Data protection information for the MEDION Fitness App (July 2022)

Thank you for using the MEDION App. MEDION AG, with its registered office at Am Zehnthof 77, 45307 Essen, Germany (hereinafter referred to as "MEDION" or "we"), is the responsible party for the collection, processing and use of your personal and terminal device-related data in connection with the MEDION App (hereinafter referred to as the "App").

MEDION collects, processes and uses personal and terminal-related data that is either entered by you or otherwise created or processed in the course of using the App, the associated terminal devices or services offered by MEDION in accordance with the applicable data protection laws and informs you below about the data processing carried out by us on the basis of the existing usage agreement with you or any other legal basis.

We take the protection of your personal and terminal data very seriously and want you to feel secure when using our apps. Protecting your privacy when processing personal and device-related data is a central and important concern for MEDION, which we also take into account in all our business processes.

We take care of the protection of your data collected, processed and used by us when you visit the MEDION apps. And we are happy to be your contact for all questions on the subject of MEDION data protection and also take your suggestions on board and see to it that they are dealt with in a very timely manner. The declaration is regularly revised in order to comply with legal changes and/or to reflect feature enhancements in the app. We therefore ask you to read it regularly. The last chapter of this statement below indicates when it was last updated.

1. Principles

Your personal data will be collected, processed and used exclusively in accordance with the statutory provisions and in good faith. As far as possible, we design our business processes in such a way that data protection requirements are already taken into account during the development of products and service offerings and that personal data is anonymised in such a way that the data subject cannot be identified or can no longer be identified if this does not jeopardise the agreed purpose. MEDION uses your personal data for the technical administration of this app, for customer and user administration and marketing in order to inform you about our services and products (specific consumables and spare parts).

2. Sources and data used

Within the scope of our business relationships, we process personal data that we have received directly from you. In addition, we process personal data that we obtain permissibly from publicly accessible sources or that is legitimately transmitted to us by other third parties, insofar as this data is necessary for the provision of the corresponding services and within the scope of the agreed purpose.

We store your data that is necessary for the processing of your order, the use of our products or the provision of services, e.g. repairs, and - if selected by you - for the processing of payments. This is personal data such as your address details, date of birth (for transactions with age verification) and data required for certain types of payment. The respective order data (article, quantity, price, etc.) is assigned to your address data. In most cases, MEDION is already required by law to collect this data (for example, in the case of age verification in accordance with the German Youth Protection Act or the German Tax Code).

3. Categories of personal data

In connection with the use of the app, the associated end devices or services and functions offered by MEDION (hereinafter "Services"), MEDION collects, processes and uses the following categories of personal data.

  1. User master and usage data
    Data that we collect and use in connection with creating a user account (registration) and setting up the app are:
  2. Device master data
    Data that we collect and use in connection with the connection of your end device (smartphone and/or tablet) with the user account are: This data is assigned to your user account within the framework of the "Add device" function for each connected end device.
  3. Device usage data
    MEDION collects and uses telemetry data in connection with the use of the end device (in this case Robot Vacuum Cleaner), which can be categorised as follows
    1. Basic information
      1. Product name
      2. Firmware versions
    To assess a variety of metrics, your device collects data such as the number of steps you take, the distance you travel, calories burned, weight, heart rate, sleep stages, active minutes and location. The data collected depends on the device you are using. Should your device pair with apps or software, the data stored on your device will be transmitted from your device to our servers.
    MEDION Fitness:
    E1000 (steps, distance, calories, sleep)
    E1500 (steps, distance, calories, sleep)
    E1800 (steps, distance, calories, heart rate, sleep)
    E1900 (steps, distance, calories, heart rate, sleep)
    E2000 (steps, distance, calories, heart rate, sleep)
    S1500 (steps, distance, calories, heart rate, sleep)
    S2000 (steps, distance, calories, heart rate, sleep)
    S2400 (steps, distance, calories, heart rate, sleep, GPS location)
    S2500 (steps, distance, calories, heart rate, sleep)
    S3500 (steps, distance, calories, heart rate, sleep)
    S3600 (steps, distance, calories, heart rate, sleep)
    S3750 (steps, distance, calories, heart rate, sleep)
    S3780 (steps, distance, calories, heart rate, sleep)
    S3900 (steps, distance, calories, heart rate, sleep, blood oxygen)
    P2200 (steps, distance, calories, heart rate, sleep)
    P4000 (steps, distance, calories, heart rate, sleep, GPS location)
    P6300 (Body weight, body fat percentage. Body water percentage, muscle & bone mass, BMI, BMR)
    MEDION uses your data to make the use of the fitness tracker as pleasant as possible for you and so that you can benefit optimally from your fitness programme. At the same time, we use this information to improve the MEDION service and thus give you the opportunity to access your data again if you lose your hardware. The following personal data to be entered by you will be stored if you create a free account: E-mail address, name, height, weight, date of birth, gender. In addition, the application stores and processes the following fitness data: steps, hours of sleep, heart rates, distances covered, calories burned, goals, successes and challenges, as well as activities. If you do not create an account, your data is only stored locally on your smartphone.
  4. App usage data
    MEDION collects and uses the following data in connection with the use of the app:
  5. Geolocation data
    The Services include features that use precise location, including GPS signals, as well as sensors on the Device & Equipment. We collect this type of data if you give us access to your location. You can opt out of our access to this data at any time in the settings of your mobile device.

