Privacy Policy

1) Information on the collection of personal data and contact details of the controller

1.1 We are pleased that you are using our application (hereinafter referred to as the “App”). Below, we inform you about the handling of your personal data when using our App. Personal data is any data that can personally identify you.

1.2 The controller responsible for data processing in relation to this App within the meaning of the General Data Protection Regulation (GDPR) is Marco Donndorf, CHESSREBELS, Chemnitzstr. 20, 22767 Hamburg, Germany, Tel.: +494069910124, E-Mail: info@chessrebels.com. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this App uses SSL or TLS encryption. You can recognize an encrypted connection by the string “https://” and the padlock icon in your browser line.

2) Log files when using our mobile app

When you download our mobile app from an app store, the necessary information is transmitted to the app store, in particular your username, email address, and customer number for your account, time of download, payment information, and individual device identification number. We have no influence on this data collection and are not responsible for it. We process the data only insofar as it is necessary for downloading the mobile app to your mobile device.

When using our mobile app, we collect the personal data described below in order to enable the convenient use of the functions. If you wish to use our mobile app, we collect the following data, which is technically necessary for us to offer you the functions of our mobile app and to ensure its stability and security:

• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request
• Access status/HTTP status code
• Amount of data transmitted in bytes
• Source/reference from which you reached the page
• Browser used
• Language and version of the browser software
• Operating system used and its interface
• IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our App. The data is not passed on or used in any other way. However, we reserve the right to check the aforementioned log files subsequently should there be concrete evidence of unlawful use.

Furthermore, we require your device's unique number (IMEI = International Mobile Equipment Identity), the subscriber's unique number (IMSI = International Mobile Subscriber Identity), mobile number (MSISDN), potentially the MAC address for Wi-Fi usage, and the name of your mobile device.

3) Hosting & Content Delivery Network

Firebase Cloud Storage

We use the web hosting service “Firebase Cloud Storage” from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”) for the purpose of hosting and displaying the app content based on processing on our behalf.

All data collected in the App is processed on Google's servers.

Within the scope of the aforementioned services, data may also be transmitted to servers of Google LLC in the USA as part of further processing on our behalf. We have concluded a data processing agreement with Google for the use of Firebase, which obliges Google to protect the data of our site visitors and not to pass it on to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission. Further information on Google's data protection with regard to Firebase can be found on the following website: https://firebase.google.com/support/privacy

Further processing on servers other than the aforementioned Google servers takes place only within the scope described below.

4) Use of your address book, calendar, photos, and reminders

At the start of using our mobile app, we will ask you in a pop-up for permission to use your address book and/or calendar and/or your photos and/or reminders. If you do not grant consent, we will not use this data. In that case, you may not be able to use all functions of our App. You can grant or revoke consent later in your operating system's settings.

If you permit access to this data, the mobile app will only access your data and transmit it to our servers insofar as it is necessary for providing the functionality. Your data will be treated confidentially by us and deleted if you revoke the right to use it or if it is no longer required for providing the service and there are no legal retention obligations. The legal basis for the processing is Art. 6(1)(1)(f) GDPR.

5) Contacting us

5.1 Personal data is collected when you contact us (e.g., via contact form or email). The data collected when using a contact form can be seen from the respective contact form in the App. This data is stored and used exclusively for the purpose of responding to your inquiry or for contacting you and the associated technical administration. The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted after your inquiry has been processed. This is the case if it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no legal storage obligations to the contrary.

5.2 - Firebase AI Logic

Within this App, we have integrated an artificial intelligence software solution from the following provider to provide autonomous support: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA

Through an API-based integration, users can make inquiries regarding functions and services of the App via text input, which are then answered and processed by the provider's language models.

For this purpose, the provider's software may collect personal data of the inquirer in order to automatically check the request and then resolve it by autonomously initiating processing procedures.

The collection and further processing of personal data occur exclusively for processing the specific inquiry. The processing of app user inputs for the purposes of training and further developing the provider's AI language models is expressly prohibited.

Data processing is based on our legitimate interest in the effective support of our app users and in the optimal marketing of our offer in accordance with Art. 6(1)(f) GDPR.

