Privacy Policy App

If translations of these privacy policy or other contract-related declarations and documents are made into languages other than German („read versions“), only the German version shall prevail.

Welcome to TimeToFace. With our app we provide you with an application that you can download to your mobile device. The app sees itself as a social networking and dating portal with the goal of bringing people into personal contact in a simple and uncomplicated way. Data protection is a particularly high priority for us and we want you to feel safe while using our app.

In the following, we provide information about the collection of personal data when using our app as well as the type, scope and purpose of the information we collect, use and process. We reserve the right to change the privacy policy at any time with effect for the future. The current version of the privacy policy can be accessed, saved and printed out in our app at any time.

1. Name and address of the responsible person

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection regulations is:

TimeToFace GmbH, Laimgruber Straße 12, 83339 Chieming

Contact information:
Postal address: TimeToFace GmbH, Laimgruber Straße 12, 83339 Chieming
E-mail: privacy@timetoface.app

2. Data subject rights

You have the following rights with respect to us regarding personal data concerning you:

a. Right of access
You also have the right to receive from us at any time, free of charge, information about the personal data stored about you and a copy of this information. You also have a right of access regarding the following information:

• the purposes of processing,
• the categories of personal data processed,
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organizations,
• if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration,
• the existence of a right to obtain the rectification or erasure of personal data concerning them, or to obtain the restriction of processing by the controller, or a right to object to such processing,
• the existence of a right of appeal to a supervisory authority,
• if the personal data are not collected from the data subject: any available information on the origin of the data as well as,
• the existence of automated decision-making, including profiling, pursuant to Art. 22 para. 1 and para. 4 of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

Furthermore, you have a right to information as to whether personal data have been transferred to a third country or to an international organization. If this is the case, you also have the right to obtain information about the appropriate safeguards in connection with the transfer.

b. Right to rectification
You have the right to request the rectification and/or completion of inaccurate or incomplete personal data concerning you without undue delay. We shall carry out the rectification without undue delay.

c. Right to restriction of processing
You have the right to request us to restrict processing if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, the data subject objects to the erasure of the personal data and instead requests the restriction of the use of the personal data.
• The controller no longer needs the personal data for the purposes of the processing, but the data subject needs it for the establishment, exercise or defense of legal claims.
• The data subject has objected to the processing pursuant to Art. 21 para. 1 of the GDPR and it is not yet clear whether the legitimate grounds of the controller override those of the data subject.

If the processing of personal data concerning you has been restricted, such data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted.

d. Right to deletion
You have the right to request that we erase personal data concerning you without undue delay, provided that one of the following reasons applies and to the extent that the processing is not necessary:

• The personal data have been collected or otherwise processed for such purposes for which they are no longer necessary.
• The data subject revokes the consent on which the processing was based pursuant to Art. 6 para. 1 letter a of the GDPR or Art. 9 para. 2 letter a of the GDPR, and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing or the data subject objects to the processing pursuant to Art. 21 para. 2 GDPR .
• The personal data have been processed unlawfully.
• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
• The personal data has been collected in relation to information society services offered pursuant to Art. 8 para. 1 of the GDPR.

If the personal data have been made public by us and we as a controller are obliged to erase the personal data pursuant to Art. 17 para. 1 of the GDPR, we shall, taking into account the available technology and the cost of implementation, implement reasonable measures, including those of a technical nature, to inform other data controllers which process the published personal data, that the data subject has requested from those other data controllers the erasure of all links to such personal data, or to copies or replications of such personal data, unless the processing is necessary.

The right to erasure does not apply to the extent that processing is necessary:

• for the exercise of the right to freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the field of public health pursuant to Art. 9 para. 2 lit. h and lit. i and Art. 9 para. 3 of the GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89 para. 1 of the GDPR, insofar as the right referred to in Section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing, or
• for the assertion, exercise or defense of legal claims.

e. Right to information
If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right against us to be informed about these recipients.

f. Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, common and machine-readable format. You also have the right to transfer this data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Art. 6 para. 1 lit. a of the GDPR or Art. 9 para. 2 lit. a of the GDPR or on a contract pursuant to Art. 6 para. 1 lit. b of the GDPR and the processing is carried out with the aid of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20 para. 1 of the GDPR, you have the right to obtain that the personal data be transferred directly from us to another controller, to the extent that this is technically feasible and provided that this does not adversely affect the rights and freedoms of other persons.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

g. Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 para. 1 lit. e or lit. f GDPR. This also applies to profiling based on these provisions.