4. Purposes of use

MEDION uses the aforementioned categories of data:

Your personal data is processed in accordance with the provisions of the European Data Protection Regulation (DS-GVO) and the Federal Data Protection Act and also the state-specific regulations in North Rhine-Westphalia.

Your terminal-related data (smartphone/tablet) is processed in accordance with the provisions of the Telecommunications and Telemedia Data Protection Act (TTDSG).

Personal data is processed in the context of trade in products and services in the field of consumer electronics. The purposes of the data processing primarily depend on the specific product (e.g. physical or digital) and its application possibilities or also on the order placed with us (e.g. repair).

5. Customer account

In order to provide you with the greatest possible convenience when shopping, we offer you the permanent storage of your personal data in a password-protected MEDION customer account for online offers and selected apps from MEDION. If you already have an account for an online offer at MEDION, the master data stored there will be transferred to your MEDION customer account. From now on, your MEDION customer account can be used to place orders in MEDION's online offers and to use selected MEDION apps without having to register separately or provide detailed user data again. In addition, you can view and change certain data stored about you in your customer account in the web shop at any time and, for example, permanently save items for a later purchase.

In addition to the data requested when placing an order, you must enter a password of your choice to set up a customer account. This is used together with your e-mail address to access your MEDION customer account. The legal basis for this is Article 6 (1) b) DS-GVO, i.e. you provide us with the data on the basis of the contractual relationship between you and us. Your data will be passed on to the operator of the respective offer for the purpose of processing purchase contracts or other services that have been commissioned via the offers included by MEDION. The latter receives the data required for the provision of the service ordered in each case, i.e. verification of the log-in data (e-mail address, password, telephone number if applicable). We generally exclude any further disclosure of this data to third parties.

If you request the deletion of the MEDION customer account - this option is available in the profile settings of the app - your data will be deleted accordingly. The processing and storage of data is also the responsibility of the respective operator of the service used, who uses the data required to provide the service ordered for this purpose and then archives it in accordance with the statutory retention periods.

7. Transmission or disclosure of your data to third parties

MEDION works with various service providers to provide the app and the services offered via it. Insofar as MEDION has obligated these service providers to process data strictly in accordance with instructions, data processing by these service providers does not require your consent. Service providers that we use as processors:

We only transfer your data to other recipients if this is necessary to fulfil a contract with you or between you and the third-party provider, we or the recipient have a legitimate interest in the transfer of your data or your consent to the transfer has been given. These recipients include the service providers mentioned above. In addition, data may be transferred to other recipients where we are required to do so by law or by enforceable governmental or court order.

Other recipients of your data include, in particular, service providers whose offers and services (third-party services) MEDION mediates within the scope of the app or enables access to such services.

Data is only transferred to countries outside the European Union (so-called third countries) if this is necessary to execute your orders, if it is required by law or if you have given us your consent. MEDION does not transfer any personal data to third countries or international organisations. However, MEDION uses service providers for certain orders (see above), who in turn use service providers that may have their registered office, parent company or data centres in a third country. According to Art. 45 DS-GVO, the transfer is permitted if the European Commission has decided that an adequate level of protection exists in a third country. If such a decision has not been made, MEDION or the service provider may only transfer personal data to a third country or to an international organisation if appropriate safeguards are provided (e.g. standard data protection clauses adopted by the Commission or the supervisory authority in a specific procedure) and enforceable rights and effective remedies are available. MEDION has agreed contracts with these service providers on so-called commissioned processing, which regulate that bases for data protection are always concluded with their contractual partners in compliance with the European level of data protection.

8. Rule storage periods

MEDION processes and stores your personal data for as long as is necessary for the fulfilment of our contractual and legal obligations. If the data is no longer required for the fulfilment of contractual or legal obligations, it is regularly deleted, unless its temporary further processing is necessary for the following purposes: preservation of evidence within the framework of the statutory limitation provisions.

According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods can be up to 30 years, with the regular limitation period being 3 years. Furthermore, this includes the fulfilment of retention obligations under commercial and tax law according to the German Commercial Code (HGB) or the German Fiscal Code (AO).

The periods for retention or documentation specified in the laws listed above range from 2 to 10 years.

Subject to deviating statutory provisions, the following standard storage periods shall apply:

  1. Single sign-in: If deletion of the central login is intended, an e-mail must be sent to datenschutz@medion.com. According to BDSG §39, MEDION is obliged to keep data for up to ten years. For this reason, only a reservation for deletion is possible.
  2. User master data: see a
  3. Appliance master data: Unassignment to the user account with removal of the home appliance from the user account.
  4. Device usage data: Storage in personal form for a period of one year. After that, the data is deleted.
  5. App usage data: storage in pseudonymous form and provision in personalised form for services/messages provided via the app, insofar as the "Allow tracking of usage data" function is activated for seven days.