Collected personal data will be deleted, subject to conflicting legal retention periods, if the provider's software determines a conclusive clarification of the matter in accordance with automatic mathematical-statistical procedures.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

Further legal information as well as Google's privacy policy can be found at https://support.google.com/gemini/answer/13594961?hl=de

6) Online Marketing

- Advertising Identifier

For advertising purposes, we use the so-called “Advertising Identifier” (GAID). This is a unique, but non-personalized and non-permanent identification number for a specific device, provided by Android. The data collected via the GAID is not linked to other device-related information. We use the GAID to provide you with personalized advertising and to evaluate your usage. If you disable the options for “Ads and Personalization” in the Android settings under “Google” - “All Services”, we can only perform the following measures: measuring your interaction with banners by counting the number of times a banner is displayed without clicking on it (“frequency capping”), click-through rate, determination of unique users (“unique user”), as well as security measures, fraud prevention, and debugging. You can delete the GAID at any time in the device settings (“Reset Advertising ID”), at which point a new GAID will be created that will not be merged with previously collected data. Please note that you may not be able to use all features of our App if you restrict the use of the GAID.

7) Web Analytics Services

Google Analytics 4
This App uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which allows for the analysis of app usage.
When accessing this App, in the context of Google Analytics 4's so-called consent mode (beta version), no cookies (text files stored on your device that enable analysis of your use of the App) are used by default unless you expressly consent to the setting of cookies and the reading of information from cookies after being prompted to do so. Until such consent is granted – and if you expressly refuse such consent when prompted by us – even during your further use of this App, no cookies will be set or read by Google Analytics 4. Instead, certain information about your usage behavior is collected and processed using so-called “pings”.
The information about your use of the App collected in this case by so-called pings (including the IP address transmitted by your device, shortened by the last digits, see below) is generally transmitted to a Google server, where it is stored and further processed. This may also involve the transmission of information to the servers of Google LLC based in the USA for further processing. If you expressly consent to the use of cookies, the same applies to information about your use of the App collected by cookies.
When using Google Analytics 4, the IP address transmitted by your device during your use of the App is always collected and processed in an anonymized manner by default and automatically, so that a direct personal identification of the collected information is excluded. This automatic anonymization occurs because the IP address transmitted by your device is shortened by Google within member states of the European Union (EU) or other contracting states of the Agreement on the European Economic Area (EEA) by the last digits.
On our behalf, Google uses this and other information to evaluate your use of the App, to compile reports on your app activities or usage behavior, and to provide us with further services related to your app usage and internet usage. The shortened IP address transmitted by your device as part of Google Analytics 4 will not be merged with other Google data. The data collected in the course of using Google Analytics 4 will be retained for 2 months and then deleted.
Through a special function, so-called “demographics”, Google Analytics 4 also allows for the creation of statistics with statements about age, gender, and interests of app users based on an evaluation of interest-based advertising and with the involvement of third-party information. This makes the determination and distinction of user groups of the App possible for the purpose of target group-optimized alignment of marketing measures. Data collected via “demographics” cannot be assigned to any specific person and thus not to you personally. This data collected via the “demographics” function will be retained for two months and then deleted.
All processing described above, including data transfers via “pings” and the potential setting of Google Analytics cookies for storing and potentially reading information on the device you use to access the App, only occurs if you have given us your express consent in accordance with Art. 6(1)(a) GDPR. Without your consent, the analysis of your use of the App will not take place. You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service via the “Cookie Consent Tool” provided on the App.
We have concluded a data processing agreement with Google for our use of Google Analytics 4, through which Google is obligated to protect the data of our app users and not to pass it on to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
Further legal information on Google Analytics 4 can be found here: https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de
Details on the processing initiated by Google Analytics 4 and Google's handling of data from apps can be found here: https://policies.google.com/technologies/partner-sites

8) Tools and Other

8.1 - Firebase Crashlytics

We use “Firebase Crashlytics”, a service of Google Ireland Ltd., Google Building Gordon House, Barrow Street, Dublin 4, Ireland, to create anonymized crash reports in order to improve the stability and reliability of our App.

