Privacy Policy (Ledlenser Connect APP)

I. Controller name and address

The controller in the context of the General Data Protection Regulation and other national data protection laws of the member states and other data protection regulations is:

Ledlenser GmbH & Co. KG
Kronenstr. 5 – 7
42699 Solingen
Germany

Ledlenser Beteiligungs GmbH
Company headquarters: Solingen
Germany

ledlenser.com

II. Data protection officer name and address

The data protection officer for the controller is:

Christoph Strieder
Ahrstraße 1
42655 Solingen
Phone: +49 (0) 2123820860
[email protected]

III. General information about data processing

1. Scope of processing personal data

We generally only collect and use personal data of our users where required to provide a functional app and for our contents and services. Personal data of our users are only regularly collected with the consent of the user. An exception applies in cases where prior consent cannot be obtained for factual reasons and processing of data is permitted by law.

2. Legal basis for processing personal data

Where the consent of the data subject is obtained for processing, the legal basis is Article 6(1)(a) of the EU General Data Protection Regulation (GDPR).

Where processing of personal data is necessary for performance of contract with the data subject as the contracting party, the legal basis is Article 6(1)(b) GDPR. This also applies to processing necessary to take steps prior to entering into a contract.

Where processing personal data is necessary for compliance with a legal obligation to which we are subject, the legal basis is Article 6(1)(c) GDPR. Where processing is necessary in order to protect the vital interests of the data subject or of another natural person, the legal basis is Article 6(1)(d) GDPR.

Where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, the legal basis is Article 6(1)(f) GDPR.

3. Erasure of data and storage period

The personal data of the data subject are erased or blocked when the purpose for which they were stored no longer exists.

They may be stored longer where required by European or national laws in EU directives, laws or other provisions to which the controller is subject. The data will further be blocked or erased upon expiration of the retention period required under the aforementioned standards unless further storage is necessary for conclusion or performance of contract.

4. Categories of recipients

Recipients of the personal data processed through our app are generally, unless otherwise specified, the controller or the controlling company (see point I of this privacy policy). The data are generally not transferred to third parties. However, any transfer to third parties is carried out in compliance with the provisions of the GDPR and the Federal Data Protection Act and other possible data protection regulations, if and when required under the contract concluded through our website (e.g. In-app purchases, where In-app purchases are offered), where required by law, in compliance with the requirements under the respective law and, where appropriate, weighing the interests of the parties involved. This can be the case e.g. due to criminal investigations. Such transfer also applies with your legally effective consent.

When downloading our app, information is also transferred to the respective operator of the App-Store (Google LLC /Apple). This is carried out in accordance with the respective privacy policies of the shop operator, who will then receive the user name, email address and account number of your App-Store account. Depending on the functionality of the operating system used for our app, data may also be transferred to the respective operator of the operating system when using our app. We have no access to these data.

IV. Provision of the app and creation of log files

1. Description and scope of data processing

Our app may have the option to use certain automatic functions to control our flashlights via daylight-controlled functions. When activating this option, we will process location data (geo locations) provided by the device you are using. These data are solely stored on the respective device. We are unable to access them.

3. Legal basis for data processing

The legal basis for processing geo location data by the user with the consent of the user is Article 6(1)(a) GDPR

4. Purpose of data processing

Geo location data are solely used to provide certain functions related to local use of the device.

5. Retention period

Data related to use of the app are solely stored on your device. The data are erased when our app is deleted from the respective device.

6. Right to object and erasure

You can disable the function based on which our app accesses geo data of your device via the settings of your operation system and/or our app and thereby stop data collection by our app and prevent future collection.

V. Registration

1. Description and scope of data processing

We provide users of our app the option to register their product on our website, at https://www.ledlenserusa.com/ll-register.html. This link is built into our app, and the website can be accessed from the app on your device. When registering a product, data are entered into the form, transmitted to us and stored. The data are not transferred to third parties.

The following data are collected during registration:

• The IP address of the user 
• Data and time registered 
• When registering a product: First name, last name, address, email address, gender, serial number of products purchased, retailer name, purchase date, and optionally the birth date of the person registering the product, subscribing to the Newsletter, and the option to provide information related to a manufacturer product survey (interview registration).

VI. Email contact

1. Description and scope of data processing

Our app includes an email address to contact us electronically. When using this address, we store the personal data of the user transmitted in the email.

These data are not transferred to third parties. The data are solely used to process the communication.

2. Legal basis for data processing

The legal basis for processing the data with the consent of the user is Article 6(1)(a) GDPR. The legal basis for processing data transmitted when emailing us is Article 6(1)(f) GDPR. If the purpose of contacting us via email is to enter into a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

3. Purpose of data processing

We solely process the personal data from the form to process your inquiry. When contacting us by email, this also constitutes the legitimate interest in processing the data.

