Privacy Policy

Controller

Controller within the meaning of the GDPR: Printproof UG (haftungsbeschränkt) Beim Schlump 15 20144 Hamburg Germany

Data protection contact: support@treubar.de

This privacy policy covers the data we process as controller: website visits including the audience measurement you can consent to (§ 6c), the sample cards to try (§ 6d), contact inquiries, notices of illegal content (§ 2) and job applications (§ 6b), the account, contract and billing data of business owners, the personal Treubar logins of a business’s staff (§ 1a) and usage data from our own applications (§ 6). The data of our customers’ end customers — in particular the details from the stamp card’s enrolment form (first and last name, date of birth), pass identifiers, stamping and redemption timestamps and push recipient data — we process, apart from technical connection data and server logs (§ 2), exclusively on documented instructions as a processor within the meaning of Art. 28 GDPR; the business issuing the stamp card is the controller in that respect. The basis is the data processing agreement at https://www.treubar.de/en/dpa; on request to support@treubar.de we also provide it in text form.

If you are a guest of a business and received a stamp card through Treubar, the business issuing the card is the controller of your data; we run the technology on its behalf. Please therefore address questions about your card and requests for access, rectification or erasure to that business. If you write to us at support@treubar.de, we refer you to the business and inform it. We are controller ourselves for the technical connection data when the guest pages are opened or your wallet pass is fetched, including the entries in our server logs (§ 2); you can exercise your rights regarding that data directly with us. You can lodge a complaint with a data protection supervisory authority at any time (§ 8).

Our services are reachable at the following addresses, all of which we operate: the website at www.treubar.de; sign-in, checkout and subscription management at www.treuly.de; the web application for businesses at app.treuly.de; our API and the pages your guests see (stamp-card enrolment, NFC display stand, recovering a card) at api.treuly.de. The addresses under treuly.de still carry the service’s former name. They remain in place for technical reasons, among others because wallet passes and NFC display stands already issued point to them. clerk.treuly.de and accounts.treuly.de are answered by the sign-in service of our provider Clerk (§ 7); it also sends the sign-in verification codes, with a sender address under treuly.de. Order confirmations and other emails we send automatically carry a sender address under mail.treubar.de; personal replies come from support@treubar.de. The Android app “Treubar – Stempelkarten” from Google Play opens the web application at app.treuly.de in a browser window without an address bar (Trusted Web Activity); everything this policy says about the web application applies to it unless stated otherwise.

Staff of a business

If a business invites you to its team, you sign in with your own Treubar login — with your email address or via your Google or Apple account (§ 7). For this login our sign-in provider Clerk stores your name, your email address and your sign-in credentials; we copy the name and email address into our database.

We are the controller for this login: we process it so that you can sign in securely and later use the same login with another business. The legal basis is our legitimate interest, and that of the business, in a secure personal login for every team member (Art. 6 (1) (f) GDPR); your right to object is set out in § 8a. The connection data in our server logs, the push token of our iOS app (§ 2) and the product analysis (§ 6) are also our responsibility.

What you do within the business — your role and location in the team and the stamps and redemptions you issue, shown with your name in the stamp overview — we process on the business’s behalf (Art. 28 GDPR). The business is the controller for that; please address requests about it to the business.

If the business removes you from its team, we block your access to that business and end your active sessions. Your Clerk login remains until you have it deleted, so that you can accept another business’s invitation. Your name and email address stay stored with the business on the stamps you issued until the business deletes its account. If the business deletes its account, we also delete the logins still linked to it at that time.

You can ask us at any time, informally at support@treubar.de, to delete your login — preferably from the login’s email address; we do so without undue delay and within one month at the latest. This does not remove your name from the stamp overview of the business you worked for; that is the business’s decision.

What data we collect

For your account we process the name and email address of the people who work with Treubar for your business (sign-in), details about the business and the stamp card including branch addresses (display and configuration) and a change log — who changed or deleted what and when — which we keep for traceability and to investigate misuse (Art. 6 (1) (f) GDPR). We process your staff’s role and location in the team and the stamp timestamps (reward logic) on your behalf; your staff’s personal Treubar logins are covered by § 1a.

Via the contact form on treubar.de we process the subject, message text and email address, optionally your name, and the selected language. We use this data to deliver your message to support@treubar.de, send you a confirmation email, reply to your request and retain it where § 9 provides for that. For job applications, § 6b applies. There is no marketing send and no profiling based on the contact form.

Through the form for reporting illegal content (https://www.treubar.de/en/report-content) we process the details of the reported content, your reasons, the type of content and the language you select, the reference number and the time of the notice and — voluntarily — your name and email address. We use them to review and decide on the notice, to confirm receipt to you and to tell you our decision (Art. 16 of the Digital Services Act (DSA), Regulation (EU) 2022/2065); the same applies to notices that reach us by email. If we block or remove content, we give the business concerned our reasons; we only tell it your name where this is strictly necessary (Art. 17 (3) (b) DSA). If a notice gives rise to a suspicion of a criminal offence involving a threat to the life or safety of persons, we pass the information on to the competent law enforcement authorities, in Germany to the Federal Criminal Police Office (Bundeskriminalamt) (Art. 18 DSA, § 13 DDG).

