Privacy Policy

On the one hand, your data is captured because you communicate it to us. This may, for example, be data that you enter in our contact form. Other data is collected automatically when visiting the website through our IT systems. These are above all technical data (e.g. Internet browser, operating system or time of the page request). The collection of this data is automatic as soon as you visit our platform.

Registration Information

When you register for kitUP (for our free offer, paid subscription, or use of a code), we collect the personal information that you voluntarily provide to us when registering through your access device.

Mobile Advertising ID

If not disabled by the user, we collect the Mobile Advertising ID provided by your mobile device. If you do not want us to collect this Mobile Advertising ID, you can always disable or change this on your device.

Cookies and Cookie Policy

For the provision of the kitUP service and to make our offer more user-friendly, effective and secure, we also use so-called cookies for data collection and storage. Cookies are small data packets that are stored on your device and do no harm. We collect Cookies in the following categories:

• Necessary technical or functional cookies: They help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.
• Preference cookies: They enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.
• Statistical cookies: They help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.
• Marketing cookies: They are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user.

Tracking Services

We use tracking services to collect information about the behavior of visitors to our pages. This way we can ensure an optimal user experience. These services use pseudonymised user profiles with the help of cookies, so that a direct inference to persons is not possible. Of course you can object to the creation of these profiles at any time.

Social Plugins

Our pages contain buttons from various social networks so that you can recommend our offers, services and/or products to other interested people. If you click on such a button, data such as your current IP address, browser and access device information (type and operating system), the resolution of the screen, installed plug-ins, the referrer (from where you came to the site) and the current URL will be sent to the site operator.

Newsletter

When you sign up for our newsletter, your email address will be used for information on advertising and advertising purposes. Of course, this is voluntary and you can unsubscribe at any time after consent.

Payment Information

If you use our free access, any of our trial phases or any of our subscriptions or you purchase anything through the Service, credit card information and other financial information we need to process the payment will be collected and stored with a payment service provider. We ourselves receive very little information from the payment providers about you.

Personal Data of Children

We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not register or send us personal data. If we learn we have collected such data, we will delete it promptly. Contact info@kitup.net.

We collect your data in three different ways:

• Automated when you visit our website
• Through cookies
• Through your voluntary input

In some cases, your data is also processed with the help of third-party providers of various online services. However, this is exclusively regulated by data processing agreements and the processing is instruction-bound, so that we always keep the responsibility for the processing.

Processors from a third country outside the European Economic Area only receive access to personal data if these third countries offer an appropriate level of data protection in connection with an adequacy decision by the EU Commission or if we have suitable guarantees with these service providers (so-called Standard Contractual Clauses in accordance with Art. 46 GDPR) or recognized Binding Corporate Rules in accordance with Art. 47 GDPR.

Revocation of Consent

Many data processing operations are only possible with your express consent. You can revoke an existing consent at any time. An informal message by email to info@kitup.net is sufficient. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Complain

In the event of data protection violations, you, the person concerned, have the right of appeal to the competent supervisory authority. The competent supervisory authority for data protection issues is the state data protection officer of the federal state in which our company is based or in which you have your residence.

Information, Correction, Deletion, Blocking, Data Transferability

You have the right at any time to request information about your personal data processed by us free of charge. In particular, you may request us to provide information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been disclosed, the planned retention period, the right of rectification, deletion, limitation of processing or opposition, passing a right of appeal, the origin of their data, if not collected by us, and the existence of automated decision-making including profiling.

You have the right to request the immediate correction of incorrect or incomplete personal data of you stored by us.

You have the right to request the deletion of your personal data stored by us, except in cases where the processing of the data is required for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims.

You have the right to demand the restriction of the processing of your personal data, as far as the accuracy of the data is disputed by you, the processing is unlawful, but you reject its deletion and we no longer need the data, or if you have objected to the processing in accordance with Art. 21 GDPR.

You have the right to receive your personal information that you have provided to us in a structured, common and machine-readable format or to request that it is sent to another person in charge.

Right to Object

If your personal data is processed based on legitimate interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to file an objection against the processing of your personal data in accordance with Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct mail. In the latter case, you have a general right to objection, which is implemented by us without specifying any particular situation.

We use SSL or TLS encryption for security reasons and to protect the transmission of sensitive content, such as orders or requests you send to us. An encrypted connection is indicated by the browser's address bar switching from "http://" to "https://" and the lock icon in your browser bar. If SSL or TLS encryption is enabled, the data you submit to us cannot be read by third parties.

Server Log Files

Our provider of the platform automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are browser type and browser version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address. The data is for data security and error analysis only. A merge of this data with other data sources will not be done. The basis for data processing is Art. 6 (1) lit. b GDPR. The server log files are automatically deleted after 2 weeks.

Cookies and Cookiebot

We use so-called cookies. Cookies do not harm your access device and do not contain viruses. Cookies serve to make our offer more user-friendly, effective and secure. Most of the cookies we use are so-called "session cookies". They will be deleted automatically at the end of your visit. Other cookies remain stored on your device until you delete them.

