Privacy Policy

1. Scope of the Privacy Policy
This privacy policy applies to the app for mobile operating systems and devices mentioned in the heading (hereinafter referred to as the "App"). It also covers the profile and networking functions MyStory and "About Me" offered in FOLW, as well as the creation, publication, finding, and replying to advertisements. It explains both the processing by Maisonpure GmbH and what information becomes accessible to other users within the scope of these functions. This policy explains the type, purpose, and scope of data collection during App use.

Please note that when downloading our App from an App Store, you must register or identify yourself with the respective App Store operator (e.g., via a Google or Apple ID). During the download, various personal data, such as your email address, username, your App Store account number, your unique device identifier, the time of download, and, if applicable, payment information, may be processed by the App Store operator. The privacy policies and terms of use of the App Store operators apply in this context and may differ from the data protection laws of the European Union. We have no control over these terms.

We reserve the right to amend this privacy policy at any time in accordance with legal requirements.

2. Responsible body
The responsible body for the data processing described in this privacy policy is:

Maisonpure GmbH
Bismarckstrasse 55
41747 Viersen

Email address: info@folw.eu
Telephone number: +49 (0) 2162 890 6554

Maisonpure GmbH is responsible for the processing of personal data insofar as it determines its own purposes and essential means, particularly in the management of user accounts, the operation of profile, network, and advertising functions, and the processing of reports of illegal content. Insofar as we process personal data within client projects exclusively on behalf of and according to the instructions of a client, this processing is governed by the data processing agreement concluded with the client. The client is responsible for the lawfulness of the processing initiated by the client and for the associated information provided to data subjects. Maisonpure GmbH's own legal obligations remain unaffected.

3. Purpose and Legal Basis of Data Processing
Unless otherwise specified in this Privacy Policy, we process your personal data in connection with your use of the app to provide its functionalities, ensure its security, or—where necessary and legally permissible—to contact you. The legal basis for this processing is Article 6(1)(b) GDPR (performance of a contract) and our legitimate interest in providing a functional app (Article 6(1)(f) GDPR). If your consent has been requested, processing is based solely on Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Data Protection Act (TDDDG); you may withdraw your consent at any time. Please see the following sections for further details.

4. Data categories processed
When you use this app, the following personal data about you will be processed:

Personal information:

• First and Last Name
• Username
• Profile picture
• Address
• E-mail address
• Telephone and mobile phone number

Contract details:

• Billing and contract data
• Payment details

Communication data:

• Chat histories
• Inquiries via email or contact form

Data generated within the app:

• Location data
• Photos, videos
• Uploads
• Weather data
• Usage data
• User input within the app (e.g. notes)

Technical information:

• IP addresses
• Metadata
• Device identifiers and device IDs
• Device number and device type
• Device type
• Operating system of the terminal device
• Device-specific app settings
• Date and time of app accesses
• Data volumes transferred
• Time zone

When using MyStory, "About Me," and ads, the following data may also be processed:

professional activities and experience
education
qualifications and uploaded credentials
references
project descriptions
skills
languages and language proficiency
professional availability
portfolio content
sharing and visibility settings
and ad content.

Ads may include information on:

job or service
requirements
location and radius
time period
employment or work model
skills
salary and weekly hours.

In addition

selected contact information
publication status
contact connections
and interactions

with content may be processed, provided the respective function is used.

This data is processed for the purpose of fulfilling the user agreement between us and the app users (Art. 6 para. 1 sentence 1 lit. b GDPR). With regard to voluntary information, data processing is additionally based on Art. 6 para. 1 sentence 1 lit. f GDPR. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. Consent can be withdrawn at any time.

5. Registration
You can register in the app. We use the data you enter for the purpose of providing the specific offer or service for which you registered. The mandatory information requested during registration must be provided in full. Otherwise, we will reject your registration. For important changes, such as changes to the scope of services or technically necessary modifications, we will use the contact information you provided during registration (e.g., email address) to inform you. The data entered during registration is processed for the purpose of fulfilling the user agreement established by the registration and, if applicable, for initiating further contracts (Art. 6 para. 1 lit. b GDPR). The data collected during registration will be stored by us for as long as you are registered on this app and will then be deleted. Statutory retention periods remain unaffected.

6. App access rights
To provide our services, the app requests the access rights listed below, which allow us to access certain functions of your device.

• Location data. Access is granted for the following purpose: weather data.

• Photos, videos, and files: selection and use of media for the functions you use, in particular profile pictures, portfolio, qualification certificates, and advertisements, as well as project and ticket content.

• Calendar. Access is granted for the following purpose: scheduling tickets.

• Camera: taking photos or videos that you wish to use in the selected function.

• Microphone. Access is granted for the following purpose: voice recordings for sending voice messages within tickets.