For your customers’ stamp cards we process the details from the card’s enrolment form: first name, last name and date of birth. All three are mandatory fields. Together they are the only anchor by which a guest can recover their card after switching devices or deleting the wallet pass, and combined with recognition of the guest’s browser (§ 10) they prevent the same guest from accidentally creating a second, empty card on the same device; the date of birth is what tells namesakes apart. If your business runs birthday offers, it also triggers those. Since 26 August 2026 we no longer ask for an email address when a card is issued. Added to this are the pseudonymous pass identifier, stamping and redemption timestamps and the technical wallet identifiers for pass updates. Your guests do not need a Treubar account. We process this data exclusively on your behalf (Art. 28 GDPR); your business is responsible for the loyalty program and for informing your guests.

We do not use your guests’ data to build advertising profiles of our own. Campaign and automation features address the pass holders of your business, are triggered by you and are not evaluated by us for our own purposes. No sale of data to third parties, no advertising trackers on our websites. The audience measurement with Google Analytics that you can consent to on our website is described in § 6c; we do not use it for advertising.

When you open our website, our applications or the pages your guests see, our server processes technically necessary connection data: IP address, timestamp, requested address, status code, amount of data transferred, and details about the browser and operating system. We use them solely to keep the service running, to fend off attacks and automated bulk requests (per-IP rate limiting) and to trace faults. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

In the logs of our API (api.treuly.de), which serves our applications and the pages your guests see, every request receives a random request identifier that links related entries. If you are signed in, the entries after sign-in also contain the identifiers of your account and your business and your role; for wallet-pass requests they contain the technical pass and device identifier. This lets us attribute faults to a specific event.

On our website we hold the IP address used for rate limiting on the contact and notice forms in memory only and discard it once the 15-minute time window has expired. To make sure the contact and notice forms each send no more than one confirmation email to the same email address within 24 hours, we also keep a value derived from that address with a secret key (HMAC) in memory for 24 hours, not the address itself. This does not limit the notice itself: it always reaches our inbox and is handled, even when no further confirmation is sent.

If your team uses our iOS app and allows notifications, we store the push token issued by Apple together with the account and business identifier and the time of the last contact. We use it to send visible alerts to the app, for example about the status of a display-stand order or how full your plan is (§ 7) — for you as a customer to perform the contract (Art. 6 (1) (b) GDPR), and for your staff on the basis of our legitimate interest in informing a business’s team about events in its account (Art. 6 (1) (f) GDPR). Once Apple reports it as invalid or you sign out of the app, we stop using it; it is deleted permanently together with your business.

Legal bases

We base the processing on the following legal grounds:

• Art. 6 (1) (b) GDPR (contract and steps prior to entering into a contract): providing the service to business owners, concluding and handling subscriptions and display-stand orders, contact inquiries concerning a contract with us or steps prior to one (including cancellations and customer support requests), and job applications (§ 6b). • Art. 6 (1) (c) GDPR (legal obligation): statutory retention obligations (§ 5, § 9), handling notices of illegal content under Art. 16 to 18 DSA (§ 2) and records proving consent (Art. 7 (1) GDPR, § 6a). • Art. 6 (1) (f) GDPR (legitimate interest): operational security — server logs, per-IP rate limiting (including on the contact and notice forms), capping confirmation emails per address on the contact and notice forms and protecting sign-up against automated registrations (§ 2, § 7) —, the change log (§ 2), the personal Treubar logins of a business’s staff (§ 1a), their iOS-app push tokens (§ 2), all other contact inquiries, documenting our decisions on notices of illegal content (§ 9), retaining job applications after a rejection (§ 6b), the product analysis (§ 6) and messages about Treubar itself, together with § 7 (3) UWG (§ 6a). How you can object to this processing is set out in § 8a. • Art. 6 (1) (a) GDPR (consent): contact for product feedback (§ 6a), keeping your job application for other or later roles (§ 6b) and the audience measurement with Google Analytics on our website, together with § 25 (1) TDDDG for the cookies and the storage entry on your device (§ 6c).

Account area and statistics

In the logged-in account area we show you statistics about your business (e.g. stamps issued, active wallet passes, redemptions). These insights are derived from the operational data already processed to run the service and are provided in performance of the contract (Art. 6 (1) (b) GDPR). For these statistics we evaluate your end customers’ data in aggregate only; no additional personal data is collected for them.

Paid subscriptions are purchased online — via the checkout of our website (www.treuly.de) or in the web application for businesses at app.treuly.de; no purchase is possible in the iOS and Android apps. Payment is processed by Stripe Payments Europe, Ltd. (Ireland) together with Stripe, Inc. (USA). When you set up a business, we create a customer record for it with Stripe, which we use for a later subscription. We do this even if you never purchase a subscription. For this we pass Stripe your email address, your name (if none is stored, the part of your email address before the @) and the identifiers of your account and your business. At checkout the chosen plan is added. You enter your billing address and — optionally — your VAT identification number directly with Stripe. You enter the full payment details (e.g. your card number) directly with Stripe; they are processed exclusively by Stripe and are not stored by us. From Stripe we receive payment metadata (e.g. payment method, card brand and the last four digits), the payment and subscription status, the invoice data and your VAT identification number where you provide one. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR) and, for the customer record before a subscription purchase, our legitimate interest in a smooth checkout (Art. 6 (1) (f) GDPR). Stripe’s privacy terms apply in addition (https://stripe.com/privacy).