We no longer process the personal data in the event of objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.

You also have the right to object, on grounds relating to your particular situation, to processing of your personal data which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 para. 1 GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

To exercise the right of objection, you may contact us at any time. You are also free, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

h. Right to withdraw consent under data protection law
You have the right to revoke your consent to the processing of personal data at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation

i. Right to automated decisions in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, provided that the decision

• is not necessary for the conclusion or performance of a contract between you and us, or
• is permitted by legislation of the Union or the Member States to which we are subject and that legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
• is done with your express consent.

If the decision

• necessary for the conclusion or performance of a contract between you and us or
• it is done with your express consent,

we shall take reasonable steps to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain the intervention of a person on our part, to express our own point of view and to contest the decision.

j. Existence of automated decision making
We do not perform automated decision making or profiling.

k. Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been submitted will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Königstraße 10 a, 70173 Stuttgart.

3. Data processing when downloading the app

If you download our app from an app store, the information required for this purpose is transferred to the respective operator of the app store (e.g. Apple or Google) during this process, i.e. in particular user name, e-mail address and user ID of your app store operator, time of download, payment information and the individual device identification number. This data collection and processing is carried out by the respective app store operator, over which we have no influence. For more information about the providers and their data processing, please refer to the respective privacy policy.

4. Access data in server log files and databases

When using the app proactively, during registration, login, single sign-in, request email verification link, update email as well as when requesting a new password, we store the access data generated in the process in so-called server log files and partly in databases. This includes date and time of the retrieval, amount of data transferred, location and IP address.

Legal basis for the temporary storage of your data and the log files is Art. 6 para. 1 lit. b GDPR.

This data is evaluated exclusively to ensure the permanent and trouble-free operation of the app and to ensure the proper functionality of the app, as well as for transmission to law enforcement authorities in the event of a cyber attack and ensuring the security of our information technology systems. An evaluation of your data for marketing purposes does not take place in this context.

The collection of data for the provision of the app and the storage of data in log files is mandatory for the operation of our app. Consequently, there is no possibility to object.

5. Data processing to operate the app

If you open a user account via the App, we process the data required for this purpose as well as for the operation of the App, such as the selected user name, email address, search criteria, gender, date of birth, photo, IP address, login data, chat content, as well as such data that was either automatically stored via the single sign-on procedure (in particular name, date of birth, photo, gender and email address) in accordance with section 10 or manually stored in the profile, such as, for example. Search attributes, height, build, search radius, interests, hobbies, favorite vacation countries, etc. The data processed in this way can be adjusted and changed by the user at any time via the profile settings. Excluded from this is the information on the date of birth, and gender.

The legal basis for the processing of personal data is Art. 6 para. 1 lit. b GDPR.

The data will be deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. This is the case for the data collected during the registration process when the user account is deleted.

6. Data processing for proximity search

In order to offer our users the most relevant recommendations possible for other user profiles and to improve the functionalities of our app, we process the location data of the respective user on the basis of Art. 6 para. 1 lit. a GDPR. If the user consents to this processing by activating the location service, the location data thus collected (longitude and latitude) or the desired location selected by the user is periodically transmitted to our servers and processed there.

The user can object to this data processing at any time for the future by deactivating this location service in the settings of their terminal device. For the smooth or unrestricted operation of the app, the collection of the current location data by activating the location service is absolutely necessary. Consequently, deactivating the location service may limit or completely cancel the functionality of the app.

7. Customer Support via Jira Help Desk

Customer satisfaction is particularly close to our hearts. For the efficient and optimized execution of our Customer Support, we therefore use the Atlassian Jira Service Desk, a service provided by Atlassian Pty Ltd, c/o Atlassian, Inc, 1098 Harrison Street, San Francisco, CA 94103, USA. This allows for faster and better resolution of inquiries. If you contact our support, e.g. by e-mail, the data entered as well as name and e-mail address are processed via a server of the provider and stored there. Atlassian is certified according to the Privacy Shield Framework and thus meets the European standards for legally compliant commissioned data processing.

The legal basis for this data processing is Art. 6 para. 1 lit. b GDPR.