• Speech recognition. Access is granted for the following purpose: internationalization of the app.

Device permissions are requested for the respective function and can be changed in your device settings. Operating system permission does not replace any data protection consent that may be required. The legal basis for subsequent processing depends on the respective purpose. Unless the storage of or access to information on the device is absolutely necessary for an explicitly requested service and no other legal exception applies, this will only occur with your prior consent. Without the necessary device authorization, the function in question may be limited.

The legal basis for access is, firstly, Article 6(1)(b) GDPR (contract) and, secondly, your consent, which you gave during installation (Article 6(1)(a) GDPR). You can change the app's access permissions at any time and thereby withdraw your consent. In this case, however, the app or certain app functions may no longer work correctly.

7. Making contact
When you contact us (e.g., via contact form, email, telephone, fax, or any other channel), your inquiry, including all resulting personal data (e.g., name, inquiry), will be stored and processed by us for the purpose of handling your request. This data is processed on the basis of Article 6(1)(b) GDPR if your inquiry relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, processing is based on our legitimate interests (Article 6(1)(f) GDPR), as we have a legitimate interest in the efficient handling of inquiries addressed to us. The data you send us via contact request will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions – in particular, statutory retention periods – remain unaffected.

8. Interaction with other app users

8a. MyStory and professional self-portrayal

With MyStory and “About me” you can introduce yourself to other FOLW users. You decide which voluntary information you enter and which photos, videos or evidence you add. We process this content in order to save the profile you created, edit it and display it in accordance with your approval. To the extent that this is necessary for the profile function you have requested, processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR.

For the “About me” area, including portfolio and proof of qualifications, you can choose between the following recipient groups: “Nobody” means that other users cannot view this area; Your own access remains. “MyNet” also allows access for your confirmed mutual MyNet connections. Simply following or an open contact request is not enough. “Everyone” means all registered FOLW users, not the freely accessible Internet.

This setting does not apply to all information about your account. Your profile name, your profile picture, the number of your confirmed MyNet contacts and the number of your published offers and requests as well as your published advertisements can remain visible within the intended user group regardless of the visibility of “About me”. The visibility of the MyNet member list is set separately. Contact and message actions remain separate from the release of the Vita.

Please only publish personal information from third parties that you are authorized to disclose in references, project descriptions, images and evidence. Unnecessary information, especially private addresses, signatures or sensitive information in evidence, should be removed or obscured before uploading. Publication does not mean that FOLW has checked the content of the information or evidence.
The user agrees to the app's default setting of "Everyone" in the Vita sharing settings. Otherwise, they can change this manually before publishing their Vita.

8b. Release of contact details

In About Me, you can individually share your home phone number, mobile phone number and email address, as well as available company phone and company email details for viewing. These shares are not initially activated. A contact information will only be displayed in this area if both the visibility of “About me” allows access and the relevant contact information is released.

The voluntary disclosure of personal contact information is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR. You can revoke the respective release at any time in the contact settings. The lawfulness of the processing carried out up to that point remains unaffected. The processing of the same contact details for your user account or contract processing may continue regardless of this on a different legal basis explained in this declaration.

You make a separate selection for contact details in advertisements. A contact share in “About Me” is not an automatic share for ads and vice versa. Copies that have already been legally taken over by other users cannot be automatically recalled by changing your approval; Your legal rights remain.

Company information may only be released by authorized persons.Revocation must record FOLW's own delivery and copies; The copy notice does not release FOLW from its own deletion obligations.

8c. Advertisements and contact

You can create offers and requests in FOLW, for example for professional activities, construction services, projects or collaboration. We process the ad information and media you select in order to save the ad, display it according to your publication decision, make it discoverable in the ad search and enable you or an interested party to contact you. The legal basis is Article 6 Paragraph 1 Letter b GDPR, insofar as the processing is necessary for this.

Published advertisements are for [OPEN: specify final recipient group; intended version: registered FOLW users] visible. In particular, the title, description, activity or profession, requirements, skills, location, availability and other published advertisement information are used for the search. Telephone and email information that has not been released will not become public search characteristics.

You can separately select available company information, in particular company name, telephone number, email address and website, for display. Personal telephone and email information will only be published after approval has been given for this purpose; Article 6 Paragraph 1 Letter a GDPR applies to this voluntary disclosure. You can revoke the release by editing the ad. Drafts and disabled ads will not appear as published offers to other users.

If you respond to an ad, the messages you sent and any attached media will be accessible to the person you spoke to. A message is not sent just by opening the contact function. Section 8 also applies to messages. Deleting or deactivating an ad does not automatically delete a message history that has already been created.

