Privacy Policy

This Privacy Policy explains how sunny site up GmbH processes personal data when you visit our website sunnysiteup.agency and when you use our mobile apps for iOS and Android (together: "our services"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

sunny site up GmbH
Managing director: Lutz Borkenhagen
Müggenkampstraße 7a
20257 Hamburg, Germany
Email: hello@sunnysiteup.agency

For all questions about data protection, please contact us at the address above.

2. Our website

2.1 Hosting and server log files

Our website is hosted by Netlify, Inc., San Francisco, USA (Netlify Privacy Policy). When you visit the website, the server automatically records technical information that your browser transmits: IP address, date and time of the request, the page requested, the referring page, browser type and version, and operating system. This is necessary to deliver the website and to ensure its security and stability. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website). Log files are stored only for a limited period and are not combined with other data sources. We have concluded a data processing agreement with Netlify (Art. 28 GDPR). As Netlify may process data in the USA, the transfer is based on the safeguards described in section 6.

2.2 No cookies, no tracking

Our website does not use cookies, analytics or tracking tools and does not load content from third parties such as fonts, maps or videos. All images and files are served from our own server.

2.3 Contact by email

If you contact us by email, we process your email address, your name (if provided) and the content of your message in order to answer your request. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries). We delete your data once your request has been fully processed, unless statutory retention obligations apply (e.g. for business letters under German commercial and tax law).

3. Our apps

Our apps are currently in development; no app has been released yet. This section describes the principles that will apply to all apps published by sunny site up GmbH on the Apple App Store and Google Play. Before an app is released, this Privacy Policy will be supplemented with the information for that app (section 4). We follow the principle of data minimisation: our apps only process the data that is needed for their features. The data each app processes is listed in section 4 and in the privacy section of the respective store page (App Store "App Privacy" and Google Play "Data safety").

3.1 Downloading the app

When you download an app, the required information (e.g. your Apple ID or Google account, time of download, device identifier) is transferred to Apple or Google. We have no influence on this processing and do not receive this data in a form that identifies you. Please refer to the privacy policies of Apple and Google.

3.2 In-app purchases and subscriptions

Purchases and subscriptions are processed exclusively by Apple or Google. We do not receive or store your payment details. We only receive confirmation of a purchase (product, time, status of the subscription) in order to unlock the purchased content. Legal basis: Art. 6(1)(b) GDPR.

3.3 User accounts

If an app offers a user account, we process the data you enter when registering (e.g. email address, display name) and the content you create in the app in order to provide the account and its features. Legal basis: Art. 6(1)(b) GDPR. You can delete your account at any time – see Delete your account and data.

3.4 Device permissions

Some features require access to functions of your device (e.g. camera, photos, location or notifications). The app only asks for a permission when you use the corresponding feature, and you can grant or revoke it at any time in your device settings. Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR, depending on the feature.

3.5 Crash reports and usage statistics

Where an app uses crash reporting or usage statistics, this is stated in section 4 for that app, including the service provider used. Where required by law, we only use such services with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time in the app settings.

3.6 Advertising

Unless stated otherwise for a specific app in section 4, our apps do not show personalised advertising and do not track you across apps or websites of other companies.

3.7 Children

Our apps are not directed at children under the age of 16 unless explicitly stated for a specific app. We do not knowingly collect personal data from children.

4. App-specific information

Once an app is released, the following table will list which personal data it processes, for which purpose and by which service providers.

5. Recipients and processors

We only share personal data with third parties if this is necessary to provide our services, if you have consented, or if we are legally obliged to do so. Service providers that process data on our behalf (e.g. hosting providers) are bound by a data processing agreement under Art. 28 GDPR and may only use the data according to our instructions.

6. Transfers to countries outside the EU

If personal data is transferred to a country outside the European Economic Area, we ensure that an adequate level of protection exists, for example on the basis of an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Retention

We store personal data only as long as it is needed for the purposes stated above. Account data is deleted when you delete your account. Data that we must keep for legal reasons (e.g. under § 257 HGB or § 147 AO) is restricted from further processing and deleted when the retention period ends.

8. Your rights

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

To exercise your rights, simply send an email to hello@sunnysiteup.agency.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
datenschutz-hamburg.de

10. Changes to this Privacy Policy

We update this Privacy Policy when our services or the legal requirements change. The current version is always available at sunnysiteup.agency/privacy.html.