account“. The deletion request will be processed within 30 days at the latest. As soon as the deletion is completed the user will be informed accordingly.
4. Right to data portability
The user has the right to demand data portability of registration data concerning him. In order to exercise the right to data portability the user has to send an e-mail to firstname.lastname@example.org with the request. The processing of the request may take up to a few days. As soon as the result is ready there will be an information via e-mail.
5. Right for complaint
The user has the right to lodge a complaint with the competent supervisory authority (www.data-protection-authority.gv.at).
VIII Duration of storage
Personal data is kept no longer than necessary in order to be able to satisfy the purpose of the processing. Personal data is deleted or anonymized on a regular basis when it is no longer relevant for the purposes for which it has been collected. The operator will, for example, retain personal data as long as the account has not been deleted or the user has revoked his consent according to Clause VII or as long as necessary for the provision of the KayX-Services or as otherwise necessary to comply with applicable laws.