8d. Interactions and Usage Statistics

FOLW processes views, likes, and saves for the content provided for this purpose. The visible view counter counts actual views; it may include repeated views by the same person and views made by the user. Therefore, it is not the same as the number of different users.

For view processing, an event identifier, an assignment to the content, the time, and a user assignment are processed. Events recorded offline are transmitted after the connection is restored. The normal counter display does not list individual viewers by name. However, the underlying events are not anonymous from the outset.

Likes and saved content serve the interaction and rediscover function you have selected; where necessary, Article 6 Paragraph 1 Letter b GDPR is the legal basis. For reach measurement, the following applies: Likes are required for the core functionality of the app (Article 6 Paragraph 1 Letter b GDPR). Personal view events from the Like counter are publicly displayed. If this function is enabled... If consent is not given, a separate written request is required.

Likes submitted by the user will be stored as long as necessary for the provision of the function, or until the user removes the like or a further legal obligation to retain the data exists.

None of the explicit analytics data may be replaced by a general formulation such as "legitimate interest and/or consent." Pure counting, analytics, and recommendations serve different purposes.

Chat functions

The app allows communication with other users. Data processing is carried out to enable communication between users. When you use the chat function, the message content, including all resulting personal data (e.g., name), is stored and processed by us. This data processing is based on Article 6(1)(b) GDPR if your request is related to the fulfillment of a contract or is necessary for carrying out pre-contractual measures. In all other cases, processing is based on your consent (Article 6(1)(a) GDPR) and/or on our legitimate interests (Article 6(1)(f) GDPR).

Reporting inappropriate content

If you report content or behavior to us, we will process the report, the content and account information required for review, and any contact information you may have provided. This is used to process the report, communicate the decision and enforce our usage rules. To the extent that we thereby fulfill legal obligations, Art. 6 Paragraph 1 Letter c GDPR is the legal basis; for further necessary measures to protect our users and our service Art. 6 Para. 1 Letter f GDPR.

The people entrusted with processing and, if necessary, service providers appointed for this purpose have access. Disclosure to affected users or authorities will only occur if there is a legal basis for this and the information is necessary. The identity of reporting individuals is not routinely published. Data on completed reports is checked within 24 hours.

9. Push-Benachrichtigungen
Diese App nutzt Google Firebase Cloud Messaging für den Versand von Push-Benachrichtigungen. Wenn Sie Push-Benachrichtigungen in unserer App aktivieren, wird Ihre IP-Adresse und Ihre Geräte-ID sowie die ggf. ausgewählten Themen an den AppStore-Betreiber übermittelt. Wenn Sie ein Android-Endgerät nutzen, erhalten Sie an-schließend Push-Benachrichtigungen über den bei Android integrierten Push-Dienst „Firebase Cloud Messaging“. Wenn Sie ein iOS-Endgerät nutzen, wird der Push-Auftrag an die Server von Apple weitergeleitet, die Ihnen Push-Benachrichtigungen über den Dienst „Apple Push Notification Services“ zukommen lassen. Rechtsgrundlage für die Datenverarbeitung und die Datenweitergabe ist Art. 6 Abs. 1 lit. b DSGVO (Vertragserfüllung).

10. Analysis and Tracking
When you access our app, your behavior may be statistically analyzed using certain analytics tools and evaluated for advertising purposes or to improve our services. We ensure compliance with legal data protection regulations when using such tools. When using external service providers, we ensure through appropriate contracts with them that data processing complies with German and European data protection standards.

We use the following tools to analyze user behavior:

Firebase Analytics: We use the external analytics service Firebase Analytics to optimally tailor our app to user interests. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Firebase Analytics allows us to analyze how our users interact with our app (e.g., average app usage, average sessions per user, button clicks, recognition of usage preferences) in order to track and understand user behavior across devices and thus optimize and improve the app's functionality accordingly. Furthermore, Firebase Analytics helps us identify and fix errors in the app's programming and prevent fraudulent activity within the app. For fraud prevention and statistical analysis purposes, Google processes device information such as the advertising ID (Apple's IDFA and Google's GAID) and the IP address of the device used, and provides us with anonymous statistics about interactions with our app. Details regarding Firebase's privacy policy can be found here: https://firebase.google.com/support/privacy. The legal basis for processing is Article 6(1)(f) GDPR. We have a legitimate interest in fraud prevention, IT security, the dynamic delivery of content, and the optimization of our app. If consent has been requested, the use of this service is based on your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time. Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/. The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF commits to complying with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

The interaction functions explained in Section 8d are to be distinguished from optional tools for analyzing app usage. Optional analysis tools that require consent will only be activated after your consent. You can revoke your consent at any time with future effect at www.folw.eu. The use of the independent app functions remains possible.