Ordering the NFC display stand

If you order an NFC display stand from us or claim the stands included in your yearly plan, we additionally process the details without which the order cannot be fulfilled: the name of the recipient or of your business, the delivery address (street and number, address supplement, postal code, city, country), a contact email address and — optionally — a phone number for queries about the delivery. Added to this are the order quantity, the design direction you chose and your free-text note on it, your feedback on the drafts we present, and the order, payment and shipping status together with the corresponding timestamps, the order number and — once available — the invoice and tracking numbers. For the draft we use the logo already stored in your account; you do not upload anything separately for it.

The legal basis is performance of the purchase contract (Art. 6 (1) (b) GDPR); for retaining the order, voucher and accounting records it is compliance with our legal obligations (Art. 6 (1) (c) GDPR in conjunction with § 147 AO, § 257 HGB and § 14b UStG).

We pass this data on to: Stripe for the payment (you enter the payment details themselves directly there), the print service provider that manufactures the stand, and the shipping provider that delivers it — currently DHL. The shipping provider receives the recipient name, delivery address, quantity and, if you gave one, the phone number; without these no shipping label can be produced. The order confirmation and status notifications are sent by email through our email provider (§ 7) and contain the delivery address.

Unlike the rest of your account data, order, invoice and accounting records are not deleted 30 days after an account deletion but only when the statutory retention periods expire: invoices and other accounting vouchers after eight years (§ 14b (1) UStG, § 147 (1) no. 4, (3) AO, § 257 (1) no. 4, (4) HGB), your order, our order confirmation and the other correspondence about the order after six years (§ 147 (1) nos. 2 and 3, (3) AO, § 257 (1) nos. 2 and 3, (4) HGB). Where your details appear in entries in our books — for example your name if you run a sole proprietorship — we keep those entries for ten years (§ 147 (1) no. 1, (3) AO, § 257 (1) no. 1, (4) HGB). The periods start at the end of the calendar year in which the record was created, received or sent (§ 147 (4) AO, § 257 (5) HGB); we keep a record longer only while it is relevant to taxes whose assessment period has not yet expired (§ 147 (3) sentence 5 AO). Until then we use these records only to meet our retention obligations; after that we delete them. If you have ordered and paid for a display stand, we cannot delete your business automatically, because the order and its invoice are attached to it. Write to support@treubar.de in that case; if the order is still being processed, wait until it has been delivered or refunded. We then delete all data of your account except the records that must be retained by law and the details linked to the order, and tell you which details we keep until the relevant retention period ends.

Usage data from our own applications (product analysis)

So that we can see how our applications are actually used, we record individual usage events. With a reference to a person this covers only our applications for businesses (iOS app and web application, including in the Android app from Google Play), and therefore the people who work with Treubar for a business — not the guests of those businesses.

For each event we store: the name of the event triggered (e.g. “card created”, “sign-up abandoned”); the timestamps on your device, at dispatch and on arrival with us; the type of screen you had open, but not the individual record in it (so “customer details”, not “customer no. 4711” — identifiers in the path are replaced by a placeholder before dispatch); the application used, with its version and build number; the operating system and — in the iOS app only — its version and the model class of the device (e.g. “iPhone 15”, never an individual device); language setting and time zone; a session identifier with the sequential number of the event and the identifier of the run of the application in which the event occurred; the identifiers of your business and your user account, your role within the business and its plan tier; plus a few event-specific details, such as the number of stamp slots on a newly created card.

Not collected in this data set: no IP address, no advertising ID, no device identifier, no free text you entered, no names or identifiers of your guests, no precise location, and no recognition feature derived from device characteristics. The identifiers of your business and your account are filled in by our server from your existing sign-in; if an application sends them itself, we discard them on arrival.

The purpose is to recognise which features are used, where use breaks off, and which errors occur that support requests never tell us about. The legal basis is our legitimate interest in a working product that is developed in the right places (Art. 6 (1) (f) GDPR). The data does not leave our own systems; we do not use any third-party analytics service for this product analysis. For the audience measurement on our website, see § 6c.

Raw events are deleted after 90 days. What remains are counts per business, day and type of event; they contain no identifiers of user accounts, sessions or devices, and we currently keep them without a fixed limit. If you are the only person in your business working with Treubar or run a sole proprietorship, these counts can still relate to you. What is and is not stored on your device is set out in § 10.

You may object to this processing at any time (Art. 21 (1) GDPR), informally to support@treubar.de. After that we no longer store any events for your user account — our applications still transmit them, but our server discards them on arrival (§ 10) — and we remove your account identifiers from the events already recorded. You suffer no disadvantage from objecting — Treubar remains available to you in full.

The pages on which your guests receive a stamp card or have a stamp issued are recorded on our server only, and without any identifier of the guest. These events are evaluated in aggregate only. The treuly_bid cookie (§ 10) is not used for this.

