Chính sách bảo mật

PollUnit UG (haftungsbeschränkt) collects and processes your data as a responsible authority in the sense of the data protection laws.

PollUnit UG (haftungsbeschränkt)
Conrad-Schulz-Weg 3
D-82211 Herrsching

support@pollunit.com

1. Scope

This privacy policy clarifies the nature, scope and purpose of the collection and use of personal data by the PollUnit UG (haftungsbeschränkt) on this web application (PollUnit). Compliance with data protection regulations is self-evident to us. The basis for this is the EU General Data Protection Regulation (GDPR).

2. Collection of general information

When you access our web application, general information is collected automatically. This data is technically necessary to deliver our web application correctly. The data includes information such as: version and type of your web browser, your used operating system, your IP address, the domain name of your Internet service provider, and the time of your access to our web application. We do not use your data to draw conclusions about your person. In order to constantly improve our service, we evaluate this data statistically. For example, statistics are about which pages and features are most popular and most frequently visited or used.

Legal basis: Processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability, integrity and functionality of our website.

Recipients: If applicable, technical service providers (contract processors) receive data that are used for the operation and maintenance of our website. Further information can be found in Appendix 2.

Storage period: We delete this data as soon as it is no longer required for the purpose of collection.

A contradiction is excluded, since without this data the functionality of our website cannot be guaranteed.

3. Collection of data during registration

We set up a password-protected direct access to the user data (user account) for each of our customers who registered accordingly. When creating user accounts, different personal data is collected. This data includes your first and last name, your e-mail address, and any other information you provide during registration.
In addition, you can comfortably sign in or register with your Facebook / Github / Google account on our application. Click on the Facebook / Github / Google logo in the login dialog. This will open a log-in dialog from the provider, where you give PollUnit the permission to access your information from this provider. This includes basic information as well as your e-mail address. With this data we create your PollUnit account. During the process, the provider will not pass a password to our application.
With a PollUnit user account or a completed registration, you can access content and services that we only offer to registered users. The data provided for the registration can be changed at any time in your user account ('My account') after a login. Here the user can also see his orders (subscriptions) and their statuses.
You agree to treat your personal access data confidentially and not to make it accessible to unauthorized third parties. We can not accept liability for misuse of passwords, unless we represent the abuse.
For any information, correction or deletion concerning the personal data we have stored about you, please contact us via the above address. Processing of this data is only possible if there are no statutory storage obligations.
Personal data will only be collected, used and passed on if this is legally permitted or if you have given your consent to the data collection.

Legal Basis: The data entered during registration are processed on the basis of the user's consent (Article 6(1)(a) GDPR).
If the registration serves the fulfilment of a contract to which the user is a party or the implementation of pre-contractual measures, the additional legal basis for the processing of the data is Article 6(1)(b) GDPR.

Recipients: If applicable, technical service providers (contract processors) receive data that are used for the operation and maintenance of our website. Further information can be found in Appendix 2.

Storage period: You can delete your account yourself in your profile settings. We first mark your account as deleted for 30 days in order to be able to help you with any questions you may have. After that the data will be deleted as long as there are no legal obligations to store them. For an immediate deletion you can contact us at any time.

The provision of your personal data is voluntary, solely on the basis of your consent. Without the provision of your personal data, we can only grant you limited access to our services.

4. Collection of data when creating a survey

If you are logged in with a PollUnit account, no further information about your person is necessary.
Without PollUnit account, you must enter your name and e-mail address. We need this data to carry out your survey. For example, to inform you about the result.
When creating a survey, we need different general information. These data are for example: title, description and location of the survey. We also need the options of your survey. These can be date, time, pictures or other infromations which you indicate during the creation.
You have the option to send invitations to other users. To do this, you can specify a list of email addresses, or import your contacts from Google. PollUnit will only get access to your Google contacts when you are logged in to Google and PollUnit is authorized to read your contacts. We use these contacts exclusively to realize your survey. For example, to send your invitation or notify users about events in your poll.
You can create surveys using images. In addition, users with the appropriate rights can upload their own background images for their surveys. In order to ensure optimal delivery of this data, this data is stored at Hetzner (cloud storage) and delivered to users by Hetzner.

Legal basis: The processing of the data entered when creating a PollUnit (voting, survey, scheduling, brainstorming...) is based on the consent of the user (Art. 6 para. 1 lit. a GDPR).

Recipients: Technical service providers (processors) who are involved in the operation and maintenance of our website may receive data. Further information can be found in Appendix 2.

Storage period: You can delete your PollUnits yourself at any time or contact us and ask us to delete it.

The provision of your personal data is voluntary, based solely on your consent. Without the provision of your personal data, we can only grant you limited access to our offers and functions.

5. Use of the data of your survey

Access to your current, not additionally secured surveys and their contents, have all users that received the participant link or admin link from you or a third party. These are links to your survey. With the help of the adminlink, users can also edit your survey. You can also secure your poll with a password.
Users with access to your survey can retrieve content such as title, description, location, and survey options. In addition, your users see the votes and names of you and other participants who have already voted.
As a user with a PollUnit account, you can edit and delete your polls at any time at 'My PollUnits'.

