Data protection declaration for the “Kärcher Programme” App
Karcher Cleaning System Sdn. Bhd. (443599-P)
1. Controller
This service (subsequently referred to as “app”) is made available by Alfred Kärcher SE & Co. KG, Alfred-Kärcher-Str. 28–40, 71364 Winnenden, Germany (subsequently referred to as “we” or “us”) as the controller under the data protection legislation in force. You can reach the responsible data protection officer at: Datenschutzbeauftragter@de.kaercher.com
Within the scope of the app we allow you to call up and present the following information: Kärcher product range. When you use the app, we process personal data related to you. Personal data encompasses all information related to an identified or identifiable natural person. Because protecting your privacy when using the app is important to us, we are supplying you with the following information about which personal data we process when you use the app and how we handle this data. In addition, we will inform you of the legal basis for processing your data and of our legitimate interests insofar as this processing is required in order to preserve our legitimate interests.
You can call up this data protection declaration at any time under the menu item “Settings” within the app.
2. Downloading the app
When downloading the app, specific required information is transmitted to the app store of your choice (e.g. Google Play or Apple App Store); in particular, this may involve processing the user name, the e-mail address, the customer number of your account, the time of the download, payment information and the individual device identification number. This data is exclusively processed by the respective app store and is beyond our control.
3. Use of the app
To enable your use of the app from a technical perspective, the following data is provided to us by your mobile end device:
- Your device identification (model name, device category, brand)
- Type and version of the operating system of your end device
- User behaviour (e.g. searching for or calling up content)
This data processing is legitimate according to Art. 6 (1) lit. b) GDPR as it is required for provision of the app and thus performance of the contract.
In addition, this data is also used to optimise the app, e.g. as part of product improvement. This data processing is justified by our legitimate interest in a functioning app, which overrides your rights and interest in protecting your personal data acc. to Art. 6 (1) lit. f) GDPR.
4. Dissemination and transfer of data
Apart from the cases explicitly mentioned in this data protection declaration, dissemination of your personal data without your explicit prior agreement only takes place when it is legally permissible or legally required. This may be the case if the processing is required in order to protect vital interests of the user or another natural person.
If required for the investigation of illegal or improper use of the app or for law enforcement, personal data will be disseminated to the law enforcement authorities or other authorities, or to aggrieved third parties or legal advisors, if required. However, this only takes place if there is evidence of illegal or improper behaviour. Dissemination can also take place if it serves the enforcement of conditions of use or other legal claims. In addition, we are legally obliged to provide information to specific public authorities on request. These include law enforcement authorities, public authorities that prosecute misdemeanours punishable by monetary fines, as well as fiscal authorities.
Potential dissemination of personal data is justified by the fact that (1) the processing is required for the fulfilment of a legal obligation to which we are subject according to Art. 6 (1) lit. c) GDPR in combination with national legal requirements regarding providing data to law enforcement authorities, or (2) we have a legitimate interest in providing data to the stated third parties in case of evidence of improper behaviour or for the enforcement of our conditions of use, other conditions or legal claims, to the extent that your rights and interests in protecting your personal data acc. to Art. 6 (1) lit. f) GDPR are not overriding.
With regard to providing our service, we are reliant on contractually affiliated companies of the Kärcher group of companies, as well as the following third-party companies and external service providers:
1. Firebase Analytics
2. AWS services: S3, Elasticsearch Service, Elasticache, Lambda, API Gateway, Cloudfront
Potential dissemination of the personal data is justified by the fact that (1) we have a legitimate interest to disseminate the data for administrative purposes within our group of companies to the extent that your rights and interests in protecting your personal data according to Art. 6 (1) lit. f) GDPR are not overriding and (2) third-party companies and external service providers are carefully selected, regularly checked and contractually obliged to exclusively process all personal data according to our instructions in accordance with Art. 28 (1) GDPR.
The further development of our company may lead to a change in the structure of our company by means of a change of the legal form, or the establishment, acquisition or sale of subsidiaries, parts or components of the company. During such transactions, customer information is potentially passed on together with the transferred part of the company. For any dissemination of personal data to third parties in the previously described scope we ensure that this takes place in line with this data protection declaration and the applicable data protection legislation.
