Echometer App Privacy Policy

Echometer is a browser-based online tool (hereinafter also referred to as "Service" or "Echometer Tool") that supports organizations in implementing a healthy feedback culture by initiating and accompanying a continuous improvement process through team retrospectives.

Our privacy policy explains in detail which personal data is processed in connection with the use of our service via  my.echometerapp.com and in what way.

Responsible within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) for the processing of personal data is

Echometer GmbH
Tondernstraße 1
48149 Münster
E-mail:  info[at]echometer.de

We process personal data only if this is permitted by law. Personal data will only be disclosed to recipients that we expressly designate in this privacy policy.

As soon as the purpose of the processing no longer applies, personal data will be deleted or blocked for further use by technical and organizational measures. This also takes place if a prescribed storage period expires, unless there is a need for further storage of the personal data for the conclusion or fulfillment of a contract.

Unless we are legally obliged to store it for a longer period or to pass it on to third parties (in particular law enforcement authorities), the decision as to which personal data is collected by us, how long it is stored and to what extent you may have to disclose it depends on which functions of our website or our service are used in individual cases.

Links on our websites and in our services may lead to other websites and services that are not operated by us but by third parties. Such links are either clearly marked by us or are recognizable by a change in the address bar of the browser. We are not responsible for compliance with data protection regulations and the secure handling of personal data on these websites and services operated by third parties.

This privacy policy uses the terms of the legal text of the GDPR. The definitions (Art. 4 GDPR) can be found, for example, at https://dejure.org/gesetze/DSGVO/4.html.

We collect different types of data during your use of our website and service.

The first type is data that you provide to us directly and consciously. This includes the information you enter when creating an account for the Service (name, email address, and password) as well as data that you create while using the Service, such as feedbacks, interactions in the retrospective, created measures, etc. This data belongs to you. Echometer may use the email address and name to contact them directly for the purposes of troubleshooting, sales contact, feedback collection and proactive support.

The second type is data that we collect automatically while you use our website and services. This data is used only to operate and improve our service. This is also our legitimate interest, which is why the processing is permitted under Art. 6 para. 1 letter f GDPR.

By using our service, you grant us permission to store this data and process it within the framework of this privacy policy. You may decide at any time to withdraw this consent, which may, however, reduce or even prevent the usability of our service for you.

In accordance with the European GDPR according to chapter 3, the following "rights of data subjects" apply:

Data subjects have the right...

• to information about data processing pursuant to Art. 15 GDPR
• to rectification of data pursuant to Art. 16 GDPR
• to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR
• to erasure (also known as "right to be forgotten") pursuant to Art. 17 GDPR
• to restriction of processing pursuant to Art. 17 GDPR
• to data portability pursuant to Art. 20 GDPR
• To object to the processing, provided that it takes place on the basis of Art. 6 para. 1 letter e or f GDPR.

Our privacy policy may change. Updates will be made available directly on this page. In the event of significant changes, we will also inform you on the login screen or by e-mail. If data subjects do not agree with future changes to this privacy policy, they must discontinue using our services and delete their account. We are obliged to inform data subjects about the rectification or erasure of personal data or the restriction of processing.

Cookies are text files that are stored or read out by a website on end devices. They contain combinations of letters and numbers in order to, for example, recognize the person concerned when reconnecting to the cookie-setting website, restore the previous settings, enable the person to remain logged in to a customer account, or statistically analyze a certain user behavior.

We use cookies to:

• Save preferences for our website
• Save login status

If you have any questions about our privacy policy, security measures, or to exercise your rights as a data subject, please contact us via email at [email protected].

Telekom Deutschland GmbH

We use the Telekom Open Cloud for our app, which is provided by:

Telekom Deutschland GmbH, Landgrabenweg 151, 53227 Bonn

Data Protection Officer: Mr. Dr. Claus D. Ulmer, Friedrich-Ebert-Allee 140, 53113 Bonn, [email protected]

The Open Telekom Cloud offers Infrastructure as a Service from German high-security data centers.

Purposes of processing

Provision of the hosting infrastructure in which Echometer runs.

Legal basis

Performance of a contract pursuant to Art. 6 para. 1 letter b GDPR.

Recipient / Categories of recipients

The recipient of the collected data is Telekom Deutschland GmbH.

Transfer to third countries

There is no transfer to third countries.

PostHog

We use the product analytics tool "PostHog" in our app, which is provided by:

PostHog Inc, 2261 Market Street #4008, San Francisco, CA 94114

Data Protection Officer: Charles Cook (VP Operations), [email protected]

PostHog is a product development and analysis platform that enables new features to be rolled out sequentially as part of release management, ensuring their stability and analyzing their use. Session replays are created to analyze usage behavior without tracking user input. Data is also processed for support and analysis purposes.

Purposes of processing

PostHog is used for release management, product support and product analysis purposes.

Legal basis

The purposes described constitute a legitimate interest within the meaning of Art. 6 para. 1 letter f GDPR.

Recipient / Categories of recipients

The recipient of the collected data is PostHog Inc., whereby Echometer exclusively uses EU hosting.

Transfer to third countries

There is no transfer to third countries.