Messages from us to you (direct marketing)

If you created your Treubar account yourself and we informed you of your right to object when you did, we occasionally write to the email address you gave us at that time about Treubar itself (product news, stamp-card tips, plan information). § 7 (3) UWG permits this because we received the address in connection with your contract for the use of Treubar; under data protection law we rely on our legitimate interest in advertising our own services (Art. 6 (1) (f) GDPR). Staff invited by a business do not receive such emails. You can object at any time — in your account settings (the app is in German: “Betrieb > Account > Kontakt”) or at support@treubar.de — without incurring any costs other than transmission costs at basic rates; after that we no longer use your address for advertising. Every such email reminds you of this right.

If you have additionally consented to product feedback, we also contact you by phone, with a message inside the application and by survey email — the legal basis is then Art. 6 (1) (a) GDPR, and you can withdraw the consent at the same place at any time. Sending is handled by our email provider (§ 7).

As evidence under Art. 7 (1) GDPR we store one row per action with the email address, the channel, the time and a checksum of the wording shown to you. These rows are kept after a withdrawal or objection — they are precisely what proves it — for as long as your business exists in Treubar; they are deleted when the business is deleted.

Job applications

If you apply to us — through the contact form, by email or in any other way — we process the details you send us for this purpose, such as your name, contact details, background, links, documents and your message, and for the mandatory internship also the details of your university’s internship rule. If we talk to you, this also applies to any notes we take. We use this data to decide on your application. The legal basis is Art. 6 (1) (b) GDPR (steps taken at your request prior to entering into a contract). You are not obliged to give us these details, but without them we cannot consider your application.

We do not need information about your health, religion or other special categories of personal data (Art. 9 GDPR). If you choose to tell us about a severe disability or an equivalent status (Gleichstellung) so that we take it into account in the procedure, we process this information under Art. 9 (2) (b) GDPR in conjunction with § 26 (3) BDSG and § 164 SGB IX.

Applications that reach us through the contact form or by email are stored and handled in our mailbox; messages sent through the contact form are delivered by our email provider Resend. Details of these providers and of transfers to third countries are set out in § 7.

If we turn you down, we keep your application only until the periods have expired within which you can assert and bring claims against us under the German General Equal Treatment Act (AGG): such a claim must be asserted in writing within two months of receiving our rejection (§ 15 (4) AGG) and brought to court within three months of being asserted in writing (§ 61b (1) ArbGG). This allows us to defend ourselves against such claims (Art. 6 (1) (f) and Art. 17 (3) (e) GDPR). After that, we delete your application. If you assert such a claim, we keep it until the proceedings have ended. If you withdraw your application, we delete it without undue delay.

We keep your application for other or later roles only if you expressly consent (Art. 6 (1) (a) GDPR, § 26 (2) BDSG). You can withdraw this consent at any time with effect for the future, informally to support@treubar.de; we then delete your application unless the periods following a rejection are still running.

If we hire you, we transfer the documents we need for the employment relationship to your personnel file.

Right to object: You may object at any time, on grounds relating to your particular situation, to our keeping your application after a rejection (Art. 21 (1) GDPR), informally to support@treubar.de. We will then no longer process it unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need it to defend legal claims.

Audience measurement with Google Analytics

On our website at www.treubar.de and www.treuly.de we use the analytics service Google Analytics 4 — but only if you click “Accept” in the “Analytics cookies” notice. Before that, and if you decline, our website loads no script from Google, stores nothing for it on your device and sends no request to Google. We do not use Google Analytics on the pages for staff sign-in and invitations, in the account area, on the “Your subscription” page, on the hand-off into our app or on the pages for your guests. Consent is voluntary; you can use our website in full without it.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes the data on our behalf (Art. 28 GDPR) under the Google Ads Data Processing Terms (https://business.safety.google/adsprocessorterms/). We have switched off the settings that would let Google also use the data for its own purposes (data sharing), as well as Google signals, ads personalisation and any link to advertising accounts. Google provides further information at https://policies.google.com/privacy.

Purpose: we want to understand how our website is used — which pages are visited, where visitors come from and at which point they drop off — in order to improve content and flows. We also count how often someone opens the sign-up, sends the contact form, starts payment and completes an order. We do not build a profile of you as a person from this, and we do not combine the data with your Treubar account.

Google processes: the pages visited and the previous page, each without additional details in the address (only campaign tags such as utm_source and the plan and billing interval in the checkout address are kept); time and duration of the visits; technical details about browser, operating system and device, language setting and screen size; a coarse location derived from your IP address; the random identifier from the _ga cookie; automatically collected events such as scrolling to the end of a page, clicks on links to other websites and file downloads; and these events: a click on a link to the sign-up (with the chosen plan and billing interval and the area of the page — header, content or footer), a successfully sent contact form, a click on “Continue to paid order” in the checkout and the confirmed order on the thank-you page, each with plan, billing interval and list price, and for the order additionally a random order identifier that only prevents double counting. We do not transmit names, email addresses, form contents or identifiers of your account, your business or your payment. Google technically receives your IP address when the script loads and with every measurement; according to Google, Google Analytics does not store IP addresses of users in the EU but uses them only to derive the coarse location and then discards them. We have switched off the collection of granular location and device data: of the location, Google stores only the country and region, and of the device only its category (such as smartphone) and the browser and operating system without minor version — not the city, the device model or the screen resolution.