You can set your browser so that you are informed about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and enable the automatic deletion of cookies when closing the browser. Disabling cookies may limit the functionality of our website.

Contact Form and Zendesk

We use the Zendesk ticket system to handle customer inquiries, a customer service platform of Zendesk Inc., 989 Market Street #300, San Francisco, CA 94102 (USA). We have entered into a "Data Processing Agreement" with Zendesk, in which we commit Zendesk to protect the data of our customers, to not disclose them to third parties and to comply with the provisions of the standard contractual clauses according to Art. 46 GDPR in the case of a transfer of personal data to the USA.

Registration on this Website

You can register on our platform to use our services. We only use the data entered for the purpose of using the respective offer for which you have registered. The mandatory information requested during registration, such as name and email address, must be provided, otherwise the registration cannot be completed.

Registration and Login with Facebook Connect

Instead of registering directly on our website, you can sign up with Facebook Connect. Provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. If you decide to register with Facebook Connect and click on the "Sign Up with Facebook" button, you will automatically be redirected to the Facebook platform. This links your Facebook profile to our website or services, giving us access to your data stored on Facebook (inventory data, contact details, event data). This information is used to set up, provision and personalize your account.

For more information, see the Facebook Terms of Use and the Facebook Privacy Policy.

Registration and Login with Google Connect

Instead of a direct registration on our website, you can also register via Google. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you decide to register with Google and click the "Sign in with Google" button, you will be redirected to the Google platform. This will link your Google profile to our website or services, giving us access to your first name, surname, email address, username, Google profile URL, and featured image. This information is used to set up, provision and personalize your accounts.

For more information, see the Google Terms of Service and the Google Privacy Policy.

Facebook Plugins

On our pages, plugins of the social network Facebook (Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) are integrated. When you visit our platform, a direct connection between your browser and the Facebook server is established via the plugin. Facebook receives the information that you have visited our site with your IP address. If you click on the Facebook "Like-Button" while logged in to your Facebook account, you can link our page contents to your Facebook profile. If you do not want Facebook to associate visiting our pages with your Facebook user account, please log out of your Facebook user account.

LinkedIn Plugin

Our site uses functions from the LinkedIn network (LinkedIn Corporation, 1000 West Maude Ave, Sunnyvale, CA 94085, USA). Each time one of our pages containing LinkedIn features is accessed, your browser establishes a direct connection to the LinkedIn servers. We have entered into a "Data Processing Agreement" with LinkedIn in compliance with Art. 46 GDPR.

Twitter Plugin

On our pages, functions of the service Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) are included. By using Twitter and the "Re-Tweet" function, the websites you visit are linked to your Twitter account and shared with other users. We have entered into a "Data Processing Agreement" with Twitter in compliance with Art. 46 GDPR.

Adjust

We use the analysis technology of adjust GmbH, Saarbrücker Str. 36, 10405 Berlin ("Adjust"). The data processing takes place on the basis of our legitimate interests (Art. 6 (1) lit. f GDPR) of analyzing user behavior and optimization of our website and our advertising. Adjust collects and uses on our behalf the parameters specified in the section "Social Plugins" (such as IP address, browser and access device information), the hashed email address given during registration and, if not disabled by the user, temporary device identification numbers.

Google Services

For marketing optimization purposes, we send, if not disabled by the user in the system settings of their device, the Mobile Advertising ID, the hashed email address given during registration and the parameters specified in the section "Social Plugins" to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We have entered into a "Data Processing Agreement" with Google in compliance with Art. 46 GDPR.

We use the following Google services:

• Google AdSense: Uses cookies and web beacons to analyze website use and deliver relevant advertisements.
• Google AdWords & Conversion Tracking: Uses conversion tracking cookies to generate statistics for advertisers. Cookies lose their validity after 30 days.
• Google Analytics: Uses cookies for website usage analysis. We have activated IP anonymization. You can prevent data collection by installing the browser plug-in for disabling Google Analytics JavaScript.
• Google Analytics Remarketing: Links advertising audiences with cross-device capabilities. You can opt out by disabling personalized ads in your Google account.

Facebook

For marketing optimization purposes, we send the Mobile Advertising ID, hashed email address, and social plugin parameters to Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"). We have concluded a special agreement with Facebook ("Controller Addendum") regulating security measures and data subject rights.

Facebook Pixel

Our site uses the visitor action pixel from Facebook for conversion measurement. The behavior of site visitors can be tracked after clicking on a Facebook ad. The collected data is anonymous to us as the operator of this website. You can disable the remarketing "Custom Audiences" feature in the Ads Settings section.

Snapchat Ads

We use services of Snapchat (Snap Inc., 63 Market Street, Venice, CA 90291). The Snapchat pixel generates a hash from your usage data that is sent to Snapchat. We have entered into a "Data Processing Agreement" with Snapchat in compliance with Art. 46 GDPR.

Twitter Ads

We use services of Twitter Ads (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA). Twitter allows us to use target group-based advertising, re-targeting and conversion measurements. Twitter adheres to the do-not-track setting of your browser. We have entered into a "Data Processing Agreement" with Twitter in compliance with Art. 46 GDPR.