10. Data security

We use technical and organisational measures to protect your data from manipulation, loss and unauthorised access by third parties, for example. These measures include the use of encryption technology, certificates, the use of a firewall on the MEDION Device Cloud and password protection of the MEDION app. We continuously review and improve our security measures in line with technological progress.

11 Scope of the information on data protection

This information on data protection applies to the services offered by MEDION via the App. Insofar as additional functions, benefits or services are offered by MEDION within the app, special information on data protection will be provided for these, insofar as their use is subject to special data protection regulations.

However, this information on data protection does not apply to third-party services (in the context of the app, this concerns Amazon Alexa and Google Assistant), even if MEDION App arranges the use of or access to these third-party services in the context of the app (for third-party services, see also the terms of use). In this case, the respective data protection provisions of the service provider apply to the use of these third-party services.

In the event of onward transfer to another service provider, MEDION shall make reasonable and appropriate efforts to identify the fact of onward transfer (e.g. when embedding the content of the service provider within the app through inline frames), insofar as the onward transfer is not obvious. Obviousness is given, for example, if a link is used to leave the MEDION App and the App or website is opened in a separate session.

If you are a user within the scope of the GDPR, please note that the use of third-party services may result in your personal data being processed in countries outside the scope of the GDPR. Please refer to the data protection information of the respective third-party service provider.

12. Amendment of the information on data protection

In the course of further development of the app - including due to the implementation of new technologies or the introduction of new services - it may become necessary to adapt this information on data protection. MEDION reserves the right to change or supplement this information as necessary. MEDION will always store the current version of the information on data protection in the app so that you can inform yourself about the current version of the information at any time. You will be informed on the app side when new data protection provisions are published. If you do not agree to the updated version of the privacy policy, you will be logged in automatically and will not be able to use the app again until you have given your consent.

13. Rights and contact information

If, despite our efforts to ensure that the data is correct and up to date, incorrect information about you is stored, MEDION will correct this at your request. If you have given MEDION your consent to the collection, processing and use of your personal data, you may revoke this consent at any time with effect for the future. You can exercise the revocation by using the contact options mentioned in the app. Your personal data will be deleted if you revoke your consent to storage, if knowledge of the personal data is no longer required to fulfil the purpose for which it was stored, or if storage is inadmissible for other legal reasons. Please take into account that for technical or organisational reasons there may be an overlap between your revocation and the use of your data, e.g. in the context of a newsletter that has already been sent. Data that is required for billing and accounting purposes or is subject to the legal obligation to retain data is not affected by this.

If you have any questions about data protection or wish to exercise your rights under data protection law to withdraw consent, obtain information, correct, delete or block data, please contact us at datenschutz@medion.com.

14 Supplementary information according to the GDPR

  1. Legal basis for data processing
    The following data processing is based on:
  2. Your rights
  3. Disclosure of personal data to recipients outside the EEA
    If necessary for the provision of the functionalities of the app as well as the services offered via the app, MEDION also discloses personal data to recipients that are based outside the EEA in so-called third countries. In this case, MEDION ensures prior to the transfer that either an adequate level of data protection exists at the recipient (e.g. based on an adequacy decision of the EU Commission for the respective country or the agreement of so-called EU standard contractual clauses of the European Union with the recipient) or your consent to the transfer has been obtained.
    You can obtain from MEDION an overview of the recipients in third countries and a copy of the specifically agreed arrangements to ensure the appropriate level of data protection. To do so, use the contact details provided at the end of this information on data protection. Please also refer to section 7 for the transfer of personal data when using third-party services.

15. information about your right to object in accordance with Art. 21 of the General Data Protection Regulation (GDPR)

You may revoke your consent to the processing of personal data at any time by contacting MEDION. This also applies to the revocation of declarations of consent that were given to us before the applicability of the General Data Protection Regulation (GDPR), i.e. before 25 May 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.

Right to object on a case-by-case basis

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (e) DS-GVO (data processing in the public interest); this also applies to profiling based on this provision within the meaning of Art. 4 No. 4 DS-GVO. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Insofar as we base the processing of your personal data on the balance of interests, you can object to the processing. This is the case if the processing is in particular not necessary for the performance of a contract with you, which is shown by us in each case in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done.

In the event of your justified objection, we will examine the merits of the case and either discontinue or adapt the data processing or show you our compelling legitimate grounds on the basis of which we must continue the processing.

Right to object to the processing of data for direct marketing purposes In individual cases, we process your personal data for the purpose of direct marketing. You have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising; this also applies to profiling insofar as it is associated with such direct advertising. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

The objection can be made form-free and should preferably be addressed to: MEDION AG, Data Protection, Am Zehnthof 77, 45307 Essen, Germany

16 Responsible body

The responsible party is MEDION AG Am Zehnthof 77, 45307 Essen, Germany.

You can also reach the company data protection and the company data protection officer via the e-mail address

datenschutz@medion.com

Management Board of MEDION AG: Gerd Brachmann (Chairman),
Christian Eigen (Deputy Chairman)
Chairman of the Supervisory Board of MEDION AG: Dr. Rudolf Stützle
Headquarters of the Company: Essen AG Essen HRB 132 74