If you move between www.treubar.de and www.treuly.de via one of our links, Google Analytics adds the parameter _gl with the identifier from the _ga cookie to the address, so that the visit counts as one across both domains. Our website also passes your choice along as the parameter tb_consent, so that you are not asked twice. The other domain accepts the choice only if you actually come from our website, and removes tb_consent from the address bar straight away.

On your device, Google Analytics stores the cookies _ga (a random identifier by which Google Analytics recognises your browser on later visits) and _ga_<ID> (records which visit a page view belongs to; <ID> is the identifier of our measurement). Both apply only to the address under which they were set and expire two months after your last visit. If you click “Continue to paid order” in the checkout, our website also stores the plan, billing interval, list price and the random order identifier in the browser’s session storage (treubar:ga4:checkout), so that the thank-you page counts the order exactly once; the thank-you page deletes the entry, and at the latest it disappears when you close the browser tab.

The legal basis is your consent: § 25 (1) TDDDG for storing and reading the cookies and the storage entry on your device, and Art. 6 (1) (a) GDPR for the further processing.

Google may also transfer the data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission’s adequacy decision for it (Art. 45 GDPR, Implementing Decision (EU) 2023/1795) and additionally on the standard contractual clauses in Google’s data processing terms (Art. 46 (2) (c) GDPR); see § 7 for details.

Google deletes the stored events and the identifier assigned to them after two months, the shortest period Google Analytics offers; further visits do not extend this period. Aggregated reports without reference to individual visitors are kept beyond that.

You can withdraw your consent at any time with effect for the future: click “Decline” under “Cookie settings” at the bottom of every page. Our website then stops measuring and deletes the cookies _ga and _ga_<ID> and the session storage entry; Google deletes data already transmitted after the period above. The withdrawal applies immediately to the domain on which you declare it; the other domain adopts it as soon as you move there via one of our links, or you withdraw there in the same way under “Cookie settings”. Processing carried out until the withdrawal remains lawful. We keep your choice in your browser for twelve months (§ 10); after that we ask you again.

Sample cards to try

On www.treubar.de you can add the sample card of an invented business (Samt & Bohne, Perlmond, Fassonwerk, Közfeuer, Wagenfein) to Apple Wallet or Google Wallet, via the QR code on the display-stand images or the “Get the test card” button. We issue this card ourselves; there is no business behind it, so we are the controller (§ 1). We ask you for nothing, create neither a customer account nor a pass in our database and set no cookie.

When you fetch the card from api.treubar.de, our server processes only the technical connection data and server logs described in § 2, plus the sample card and wallet you chose, in order to deliver the card you requested (Art. 6(1)(f) GDPR); the page loads fonts from Google Fonts (§ 7).

Apple Wallet: the card contains no address for updates, so your device never registers with us, we receive no push token and cannot change the card afterwards.

Google Wallet: we forward you to Google (§ 7) with a signed link; the card is only created there once you tap “Save”, and it contains no information about you. We cannot delete a card object stored at Google; it contains only the sample data.

The card collects no stamps and receives no messages; you can delete it from your wallet at any time.

Service providers and other recipients

We use the following providers to operate Treubar:

• Hosting of the website, the web application and the API: Render Services, Inc. (USA). The website and the API run on servers in the Frankfurt am Main region (EU). • Database: Supabase, Inc. (EU region) • Sign-up, sign-in and account management: Clerk, Inc. (USA). For this Clerk processes your email address, your password if you sign up with an email address (we never see it ourselves), your name, and the IP address, browser and device details of your sessions; in our iOS app also the identifier that iOS assigns to your device for our app. If you register on our website, Clerk also stores with your account which version of the Terms of Service and the Data Processing Agreement and which notice you were shown, in which language, and that you confirmed you are acting as a business (proof of how the contract was concluded, Art. 6 (1) (b) and (f) GDPR). If you create an account in a browser — including via “Sign in with Google” or “Sign in with Apple” — Clerk runs a bot check by Cloudflare Turnstile (see the Cloudflare item and § 10). • Transactional email (contact form, notice form, order confirmations and status notifications): Plus Five Five, Inc. (“Resend”, USA), with sender addresses under mail.treubar.de • Mailboxes such as support@treubar.de: Google Ireland Limited (Ireland), “Google Workspace” service. For data centre operations, maintenance and technical support, Google also uses group companies outside the EU, in particular Google LLC (USA); Google publishes the list at https://workspace.google.com/terms/subprocessors.html. If you send us an email or a message through the contact or the notice form, it is stored there and handled by us. • Name resolution (DNS), network and protection against attacks: Cloudflare, Inc. (USA). For name resolution of our domains treubar.de and treuly.de, Cloudflare generally receives not your IP address but that of the name server used by your internet provider or your device. In addition, our hosting provider Render and our sign-in provider Clerk use Cloudflare’s network: requests to our website, our applications, the pages your guests see and the sign-in service (clerk.treuly.de) pass through it. As a service provider to Render and Clerk, Cloudflare terminates the encrypted connection, fends off attacks and overload and forwards the request; to do so it processes your IP address and the content of the request, such as the details you enter in a form. If you create an account in a browser, Cloudflare Turnstile also checks whether a human is signing up (§ 10). According to Cloudflare, it additionally uses the signals collected in the process (IP address, TLS fingerprint, browser identifier and the website’s key and address) as a controller in its own right to improve its bot detection (https://www.cloudflare.com/turnstile-privacy-policy/). The legal basis is our legitimate interest in a secure service, in particular in protecting sign-up and sign-in against automated access and spam accounts (Art. 6 (1) (f) GDPR). • Apple Wallet and push notifications: Apple Distribution International Ltd. (Ireland). Two separate paths: a wallet pass receives a contentless notification that merely prompts the device to refetch; your team’s iOS app receives visible alerts with a title and body (e.g. the status of a display-stand order, or how full your plan is). • Google Wallet: Google Ireland Limited (Ireland), with Google LLC (USA) for technical operation • Address lookup when entering a location or delivery address. In the web application our server sends the request to the OpenStreetMap Foundation (United Kingdom), “Nominatim” service; only the address text you typed is transmitted, not your IP address. In the iOS app this is handled by the map functionality built into iOS by Apple Distribution International Ltd. (Ireland): your iPhone itself queries Apple for matching addresses and for the coordinates of the selected address, transmitting the typed text and its IP address to Apple. In neither case do we read your location. • Fonts on the pages your guests see (stamp-card enrolment, display-stand pages), on the sample-card pages (api.treubar.de/demo, § 6d) and on the page you return to after the Stripe payment step for an NFC display stand (api.treuly.de/orders/return): Google Ireland Limited (Ireland), “Google Fonts” service. The browser loads the font directly from a Google server and in doing so transmits its IP address and technical details about the browser and operating system to Google. • Manufacture of the NFC display stand: a print service provider — details in § 5 • Audience measurement on our website, only with your consent: Google Ireland Limited (Ireland), service “Google Analytics”; for technical operation also Google LLC (USA) — details in § 6c