Other personal data processed upon sending are used to prevent misuse of the contact form and safeguard the security of our information technology systems.

4. Retention period

The data are erased when they are no longer necessary for the purpose for which they were collected. For personal data from the entry mask of the contact form and those transmitted via email, this is the case when the respective conversation with the user has ended. The conversation has ended if circumstances indicate the respective issue has been resolved.

Additional personal data collected during the send process are erased after no more than seven days.

5. Right to object and erasure

The user may at any time revoke his/her consent to processing personal data. The user may email us at any time to object to his/her personal data being stored. In this case communication cannot be continued. All personal data stored in connection with contacting us will then be erased unless storage is required by legal provisions, e.g. under commercial code or revenue code or other legal justification under data protection regulations after weighing all interests.

VII. Permissions

1. Scope of processing personal data

In individual cases and depending on the operating system used (Android/IOS), the app allows access to functions and data stored on your respective device. During installation, your consent to access such functions/data is prompted, which are only accessed if you approve access during installation. Depending on the functionality of the operating system used to launch our app, you may also approve or limit access later. For details, please refer to the manufacturer of the operating system or the hardware used to launch our app. In some cases, limiting access to functions/data on your device may also limit use of our app.

The following permissions will be promoted:

Permission

Purpose

Location

Allocation of country-specific error messages

WiFi, Bluetooth, NFC

or network connections

Connecting to the flashlight

Before using the app for the first time, the following permissions will be prompted on iOS:

Permission

Purpose

Location

Allocation of country-specific error messages

Please note: In line with the terms of use of your smartphone or the respective operating system your smartphone uses to operate it, the respective provider (Apple Inc. or Google LLC) may collect, process and use data. Therefore please note the respective privacy policies/settings of the provider.

VIII. Rights of the data subject

When your personal data are processed, you are the data subject as defined by the GDPR and you have the following rights with the controller:

1. Right of access

You have the right to obtain from the controller confirmation as to whether or not your personal data are being processed by us.

Where that is the case, you have the right to obtain access from the controller to the following information:

(1) the purposes for which personal data are processed;

(2) the categories of personal data concerned;

(3) the recipients or categories of recipients to whom your personal data have been or will be disclosed;

(4) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(5) the existence of the right to request from the controller rectification or erasure of personal data concerning you or restriction of processing of personal data by the controller or to object to such processing;

(6) the right to lodge a complaint with a supervisory authority;

(7) where the personal data are not collected from the data subject, any available information as to their source;

(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to obtain information whether personal data are transferred to a third country or to an international organization. In this respect you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

2. Right to rectification

You have the right to obtain from the controller the rectification or completion of inaccurate or incomplete personal data relating to you. The controller must carry out this rectification without undue delay.

3. Right to restriction of processing

You have the right to obtain from the controller restriction of processing where one of the following applies:

(1) the accuracy of the personal data is contested by you, for a period enabling the controller to verify the accuracy of the personal data;

(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

(3) the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or

(4) you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing of the personal data concerning you has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If you have obtained restriction of processing pursuant to the above provisions, you will be informed by the controller before the restriction of processing is lifted.

4. Right to erasure

a) Obligation of erasure

You have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(1) the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

(2) you withdraw consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2) GDPR, and there are no other legal grounds for the processing.

(3) you object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR;

(4) the personal data concerning you have been unlawfully processed.

(5) the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

(6) the personal data concerning you have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

b) Disclosure to third parties

Where the controller has made the personal data concerning you public and is obliged pursuant to Article 17(1) GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure of any links to, or copy or replication of, those personal data by such controllers.

c) Exceptions

The right to erasure does not apply to the extent that processing is necessary:

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph a is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(5) for the establishment, exercise or defense of legal claims.

5. Notification obligation

If you have exercised your right to rectification, erasure or restriction of processing with the controller, the controller is obligated to notify all recipients to whom the personal data concerning you were disclosed of this rectification or erasure of data or restriction of processing unless this proves impossible or involves disproportionate effort.

You have the right to obtain information from the controller about those recipients, if requested.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to a controller, in a structured, commonly used and machine-readable format. You further have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, where

(1) the processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or on a contract pursuant to point (b) of Article 6(1) GDPR; and

(2) the processing is carried out by automated means.

In exercising your right to data portability you have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

The right to data portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to withdraw consent related to data protection law

You have the right to withdraw your consent related to data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision

(1) is necessary for entering into, or performance of, a contract between you and a data controller;

(2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

(3) is based on your explicit consent.

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in points (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.

Date: 12/27/18