You can register for our service with your Google account. Registration takes place via a redirect to the Google website (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), where you can log in with your login details.

Scope of the processing of personal data: When you register via your Google account, your Google profile is linked to our service. We would like to point out that we have no influence on the processing of data at Google. Please note that you may have to explicitly log out of your Google account again after the transfer process. We receive the following information from Google: Name, first name and email address. We use the following information provided to us by Google: Name and email address. This information is mandatory for login in order to be able to identify you. For further information about Google, please refer to Google's data protection information and terms of use.

Legal basis for the processing of personal data: The legal basis for the processing of personal data using your Google account is Art. 6 para. 1 lit. f GDPR.

Purpose of data processing: Google is used for the purpose of making logging into our product as pleasant as possible for you.

Storage period: Data transmitted as part of registration via Google will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of storage of data in log files, this is the case after 14 days at the latest. Storage for a longer period is possible. In this case, the IP addresses of the users are deleted or alienated, so that it is no longer possible to assign the calling client.

Possibility of objection and removal: As a user, you have the option of canceling your registration at any time. You can have the data stored about you changed at any time.

As part of your registration, you can agree to receive extended product communications. This communication is handled via the CRM tool HubSpot, which is provided by:

HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 United States

Data Protection Officer: Nicholas Knoop, Data Protection Officer

Purposes of processing

HubSpot is used for the purposes of individualized customer communication and for the purposes of market research.

Legal basis

The purposes described constitute a legitimate interest within the meaning of Art. 6 para. 1 letter f GDPR.

Recipient / Categories of recipients

The recipient of the collected data is HubSpot Inc.

Transfer to third countries

The data is transferred to HubSpot Inc. in accordance with HubSpot's Data Processing Agreement.

Users can unsubscribe from this optional communication at any time by clicking on the "Unsubscribe" button in the product emails.

In some places, Echometer offers AI-supported functions. These functions are provided through an integration with OpenAI Ireland Ltd (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, [email protected]).

These functions explicitly state that certain inputs and data are processed by OpenAI. No further data is transmitted to OpenAI beyond these inputs and data.

All AI-supported functions in Echometer are optional and each require explicit activation and consent.

Purposes of processing

Provision of AI-supported functions at the request of a user

Legal basis

The purposes described constitute the performance of a contract with the consent of the data subject within the meaning of Art. 6 para. 1 letter a and b GDPR.

Recipients and transfer to third countries

The data is processed in the USA in accordance with OpenAI's Data Processing Addendum (see https://openai.com/policies/data-processing-addendum). More information about processing can be found in the OpenAI Privacy Policy: https://openai.com/policies/privacy-policy

There are several ways to become an Echometer customer. As part of the self-checkout process, the service provider Stripe is used, among other things. Stripe is provided by:

Stripe Inc., Corporation Trust Center, 1209 Orange Street, Wilmington, New Castle, DE 19801, USA

Data Protection Officer: [email protected], Privacy: [email protected]

Purposes of processing

Stripe is used for the purposes of processing the purchase process and billing.

Legal basis

The purposes described constitute the fulfillment of a contract with the consent of the data subject within the meaning of Art. 6 para. 1 lit. a and b GDPR.

Recipient / categories of recipients

The recipient of the data collected is Stripe Inc.

Transfer to third countries

The data is processed in accordance with Stripe's data processing agreement (see Stripe Data Processing Agreement).

There are several ways to become a customer of Echometer. As part of the self-checkout process, the service provider Paddle is used, among other things. Paddle is provided by:

Paddle.com Market Limited, Judd House, 18-29, Mora Street, England, London, EC1V 8BT

Data Protection Officer: Michael Cox, [email protected]

Purposes of processing

Paddle is used for the purposes of processing the purchase process and billing.

Legal basis

The purposes described constitute the fulfillment of a contract with the consent of the data subject within the meaning of Art. 6 para. 1 lit. a and b GDPR.

Recipient / categories of recipients

The recipient of the data collected is Paddle.com Market Limited

Transfer to third countries

The data is processed in accordance with Paddle's data processing agreement (see Paddle Data Processing Addendum).

The extended product communication with users of the free Echometer version is partially handled via the MixMax tool, which is provided by:

Mixmax Inc., 548 Market Street, PMB 60764, San Francisco, CA, 94104-5401, United States

Data Protection Officer: Jonathan Grant, Data Protection Officer ([email protected])

Purposes of processing

Mixmax is used for the purposes of individualized user communication and for the purposes of market research.

Legal basis

The purposes described constitute a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

Recipient / categories of recipients

The recipient of the data collected is Mixmax Inc.

Transfer to third countries

The data is transferred to Mixmax Inc. in accordance with MixMax's Data Processing Agreement.

If data subjects use the paid version of the Echometer app, we process their data in addition to the information in this privacy policy on behalf of the owner of the Echometer workspace (usually the employer). This data processing is governed by the SaaS agreement and the data processing agreement signed between Echometer and the workspace owner.

In this context, Echometer acts only as a data processor, while the workspace owner acts as the data controller. For more information about this data processing, data subjects can therefore contact their workspace owner/employer, as they are the responsible party for the processing of data within the workspace.