Other recipients who receive your data as controllers in their own right:

• Signing in with an existing account: Google Ireland Limited (Ireland) or Apple Distribution International Ltd. (Ireland). If you choose “Sign in with Google” or “Sign in with Apple”, your device sends the sign-in directly to that provider; through our sign-in provider Clerk we receive from there your email address, your name and the identifier of your account with that provider, and from Google also the address of your profile picture and access tokens for retrieving this information. You can withdraw the permission in the respective account. If you delete your Treubar account, we revoke the Google permission ourselves; the “Sign in with Apple” permission remains in your Apple account until you remove it there. • Payments: Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA); Stripe’s privacy policy applies in that respect (https://stripe.com/privacy). • Shipping of the NFC display stand: a shipping provider (currently DHL) — details in § 5 • Cloudflare, Inc. (USA) for the Turnstile signals, insofar as Cloudflare, according to its own statement, uses them to improve its bot detection (see above)

We base transfers to third countries on an adequacy decision of the European Commission (Art. 45 GDPR) or on appropriate safeguards (Art. 46 GDPR). For recipients established in the USA, the adequacy decision for the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795) applies where the recipient is certified under it (current status: https://www.dataprivacyframework.gov/list); otherwise the European Commission’s Standard Contractual Clauses apply (Art. 46 (2) (c) GDPR). For the OpenStreetMap Foundation in the United Kingdom, an adequacy decision of the European Commission is in place. The text of the Standard Contractual Clauses is published in the Official Journal of the EU (Implementing Decision (EU) 2021/914): https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. A copy of the clauses agreed with a recipient is available free of charge on request to support@treubar.de; we may redact business secrets in it.

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21, details in § 8a). You may withdraw any consent — for example for product feedback (§ 6a) or for the audience measurement on our website (§ 6c, under “Cookie settings” at the bottom of every page) — at any time with effect for the future; processing carried out until then remains lawful.

Send requests informally to support@treubar.de — if you have an account, preferably from its email address. We reply without undue delay and within one month at the latest; in complex cases the period may be extended by up to two further months, in which case we tell you within the first month (Art. 12 (3) GDPR). If we have reasonable doubts whether a request comes from you, we ask for an additional confirmation, for example from within your account or from the email address you wrote to us from.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, https://datenschutz-hamburg.de.

You are not legally obliged to provide any data. Some details are, however, needed, otherwise we cannot do what you ask of us: for the contact form we need your email address, a subject and your message — otherwise we cannot reply; your name is optional. For a notice of illegal content we need the details of the reported content, your reasons and your confirmation in good faith that the information in your notice is accurate and complete; your name and email address are optional, but without an email address we can neither confirm receipt nor tell you our decision. For a Treubar account we need at least your email address and a password, or sign-in via Apple or Google; if you register in our iOS app or web application with your email address, we also need your first name. To set up your business we need its name. For a paid subscription we additionally need the billing and payment details Stripe asks for at checkout; the VAT identification number is optional. Without these details we cannot create an account or a business or conclude a subscription. Which details are needed to order an NFC display stand is set out in § 5.

We do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). If you are a guest of a business, please address matters concerning your stamp card to that business (§ 1).