Firebase Crashlytics: This app uses Firebase Crashlytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Firebase Crashlytics is used to analyze malfunctions in mobile apps. In the event of malfunctions (e.g., crashes), reports about the malfunction are transmitted to Google in the USA. These reports may also contain personal data (e.g., IP addresses). Details on Firebase's privacy policy can be found here: https://firebase.google.com/support/privacy. The legal basis for processing is Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in a stable app. If consent has been requested, the use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. Consent can be revoked at any time. Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/. The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA designed to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF commits to adhering to these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

11. Recipients of personal data
Your personal data will be transmitted to the following recipients:

1) Hosting provider Maisonpure GmbH: The app itself is hosted by the provider of the app store from which you downloaded the app. The user data collected in the app (e.g., uploads) is stored by our hosting provider. A data processing agreement with the hosting provider is in place.

2) Google Cloud
We use Google Cloud. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google provides us with a comprehensive platform for cloud computing services through Google Cloud. The use of Google Cloud is based on our legitimate interest in ensuring the most error-free and secure provision of our website (Art. 6 para. 1 lit. f GDPR).
Data transfers to the USA are based on the EU Commission's Standard Contractual Clauses. Details can be found here: https://cloud.google.com/terms/eu-model-contract-clause
You can find more information about Google Cloud here: https://cloud.google.com/cdn/docs/overview?hl=de
The company is certified under the EU-US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA designed to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF commits to adhering to these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780
Order processing
We have concluded a data processing agreement (DPA) for the use of the aforementioned service. This is a legally required contract under data protection law, which ensures that the service provider processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

12. Data Transfer to Third Countries
We use tools from companies based in the USA or other third countries that do not offer adequate data protection. When these tools are active, your personal data may be transferred to and processed in these third countries. Please note that a level of data protection comparable to that of the EU cannot be guaranteed in these countries. For example, US companies are obligated to disclose personal data to security authorities without you, as the data subject, having any legal recourse. Therefore, it cannot be ruled out that US authorities (e.g., intelligence agencies) may process, analyze, and permanently store your data located on US servers for surveillance purposes. We have no control over these processing activities.

13. Encryption
This app uses encryption for security reasons and to protect the transmission of confidential content. This encryption prevents the data you transmit from being read by unauthorized third parties.

14. Storage period

We store personal data for as long as it is needed for the respective purpose or as long as there is a legal obligation to retain it. Simply logging out ends the session and is neither a termination of your user agreement nor an order to delete your account or all content.

You can remove profile information and uploaded portfolio or evidence content using the editing functions provided. You can deactivate an ad without deleting it. Deactivated ads are no longer accessible to other users as published ads and remain stored for your own management until you delete them or a specified storage period ends. We store drafts for up to 30 days after account deletion.

If content is initially moved to a trash can, it remains available there until it is restored and is not accessible to other users. Subsequently, the associated data and files that are no longer needed will be deleted from the active systems after 30 days of account deletion. Mere removal from visible view does not equate to permanent deletion.

When an account is deleted, the profile and network data and advertisements associated with the account are removed after 30 days. Conversations and data that have already taken place and that are part of a customer project are assessed separately according to their purpose, the rights of other parties involved and, if necessary, the instructions of the responsible customer. Further storage does not occur simply because data was previously published.

Data that is required to be retained by law and data that is required in a specific case to assert, exercise or defend legal claims will only be retained for these purposes and for the required period. Apply to the affected categories

Account data will be removed after 30 days of account deletion, likes, follows comments will be maintained for the purpose of general app operation, we will treat invoices and payment documents in accordance with §147 AO and § 257 HGB, server/log data must be treated for the purpose of system operation, misuse and security data in accordance with Art Account deletion removed immediately, support requests are handled in accordance with Art. 6 Para. 1,

Backup copies are cleaned within 14 days. During a restore, deletions that have already been initiated will be taken into account again.

15. Automated decision making
There is no automated decision making.

16. Your rights
Under the GDPR, you have the following data protection rights:

Right to information (Art. 15 GDPR): You have the right to request information about your personal data stored by us.

Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data.

Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data.

Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing of your personal data.

Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us, where the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) and the processing is carried out by automated means. Where technically feasible, you also have the right to have the personal data transmitted directly from us to another controller.

Right to withdraw your consent (Art. 7 para. 3 GDPR): If you have given your consent to the processing of your data, you have the right to withdraw it at any time with effect for the future.

Right to lodge a complaint (Art. 77 GDPR): If you believe that we are not complying with data protection regulations when processing your personal data, you have the right to lodge a complaint with a data protection authority.

In cases where data processing is carried out on the basis of Art. 6 para. 1 sentence 1 lit. e or f GDPR, you have the right to object to the data processing on grounds relating to your particular situation (right to object pursuant to Art. 21 GDPR).