Potential dissemination of the personal data is justified by the fact that we have a legitimate interest in adjusting our company form to the economic and legal circumstances where required, to the extent that your rights and interests in protecting your personal data are not overriding according to Art. 6 (1) lit. f) GDPR.
5. Cookies
When the app is used as a web app (e.g. if you use this app on a desktop or laptop computer), cookies are saved on your end device. These are small text fragments that can be read by your end device, which provides us with specific information. This information is required for the technical operation of the app.
This data processing is legitimate according to Art. 6 (1) lit. b) GDPR as it is required for provision of the app and thus performance of the contract.
6. Google Firebase
If you use this app on your tablet, we also use the technology of Google Firebase (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, “Google”) in the app. Firebase Analytics allows us to analyse the use of the app. Anonymous usage information is collected by the app and forwarded to Google. For this purpose, Google uses the advertising ID of your end device. Google uses this information to analyse the use of our app and to provide us with additional services associated with the use of apps. You can limit the use of the advertising ID in the settings of your end device. This data processing only takes place with your explicit approval, therefore the data processing is legitimate according to Art. 6 (1) lit. a) GDPR. You can cancel the analysis function at any time through the menu item “Settings” in the operating system of your end device and thus withdraw your consent. Google Inc. is certified under the Privacy Shield agreement. This guarantees that a standard in line with the European data protection legislation is complied with. For more information visit: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
Processors that can be used by Google are available at the following address: https://firebase.google.com/terms/subprocessors.
7. Storage time
We delete or make your personal data anonymous as soon as it is no longer required for the above-stated purposes for which it was collected or used by us. In general, we store your personal data for the duration of the use or contractual relationship for the app plus a period of 2 months, during which we maintain backup copies after deletion, insofar as this data is not needed for a longer period for criminal proceedings or for ensuring, asserting or enforcing legal claims.
Legal requirements regarding the storage and deletion of personal data, especially the data that we have to store for tax legislation reasons, remain unaffected.
8. Your rights as a data subject
You have the right to request disclosure of personal data concerning you that is processed by us at any time according to Art. 15 GDPR. For this purpose, you can send a request either by post or by e-mail to the address stated below.
You have the right to request the immediate rectification of personal data concerning you, if it is inaccurate. Please contact the addresses stated below for this purpose.
You have the right to request erasure of your personal data under the conditions stated in Art. 17 GDPR. These conditions specifically provide a right to erasure of personal data if it is no longer needed for the purposes for which it was collected or otherwise processed, as well as in cases of improper processing, the existence of an objection or the existence of an erasure obligation according to EU law or the member state legislation that we are subject to. For the period of data storage see also Clause 7 of this data protection declaration. To enforce your right to erasure, please contact the addresses below.
You have the right to ask us to restrict processing according to Art. 18 GDPR. This right applies in particular if the accurateness of the personal data is contested between us and the user, in which case it applies for the duration required to determine the accurateness, and it applies if the user has a right to erasure and requests restricted processing instead; in addition, it applies if the data is no longer required for the purposes pursued by us but is required by the user for the assertion, enforcement, practice or defence of legal claims, and if the successful implementation of an objection is still disputed between us and the user. To enforce your right to restricted processing, please contact the addresses below.
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format in accordance with the specifications of Art. 20 GDPR. To enforce your right to data portability, please contact the addresses below.
In accordance with Art. 21 GDPR, you have the right to object at any time to the processing of your personal data that is taking place – for example – on the basis of Art. 6 (1) lit. f) GDPR, for reasons based on your specific situation. We shall cease processing of your personal data unless we can provide compelling and legitimate reasons for the processing that outweigh your interests, rights and freedoms, or if processing serves the enforcement, practice or defence of legal claims.
Furthermore, you have the right to address complaints to the responsible supervisory authority. The responsible supervisory authority is the Federal State Authority for Data Protection Baden-Württemberg.
If you have further questions regarding the processing of your data or if you want to enforce the rights presented above, you can reach the data protection officer of Alfred Kärcher SE &Co. KG at the above address and at the following e-mail address: Datenschutzbeauftragter@de.kaercher.com.