Retention

We only retain personal data for as long as it is needed to provide the service or to meet statutory retention obligations (e.g. § 147 AO, § 257 HGB). Contact inquiries are kept in our mailbox while we handle them and need them to answer follow-up questions on the same matter (Art. 6 (1) (b) GDPR where the inquiry concerns a contract with us or its preparation, otherwise (f); § 3). Where an inquiry concerns preparing, concluding or performing a contract with us, it is a commercial or business letter; we then keep it for six years from the end of the calendar year in which it was received or answered, and beyond that for as long as it is relevant to taxes whose assessment period has not yet expired (Art. 6 (1) (c) GDPR in conjunction with § 257 (1) nos. 2 and 3, (4) and (5) HGB and § 147 (1) nos. 2 and 3, (3) and (4) AO). For job applications, § 6b applies. We keep notices of illegal content and our decisions on them until the end of the third calendar year after the procedure is closed, so that we can document them and defend against legal claims. After you delete your account we remove your content — including the end-customer data processed on your behalf — from the production systems within 30 days. Data held in backups is overwritten as part of the ordinary backup cycle.

One exception is beyond our reach: when a guest chooses Google Wallet, we create an object there that cannot be deleted — Google issues immutable identifiers for it and provides no delete operation. When the guest or their business’s account is deleted in Treubar, we set the object to “inactive”. If the guest has saved the card in their wallet, Google then shows it there among the expired passes, with the details last saved, including the name, until the guest removes it; Google keeps the record in any case. An Apple Wallet pass already issued stays on the guest’s device until they remove it there; it is no longer updated.

Two sets of data are exempt from this 30-day rule. First: order, invoice and accounting records are retained for the statutory retention periods — six, eight or ten years depending on the type of record — and are used only for that purpose until then (details in § 5). Second: raw usage events from the product analysis are deleted after 90 days already, without any account deletion being needed; the counts per business derived from them are currently kept without a fixed limit (§ 6).

Google deletes the data of the audience measurement with Google Analytics after two months; the periods for the cookies and the storage entry on your device are set out in § 6c and § 10.

Cookies and access to end devices

On treubar.de and treuly.de, in the web application and on the pages your guests see, we and our service providers set the following cookies. We do not set advertising cookies. Cookies for audience measurement (Google Analytics) are set on www.treubar.de and www.treuly.de only if you consent (§ 6c).

• Authentication provider Clerk, Inc. (USA, § 7) on the sign-in, sign-up, account and checkout pages (including the thank-you page after your order) and on the “Your subscription” page at www.treuly.de, and in the web application at app.treuly.de. As soon as you open one of these pages — that is, even before you sign in — Clerk stores these cookies: __client, a random identifier of your browser at the authentication service (only for clerk.treuly.de, not readable by scripts, lifetime up to ten years); __client_uat and __client_uat_<suffix>, holding the time your sign-in status last changed, or the value “0” while nobody is signed in (for all addresses of the .treuly.de domain, lifetime up to ten years). After you sign in, these are added: __session and __session_<suffix>, holding a short-lived proof of sign-in that Clerk renews continuously (only for the respective address, lifetime up to one year, deleted when you sign out), and clerk_active_context, holding the active session (until the browser is closed). If you are signed in, our server sometimes briefly routes your browser via clerk.treuly.de when you open one of these pages at www.treuly.de, so that Clerk confirms your sign-in and renews the proof of sign-in — for example when you come from the web application or from treubar.de, or when your proof of sign-in there is missing or has expired; for this our server sets the cookie __clerk_redirect_count for two seconds, which only counts these redirects so that no endless loop can occur. Clerk also keeps the public settings of the authentication service in the browser’s local storage for 24 hours (__clerk_environment). __client and __client_uat remain after you sign out; you can delete them in your browser at any time. When you attempt to sign in, your browser also transmits its language setting and time zone to Clerk. • Cloudflare, Inc. (USA) as Clerk’s service provider: connections to clerk.treuly.de and accounts.treuly.de run through Cloudflare’s network, which receives your IP address in the process. There, Cloudflare sets the cookies __cf_bm (detection of automated access, lifetime 30 minutes from the last request) and _cfuvid (distinguishes users who share an IP address when mass requests are limited; until the browser is closed). Neither is readable by scripts, and both apply only to these addresses. If you create an account in a browser — including via “Sign in with Google” or “Sign in with Apple” — Clerk also uses Cloudflare’s Turnstile service to check that a human is signing up; for this your browser loads a check script from Cloudflare that reads technical characteristics of your browser and transmits them to Cloudflare together with your IP address. • treuly_bid — a cookie on the pages your guests see. It holds neither a name nor a card number, but a random, signed identifier of the browser; which stamp card it belongs to is known only on our server. It is set at every business — even one that does not use an NFC display stand — the first time a guest opens one of these pages: the entry via the QR code or a link to the stamp card, the enrolment page, recovering a card, “Jetzt stempeln” (stamp now) on their card, or the page that opens when an NFC display stand is tapped. It is refreshed every time one of these pages is opened again. When a guest creates a card, recovers it or opens “Jetzt stempeln”, we assign the cookie on our server to their card at that business; the same cookie applies to all businesses. It serves two purposes: at the NFC display stand it assigns the tap to the guest’s card — without it, a tap cannot tell which card the stamp belongs to; and if a guest creates a card at the same business again on the same device with the same details (first name, last name, date of birth), they get their existing card back instead of a second, empty one. It applies only to the address that set it (currently api.treuly.de). Lifetime: 400 days from the last time one of these pages was opened. It is httpOnly (not readable by scripts in the browser), transmitted over HTTPS only, scoped to our own pages (SameSite=Lax), and never used for any analysis. • treuly_park — a short-lived cookie at the NFC display stand. It is created when a guest taps but their browser is not yet assigned to a card, so the stamp is held briefly until the guest opens their card. It holds a random identifier of the held stamp and a one-time key, neither a name nor a card number. Lifetime: 5 minutes. It is httpOnly, transmitted over HTTPS only and scoped to our own pages (SameSite=Lax). • _ga and _ga_<ID> — Google Analytics cookies on www.treubar.de and www.treuly.de, only after your consent (§ 6c, § 25 (1) TDDDG): _ga holds a random identifier by which Google Analytics recognises your browser on later visits; _ga_<ID> records which visit a page view belongs to. They apply only to the address under which they were set and expire two months after your last visit. If you decline or withdraw, our website deletes them. With your consent, our website also stores the entry treubar:ga4:checkout in session storage when you submit the checkout (§ 6c).

