Privacy Policy XFAIR.lead App

General

We take the protection of your personal data very seriously and treat it confidentially and in accordance with the statutory data protection regulations and this privacy policy. This privacy policy applies to our XFAIR.lead app for iOS and Android (hereinafter referred to as "APP"). It explains the nature, purpose and scope of data collection in the context of using the APP.

Within the framework of the statutory requirements and taking into account the state of the art, we implement comprehensive technical and organizational measures to protect your data as best as possible. Nevertheless, absolutely complete protection against access by third parties cannot be fully guaranteed when data is transmitted over the Internet.

Responsible Party

The responsible party for data processing within the scope of this APP is:

XFAIR GmbH
Elisabeth-Schiemann-Bogen 1
85716 Unterschleißheim

Phone: +49 (0)89 3090968-0
Email: feedback@xfair.com
Website: www.xfair.com

Note on the Role of the Provider

XFAIR GmbH (hereinafter the "Provider") is the controller for the processing of personal data insofar as it takes place in connection with the use of the APP for demo and test purposes. If the APP is used within the scope of projects with business customers of the Provider, the respective customer is the controller within the meaning of Art. 4 No. 7 GDPR and the Provider is the processor within the meaning of Art. 4 No. 8 GDPR. In this context, the Provider processes the data exclusively as a processor pursuant to Art. 28 GDPR and on the instructions of the customer.

Data Protection Officer

You can reach our data protection officer at:

Markus Scheid
Elisabeth-Schiemann-Bogen 1
85716 Unterschleißheim

Email: markus.scheid@xfair.com

General Storage Period for Personal Data

Unless otherwise specified or further detailed within this privacy policy, the personal data collected by this APP will be stored until you request us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies. If there is a statutory obligation to retain the data or another legally recognized reason for storing the data (e.g. legitimate interest), the personal data concerned will not be deleted before the respective reason for retention ceases to apply.

Storage Period in the Context of Commissioned Processing

Insofar as personal data is processed within the scope of commissioned processing, the storage period is determined by the specifications of the respective customer as the controller. The Provider processes and stores the data exclusively within the scope of the customer's instructions and deletes it in accordance with the customer's specifications or upon termination of the engagement, unless statutory retention obligations prevent this.

Legal Bases for Storing Personal Data

The processing of personal data is only permitted if a valid legal basis for the processing of this data exists. Insofar as we process your data, this is done on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR, for the purpose of contract fulfillment pursuant to Art. 6 Para. 1 lit. b GDPR, or on the basis of legitimate interests pursuant to Art. 6 Para. 1 lit. f GDPR, which are always weighed against your interests. The legal bases applicable in each case are specified, where relevant, at a separate point within this privacy policy.

Insofar as personal data is processed within the scope of commissioned processing, this is done pursuant to Art. 28 GDPR on the instructions of the respective customer as the controller.

Encryption

For security reasons and to protect the transmission of confidential content, the APP uses state-of-the-art encryption. Recognized and established security procedures are used. This encryption prevents the data you transmit from being read by unauthorized third parties.

Purpose of Processing

The APP serves the digital capture and management of contact data as well as the qualification of potential business contacts (leads).

Main Functions of the APP

• Login via your EMS account
• Capture of contact data by scanning business cards, vCards or trade fair tickets
• Qualification of leads via a customizable data capture form
• Supplementing contacts with notes and additional images
• Access to and editing of all captured leads within the app history

The processing of personal data in the context of demo and test use takes place exclusively for the purpose of providing and using the demo version of the APP.

This includes in particular the demonstration of the APP's functionalities, the simulation of typical use cases, and the verification of technical functionality.

Registration of the APP is required to use the demo version. This is done by means of a PIN issued by the Provider. Subsequent test access takes place via a provided user account in the XFAIR Demo EMS (Event Management System).