MailChimp / Mandrill

This website uses the services of MailChimp for sending newsletters (Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA). If you have entered data for newsletter subscription, these will be stored on MailChimp servers in the USA. With the help of MailChimp we can analyze our newsletter campaigns. If you do not want to be analyzed, you have to unsubscribe from the newsletter. We have entered into a "Data Processing Agreement" with MailChimp in compliance with Art. 46 GDPR.

AWS Data Center

This AWS service helps us to host our backend applications. The AWS Data Center stores user data such as email, address, first name, last name, interaction data. The data processing takes place on the basis of our legitimate interests (Art. 6 (1) lit. f GDPR) for the technically error-free and optimized provision of our services.

AWS Pinpoint

This AWS service is used to evaluate mobile interaction data. AWS stores user data such as a pseudonymized kitUP ID, device identification number and interaction data. We have entered into a "Data Processing Agreement" with AWS in compliance with Art. 46 GDPR.

Cloudflare

We use the service Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) to increase the performance and security of our websites and services. Here interaction data (especially IP addresses) are transferred via interfaces. We have entered into a "Data Processing Agreement" with Cloudflare in compliance with Art. 46 GDPR.

Google Cloud Platform

We use services of the Google Cloud Platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to find bugs in the kitUP app by using the service Firebase Crashlytics. Google Cloud Platform / Firebase Crashlytics receives user data for error analysis such as Mobile ad IDs, installation UUID, Android IDs and IP addresses. We have entered into a "Data Processing Agreement" with Google in compliance with Art. 46 GDPR.

YouTube

On our website, based on our legitimate interests under Art. 6 para. 1 sentence 1 lit. f GDPR, we use components (videos) of YouTube (YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA). We use the "extended privacy mode" provided by YouTube. According to YouTube, in this mode your data is only transmitted to YouTube servers when you watch the video. If you are logged in to YouTube, this information will be associated with your account.

When you make payments for our services, no credit or debit card information is stored on our servers. This information is stored by our third-party PCI-compliant payment processing companies. We work with the following providers:

• Recurly Inc., 400 Alabama Street Suite 202, San Francisco, CA 94110 (USA)
• Stripe Inc., 185 Berry Street, Suite 550, San Francisco, CA 94107 (USA)

All credit and debit card transactions occur between the computer from which the transaction originates and our payment processor. We also collect certain limited information, such as your zip code, mobile phone number and details of your transaction history. We have entered into separate "Data Processing Agreements" with both Recurly and Stripe in compliance with Art. 46 GDPR.

Request Refunds

If you purchased a subscription via iTunes and consider that a payment has been wrongly debited, you may, as an iOS user, request a refund directly through your user account within the iOS app, which will then be processed directly by Apple. In order to enable Apple to make a decision about the legitimacy of your refund request, we may transfer data about your usage history to Apple. You agree to this data transfer by requesting a refund. The legal basis is your consent (Art. 6 para. 1 p. 1 lit. a. GDPR) as well as our legitimate interest (Art. 6 para. 1 p. 1 lit. f. GDPR).

Some onboarding questions may touch on health, mental well-being, sexual orientation, or your sex life. Where you provide this, we use it only to personalize your recommendations and we never share it with advertising or analytics partners (such as the Meta Pixel). Depending on your region, we either ask for your explicit consent before collecting it (Türkiye/EEA) or let you limit its use (California).

The core of this policy applies to everyone. Depending on where you live, you have the additional rights below.

United States – California (CCPA/CPRA)

We do not sell your personal information for money. However, our use of advertising and analytics partners (such as the Meta Pixel and Google) may qualify as “selling” or “sharing” under California law. You can opt out via our Do Not Sell or Share page or by using a Global Privacy Control (GPC) signal, which we honor automatically.

California residents have the right to: know the personal information we collect, use, disclose and share; delete it; correct inaccurate information; opt out of the sale or sharing of personal information (including sharing for cross-context behavioral advertising); limit the use and disclosure of sensitive personal information; and non-discrimination for exercising these rights.

Categories we collect: identifiers (name, email), internet/device activity (usage data, Mobile Advertising ID), commercial information (subscription and transaction history), and sensitive personal information you voluntarily provide (e.g., health, sexual orientation, sex life). We may disclose/share these with advertising networks, analytics and hosting providers, payment processors, and social networks. We do not knowingly sell or share the information of consumers under 16.

To exercise your rights: email info@kitup.net, use our Do Not Sell or Share page, or enable a GPC signal (treated as a valid opt-out). We respond within 45 days (extendable by 45 days). You may use an authorized agent. We retain personal information only as long as needed for the purposes described here or as required by law.

Türkiye (KVKK)

See the Turkish version of this policy at kitup.net/tr/privacy.

EEA & UK (GDPR)

Your GDPR rights (access, rectification, erasure, restriction, portability, objection, and withdrawal of consent) apply as described elsewhere in this policy. To exercise them, contact info@kitup.net.