Exclusively on the basis of your express consent in accordance with Art. 6(1)(a) GDPR, anonymous information is transmitted to Google's servers in the event of an app crash (state of the app at the time of the crash, installation UUID, crash trace, manufacturer and operating system of the phone, last log messages). Transmissions to Google LLC in the USA are also possible. This information does not contain any personal data.

When using an iOS-based device, you can grant consent in the App settings or after a crash. When using an Android-based device, there is an option during setup to generally consent to the transmission of crash reports to Google and app developers.

You can revoke your consent at any time by

• disabling the “Crash Reporting” function in the App settings on iOS
• adjusting the system settings on Android. To do this, open the App settings, select the item “Google” and there in the three-dot menu at the top right, the menu item “Usage & Diagnostics”. Here you can deactivate the sending of the corresponding data.

Further information on data protection can be found in the Firebase Crashlytics privacy notice at https://firebase.google.com/support/privacy

8.2 - Firebase App Check

For security purposes, this App uses the “Firebase App Check” service, a service of Google Ireland Ltd., Google Building Gordon House, Barrow Street, Dublin 4, Ireland.

Data may also be transmitted to: Google LLC, USA

The service protects the App and the associated IT infrastructure from unauthorized third-party access, cyberattacks, and viruses and malware. For this purpose, the service collects user IP addresses and, if applicable, other data regarding behavior within the App in order to detect and fend off illegitimate access and threats. The collected IP address is compared with a list of known attackers. If the collected IP address is recognized as a security risk, the service can automatically block it from app access. The information collected in this way is transmitted to a provider server and stored there.

The described data processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interests in protecting the App from harmful cyberattacks and in maintaining the integrity and security of the structure and data.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

9) Rights of the data subject

9.1 The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller regarding the processing of your personal data, about which we inform you below:

• Right of access pursuant to Art. 15 GDPR: You have, in particular, a right to obtain information about your personal data processed by us, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, the right to lodge a complaint with a supervisory authority, the source of your data if not collected from you by us, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved and the significance and envisaged consequences of such processing for you, as well as your right to be informed about which safeguards exist pursuant to Art. 46 GDPR regarding the transfer of your data to third countries;
• Right to rectification pursuant to Art. 16 GDPR: You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and/or completion of your incomplete data stored by us;
• Right to erasure pursuant to Art. 17 GDPR: You have the right to request the erasure of your personal data if the requirements of Art. 17 (1) GDPR are met. However, this right does not exist in particular if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims;
• Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data contested by you is being verified, if you refuse the erasure of your data due to unlawful data processing and request the restriction of processing instead, if you require your data for the establishment, exercise or defense of legal claims after we no longer need these data upon achievement of the purpose, or if you have objected to processing on grounds relating to your particular situation, as long as it is not yet clear whether our legitimate grounds override yours;
• Right to notification pursuant to Art. 19 GDPR: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the latter is obliged to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
• Right to data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to request the transmission to another controller, as far as this is technically feasible;
• Right to withdraw consent given pursuant to Art. 7 (3) GDPR: You have the right to withdraw your consent to the processing of data once given at any time with effect for the future. In the event of withdrawal, we will delete the data concerned immediately, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal;
• Right to lodge a complaint pursuant to Art. 77 GDPR: If you believe that the processing of personal data concerning you violates the GDPR, you have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

9.2 RIGHT TO OBJECT

IF, WITHIN THE SCOPE OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN PROVE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA ARE PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

10) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and – if applicable – additionally by the respective statutory retention period (e.g., commercial and tax law retention periods).

When processing personal data based on express consent pursuant to Art. 6 (1) (a) GDPR, the data concerned are stored until you withdraw your consent.

If statutory retention periods exist for data that are processed in the context of legal or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, these data are routinely deleted after the expiry of the retention periods, provided they are no longer required for the fulfillment of the contract or the initiation of a contract and/or we have no continuing legitimate interest in further storage.

When processing personal data based on Art. 6 (1) (f) GDPR, these data are stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

When processing personal data for direct marketing purposes based on Art. 6 (1) (f) GDPR, these data are stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in other information in this declaration regarding specific processing situations, stored personal data are otherwise deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.