Further information and data protection with the provider can be found in their privacy policy.

8. Newsletter

You can sign up to receive our newsletter. To register, you must provide us with your e-mail address, name and the terminal device used. The registration takes place in a so-called double opt-in process. After registration on our app, we send a confirmation e-mail via the service provider mentioned in item 9, in which you must confirm the registration again. This entire process is documented and stored. This includes both the storage of the registration and confirmation time, as well as your IP address. The collection of this data is necessary so that we can trace and explain the processes in the event of misuse of the e-mail address and therefore serves our legal protection. By subscribing to our newsletter, you agree to receive it. The legal basis for the processing of your data after subscription to the newsletter is Art. 6 para. 1 lit. a GDPR.

You can revoke your consent to the storage and use of your personal data to receive the newsletter and the previously described statistical collection at any time with effect for the future. For the purpose of revoking consent, you can use the link provided for this purpose in the newsletter.

Your data will be deleted as soon as they are no longer necessary to achieve the purpose of their collection. Accordingly, your e-mail address will be stored as long as the subscription to the newsletter is active.

9. Newsletter sending via Mailchimp

For the optimized processing of our newsletter dispatch, we use the dispatch tool MailChimp, a service of the list provider The Rocket Science Group, LLC, 512 Means St., Suite 404 Atlanta, GA 30318, USA. If you have effectively subscribed to our newsletter as described in section 8, or you have expressly requested or consented to receive it by accepting the T&Cs, then the data required for this purpose will be processed via MailChimp's servers and stored there, so in particular name, email address, device manufacturer, language and data on interactions with emails from TTF. Mailchimp is certified under the Privacy Shield Framework and thus meets the European standards for legally compliant commissioned data processing. Additional information about MailChimp and data protection at MailChimp can be found in the Data Protection Statement of the provider as well as in the further explanations about the GDPR. If you have any questions about MailChimp's data processing, you can also contact MailChimp's data protection officer directly at privacy@mailchimp.com. You can revoke this processing at any time with effect for the future. To do this, either use the unsubscribe button implemented in the respective newsletter or send us a short note by e-mail to the e-mail address specified under 1.

The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR, whereby the optimization of our campaigns is our legitimate interest.

10. Automatic emails

TTF informs its users by emails about user-specific information in particular tips & tricks, news, special offers.

You can revoke this processing at any time with effect for the future. To do so, either use the unsubscribe button implemented in the respective email by deactivating the „Team TimeToFace“ function in the app under „App Settings“ and „Notifications“ or send us a short note by email to the email address specified under 1.
. This option does not apply to emails that are not primarily for advertising. This includes emails about contracts, support, or other administrative or transactional notices.

11. Data processing when using single sign-on procedures

In order to facilitate the registration process for our users, they are offered the option of opening a user account via an existing account with a third-party provider. If a user decides to use this registration method, the first step is to be redirected directly to the selected third-party provider. There, the user is requested by the respective third party provider to enter the access data in order to log in or register with the respective service. If the user is already logged in to the third-party provider with the end device at this point, this login prompt is skipped. You can recognize the login options in the app by the integrated logos of the respective third-party provider. Currently, we offer the option to register via an existing account of the following third-party providers:

• Facebook Connect: The user can register with his existing Facebook account. Facebook is a social network of the company Facebook Ireland Limited, Hanover Reach, 5-7 Hanover Quay, Dublin 2 Ireland. The Privacy and Terms of Use of the social network apply to the registration to and use of Facebook.
• Google Sign-In: The user can register with his existing Google account. Google is operated by the company Google Inc, Amphitheatre Parkway, Mountain View, CA 94043, USA. Google's Privacy Policy and Terms of Use apply to the registration and use of Google's services.
• Sign in with Apple: The user can register with his existing Apple account or Apple ID. This service is operated by Apple Inc, Infinite Loop, Cupertino, CA 95014, USA. Apple's privacy policy applies to the registration and use of Apple's services.

If you use the option to register via one of the third-party providers, the app communicates with the servers of the respective provider, whereby the data required for the user account opening and deposited with the third-party provider is read and linked to the user account, so in particular name, profile picture, date of birth, e-mail address and gender.

Legal basis for this data processing is Art. 6 para. 1 lit. b GDPR.