Collection of Personal Data in the Context of APP Use

General

In the course of your use of the APP, certain data that is required for the use of the APP is processed automatically:

• Email and password: this information is required to authenticate the user as an EMS user and app user.
• App ID/UUID: the ID is automatically generated when the APP is installed and sent to our server and is required for unique identification of the mobile device.
• Event ID: this information is required for access to the corresponding event.
• Person ID: this information is required for user identification.
• PIN: this information is required for registration of the APP.
• First and last name: This information is required to display the logged-in user within the app menu.
• Information such as device type, operating system version, model number, extended unique app name, app version: Access to this information takes place on the basis of Section 25 (2) No. 2 TDDDG, as it is strictly necessary to provide the digital service expressly requested by the user, in particular for assistance in the area of end-user support and to ensure the security and functionality of the APP.

When using the APP for demo and test purposes, data can be entered into the input fields provided for this purpose and processed. This is usually contact data of the kind typically found on business cards (e.g. name, company, position, email address, telephone number, etc.) as well as other information entered in the course of use. However, the demo version is intended exclusively for use with test or fictitious data. The processing of real personal data is not permitted within the scope of demo use. The demo system is designed as a generally accessible test environment and may also be used by other interested parties for test purposes.

If personal data is to be processed, an appropriate legal basis under data protection law must be ensured for this. This may require the conclusion of a data processing agreement with the Provider pursuant to Art. 28 GDPR.

Legal Basis

The legal basis for the processing of personal data is Art. 6 Para. 1 lit. b GDPR for the fulfillment of contractual obligations and for the implementation of pre-contractual measures.

Storage Period

The data processed in the context of demo and test use is stored for a period of 28 days and then automatically deleted. This includes both the provided test access and all data captured in connection with this test access.

Management of Test Accesses

For the provision and management of demo accesses, it is documented internally which test accesses have been assigned to which persons. This assignment takes place exclusively for the purpose of managing the test accesses, ensuring traceability of use, and providing assistance with support requests.

Legal Basis

This data is processed on the basis of Art. 6 Para. 1 lit. b GDPR.

Storage Period

The personal data processed in the context of managing test accesses is stored only for as long as is necessary for the provision and use of the respective test access. The data will be deleted no later than 28 days after the test access has been issued, unless statutory retention obligations prevent this.

Business Card Scanning

For the automated capture of the contact data contained on business cards, we use the cloud service Google Cloud Document AI. For this purpose, the image of the business card is transmitted to the service, automatically analyzed, and the recognized contact data is returned to the app. The data is initially stored locally on the mobile device in encrypted form. Only after you expressly trigger the transmission is the contact data transferred to our server and stored in our database. Google Cloud is used here exclusively as a processor pursuant to Art. 28 GDPR. The processing takes place in the Google Cloud region EU (European Union).

Under the contractual terms applicable to Google Cloud, data is not used to train or fine-tune AI or machine learning models unless the customer expressly approves or instructs this. We do not grant any such approval or instruction.

Access Rights of the APP

To provide our services, the APP requires access to certain functions of your device.

Camera

Access to the camera is required to provide the business card scanning function.

Your Rights

Using the contact details provided, you can exercise the following rights at any time in accordance with the EU General Data Protection Regulation (GDPR):

• Access to your data stored by us and its processing (Art. 15 GDPR),
• Rectification of inaccurate personal data (Art. 16 GDPR),
• Erasure of your data stored by us (Art. 17 GDPR),
• Restriction of data processing, insofar as we are not yet permitted to delete your data due to statutory obligations (Art. 18 GDPR),
• Objection to the processing of your data by us (Art. 21 GDPR) and
• Data portability, provided you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR).

If you have given us your consent, you can withdraw it at any time with effect for the future.

You can contact a supervisory authority with a complaint at any time, e.g. the competent supervisory authority of the federal state of your place of residence or the authority responsible for us as the responsible party. A list of supervisory authorities (for the non-public sector) with addresses can be found at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Right to Object to Data Collection in Special Cases and to Direct Advertising (Art. 21 GDPR)

If the data processing is based on Art. 6 Para. 1 lit. e or f GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you; this also applies to profiling based on these provisions. The respective legal bases on which processing is based can be found in this privacy policy.

If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.

If your personal data is processed for the purpose of direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising. If you object, your personal data will subsequently no longer be used for the purpose of direct advertising.

Amendment of this Privacy Policy

We reserve the right to adapt these data protection provisions at any time in compliance with legal requirements.