Under § 25 (2) no. 2 TDDDG, Clerk’s cookies and storage entry, Cloudflare’s cookies, the check at sign-up and treuly_park require no consent, because they are strictly necessary for the service that was expressly requested: Clerk’s cookies and storage entry carry the sign-in you start yourself by opening the sign-in or sign-up page or the web application, and keep you signed in; Cloudflare’s cookies and the check at sign-up protect the authentication service against automated attacks; treuly_park ensures that only the person who actually tapped the display stand receives the held stamp.

In the iOS app, the sign-in SDK of our provider Clerk (§ 7) stores your sign-in token, a copy of your account data and Treubar’s sign-in settings in your device’s keychain, and reads the sign-in token with every request to the authentication service. This keeps you signed in; without this storage you would have to sign in again every time the app starts (§ 25 (2) no. 2 TDDDG). With every request to Clerk, the SDK also sends the device type (e.g. “iPhone”), the model class of the device, the versions of iOS and of the app, the app’s identifier, whether it is a test version, and the identifier that iOS assigns to your device for our app (identifierForVendor).

For the product analysis under § 6, our iOS app and our web application record usage events as soon as they are opened — that is, even before you sign in. For this they read the operating system, language setting and time zone on your device, the iOS app additionally the iOS version and the model class of the device, and the web application the display mode (in the browser or as an installed app). Events not yet transmitted are kept in a queue on your device: in the iOS app in a file in the application directory, in the web application in the browser’s local storage (treuly.analytics.outbox). Each event in it contains the identifier of the run of the application in which it occurred and a session identifier. Events that occur before a sign-in stay in the queue, are transmitted after the next sign-in and are then assigned to the account that signed in. The queue is cleared once its events have been transmitted; anything that cannot be transmitted is discarded by the application after seven days at the latest. If you have objected under § 6, the applications keep recording and transmitting events; our server then discards them without storing them.

For the request to rate Treubar in the App Store or on Google Play, the iOS app (in the device’s app settings) and the web application (in the browser’s local storage) also store on your device when you first and last used the application, how many sessions there were, how often a stamp or redemption succeeded and when the last one did, when a scan last failed, and when the request was shown. The web application shows the request only in our Android app; to tell whether it is running there, it keeps a note in the browser’s session storage while the tab is open. When an application shows the request, it transmits the number of sessions and of successful stamps and redemptions as a usage event under § 6.

Stamps you issue while offline are likewise stored on your device: the web application keeps them in the browser’s database, the iOS app in a file, until they have been transmitted — without that store the stamp would be lost (§ 25 (2) no. 2 TDDDG).

Beyond that, our website and our applications only store settings and intermediate states on your device that serve solely the feature you are using: • On our website (treubar.de and treuly.de): an entry in your browser’s local storage with your language choice (“de” or “en”). It is created only when you switch the language or close the hint about the English version, and it makes sure that this hint does not appear again. It never leaves your device. If you have made a choice in the “Analytics cookies” notice, local storage also holds an entry with that choice and its time (treubar:consent). It makes sure that we respect your choice and do not ask you again on every visit; after twelve months we ask again. If you move between www.treubar.de and www.treuly.de via one of our links, our website passes your choice along as the parameter tb_consent in the address (§ 6c). In addition, the checkout keeps the name you enter there for your business in the browser’s session storage while the browser tab is open: if the checkout shows an error message after you submit, it fills the name in again; if you open the checkout without an error message, it removes the name. • In the web application: a service worker with caches for the application’s program files (until they are replaced by a newer version of the application), its start page (up to 7 days) and fonts (up to 1 year), so that the application also starts without a network connection; entries in the browser’s local storage for the location selected at the scanner, introductions you have seen and hints you have closed, an intention to order expressed during setup, and the draft of a display-stand order with the contact and delivery details you entered (until you submit or discard it; the application discards a draft that has not been changed for 14 days); in session storage, only while the browser tab is open, an invitation code until the invitation is completed (at most 30 minutes). • In the iOS app: the same settings and intermediate states as in the web application’s local storage, here in the device’s app settings, the device’s push token, so that we can deregister it when you sign out, and, in the app’s cache, the explainer videos for the display stand, so that they are not downloaded again every time. This storage, too, requires no consent under § 25 (2) no. 2 TDDDG. You can remove these entries at any time in your browser or by deleting the app.