12. Chat function via Google Firebase

In order to provide our app along with all functionalities, in particular the chat function, we use the technology of Google Firebase, a service of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as „Firebase“). Firebase is part of the Google Cloud Platform and offers numerous services for developers. A listing of these can be found here: https://firebase.google.com/terms/. Firebase provides a Firebase real-time database where we store user and chat data. Here, user data is transmitted to Firebase in order to use the database.

The processing of the data is based on Art. 6 para. p. 1 lit. b GDPR, as the functions can only be guaranteed via Firebase.

The data processed by Firebase may be processed via servers outside of Europe, for example from the USA. We have concluded a contract with Google for commissioned processing in accordance with Art. 28 GDPR, in which Google undertakes to process the data received only in accordance with our instructions and to comply with the EU level of data protection. Further information on data protection in connection with Google Firebase can be found at: https://www.firebase.com/terms/privacy-policy.html.

For Firebase, Google uses the advertising ID of the mobile device in addition to the „instance ID“ described above. In the device settings of your mobile device, you can restrict the use of the advertising ID by changing your menu settings as follows:

- For Android: Settings→Google →Advertisements →Reset Advertising ID
- For iOS: Settings→Privacy→Advertising→ Restrict ad tracking

13. Google Firebase Analytics

To measure the installations of our app, we use on the basis of Art. 6 para. p. 1 lit. f GDPR the Firebase real-time database, a technology of Google Firebase (see above), which stores the number of installations as well as automatically recorded events. The collection of this technical data is to be recognized as our legitimate interest. In this data processing, user data is transmitted to Firebase in order to be able to use the database. This data is not personal to us. Nevertheless, we would like to inform you about this data collection below.

If you have a smartphone with iOS operating system, you can prevent the collection by disabling the „Additional analysis“ function under „App settings“ and „Privacy“.

Otherwise, the Terms of Use and Privacy Policy of Google and Google Firebase Analytics apply. For more information on data processing for automatically collected events, please see You can find here.

14. Amplitude

For the purpose of continuous optimization and needs-based design of our app, we use the analysis tool Amplitude of Amplitude Analytics Inc, 501 2nd Street Suite 100, San Francisco, California 94107, USA („Amplitude“). The tool helps us to better understand the usage behavior of our users and to gain insights for further optimization needs. For this purpose, we use the Amplitude library, which processes the following data in particular, such as device information (ID, type, brand, operating system), the IP address of the device used, provider name (e.g. Vodafone), region of origin such as country and/or city, interactions with the app, version status and language used. Gender. Usage profiles can be created from the data processed in this way, which we use exclusively for the aforementioned purposes. Amplitude is certified under the Privacy Shield Framework and thus complies with European standards for lawful commissioned data processing.

The legal basis for the processing of personal data is Art. 6 para. 1 lit. a GDPR.

You can revoke your consent to this data processing at any time with effect by selecting the „Deactivate analysis at any time“ function via „App settings“ and „Privacy“.

Additional information on data processing by Amplitude can be found in the privacy policy of the provider If you have any questions, you can also contact Amplitude's data protection officer directly at contact@amplitude.com.

15. Data security

We secure our app and other systems through numerous technical and organizational measures against loss, destruction, access, modification or distribution of your data by unauthorized persons. To this end, we continuously update the firewalls we use, the encryption procedures and our security systems. Despite regular checks, complete protection against all threats is nevertheless not possible and cannot be guaranteed by us.

16. Data deletion

Your personal data will be deleted or blocked as soon as the purpose of storage ceases to apply or you revoke your consent. In addition, storage may take place if this has been provided for by the European or national legislator in Union regulations, laws or other regulations to which the controller is subject. If the purpose of storage ceases to apply, if you revoke your consent or if a storage period prescribed by the European Directive and Regulation or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions, unless there is a need for further storage of the data for the conclusion or performance of a contract.

17. Legal or contractual requirements to provide the personal data; necessity for the conclusion of the contract; obligation of the data subject to provide the personal data; possible consequences of non-provision

We inform you that the provision of personal data is sometimes required by law (e.g. tax regulations) or may also result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary for the conclusion of a contract that you provide us with personal data, which must subsequently be processed by us. For example, you are obliged to provide us with your personal data if you conclude a contract with us. Failure to provide your personal data would mean that the contract with you could not be concluded.

LAST UPDATED: January 2021