6. Collection, processing and use of your data

If you have provided us with personal data, we only use it to create your surveys, process your orders, answer your queries, for technical administration as well as for our own marketing purposes. When collecting, processing and using your personal data, we adhere strictly to the legal provisions of the EU General Data Protection Regulation (GDPR). Your personal data will only be passed on to third parties if this is necessary for the purpose of the contract processing or for the settlement and you have previously given your consent. For example, Stripe (payment service provider) will receive the necessary data to process your order. The provided data may be used by our service providers only to fulfill their tasks.
Your e-mail address is required, so we can confirm your order and communicate with you. We can also use them for your identification (customer login). In addition, we use your account email address or address provided by the creation in surveys to inform you about events in your survey. These events can be, for example: the result of the survey, information about new options, the participation of participants.
Depending on the type of survey, different information from the participants is recorded and made available to other participants. For example, other participants have access to the following information: your name, your chosen options or ratings, your comments and other information you specify in a survey. The aim of PollUnit is to shorten the communication between its users. Therefore all users who have access to the administration of a survey have the option to export, edit and save the results, votes, and e-mail addresses (if known) of the participants.
Uploaded media such as photos, can contain metadata. Metadata could include personal data like EXIF GPS location. As administrator of a PollUnit, you can view this metadata and export, download and save media files. Personal data like location information can be removed before uploading to the PollUnit servers.

7. Provision of services at a charge

For the provision of paid services, additional data are requested by us, such as your payment details. To protect your data during transmission, we use the current state of the art encryption methods (e.g., SSL) over HTTPS.

Legal Basis: The processing of the data required for the conclusion of the contract is based on Article 6(1)(b) GDPR.

Recipients: If applicable, technical service providers (contract processors) receive data that are used for the operation and maintenance of our website. Further information can be found in Appendix 2.

Storage period: These data will be stored in our systems until the legal retention period expire.

The provision of your personal data is voluntary, solely on the basis of your consent. Without the provision of your personal data, we can only grant you limited access to our services.

8. Contact

When contacting PollUnit (for example via a contact form or e-mail), your data will be stored for the processing of the inquiry as well as for the case of further questions.

Legal Basis: The processing of the data entered in contact forms or in support requests is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest or to implement pre-contractual measures (Article 6(1)(b) GDPR).

Recipients: If applicable, technical service providers (contract processors) receive data that are used for the operation and maintenance of our website. Further information can be found in Appendix 2.

Storage period: The data will be deleted as soon as they are no longer required for our recording purposes.

The provision of your personal data is voluntary, solely on the basis of your consent. Without providing the necessary information of your request (such as e-mail address, name...) we can not process your request.

9. Posts and Comments

When you create posts, comments or other information, your IP address will be saved. This occurs to the security of the offerer, if someone writes illegal contents (insults, prohibited political propaganda, etc.) in comments and contributions. In this case, the provider itself may be prosecuted for the comment or contribution and is therefore interested in the author's identity.

Legal Basis: The data entered as comments or contributions will be processed in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest.

Recipients: If applicable, technical service providers (contract processors) receive data that are used for the operation and maintenance of our website. Further information can be found in Appendix 2.

Storage period: Comments and posts in PollUnits are automatically deleted when the PollUnit to which the comments and posts belong is deleted. The deletion of contributions in our support forum can be requested by contacting us.

The provision of your personal data is voluntary, solely on the basis of your consent. Without the provision of your personal data, we can only grant you limited access to our services.

10. Integration of third-party services and content

It may happen that third parties are involved in our application. For the technical delivery of the content to your browser, the providers need and use your IP address. We have no influence on the further processing of your IP address with these providers. As far as we know, we will clarify our users about this. Third party content might be: videos from YouTube, GoogleMaps map material, RSS feeds, Amazon Web Service graphics, and advertisings
You can share your surveys and our application across different social networks. The buttons are marked accordingly with the logo and name of the network. Clicking on the button will take you to the offer or the website of the respective network. We have no influence on the processing of your data with these providers.
To invite friends or colleagues to a PollUnit, You can find your Google Contacts through the Google People API. Once you've permitted PollUnit to access the Google People API, you can search the email addresses of your contacts and select those to which you want to send the invitation.
When you create a video contest, you and your participants can add YouTube and Vimeo videos. When the video contest is accessed, the videos are retrieved from YouTube or Vimeo. The YouTube videos will be integrated into PollUnit with extended privacy mode, so that no YouTube cookies are set to analyze the usage behavior.

11. Secure data transmission

By encrypting, your personal data will be transferred securely. The secure transfer applies to your orders and also to your customer login. We use the encryption system SSL (Secure Socket Layer). Our website is protected by technical and organizational measures against loss, destruction, access, alteration or distribution of your data by unauthorized persons.

12. Claim for information, revocation and correction of your data

According to the EU General Data Protection Regulation (GDPR), you have the right to receive free of charge information about your stored personal data (Article 15 GDPR). Likewise, you have the right to correct (Article 16 GDPR), block (Article 18 GDPR) or delete (Article 17 GDPR) your personal data. Except for this is the prescribed data storage for business processing. Du kannst Widerspruch gegen die You may object to the processing of your data (Article 21 GDPR) and to the transferability of your data, if you have not consented to any data processing or concluded a contract with us (Article 20 GDPR). Excluded from this is the prescribed data storage for business transactions.
In order to ensure that data can be blocked at any time, these data must be kept in a lock file for control purposes. You may also request the deletion of the data if there is no legal obligation to archive. If such an obligation exists, we will lock your data on request.
You may make changes or revoke a consent by means of a corresponding notice to us with effect for the future.
You can complain to a supervisory authority at any time, e.g. to the competent supervisory authority of the federal state in which you live or to the authority responsible for us: supervisory authorities and their addresses.

13. Questions to the Data Protection Supervisor

If you have any questions about the privacy policy, please send your inquiry by e-mail or by mail, clearly identifying your person to the above address.

14. Privacy policy updates

We reserve the right to update our privacy policy if necessary. This is necessary in order to ensure that data protection is always in accordance with current legal requirements and to make changes to our services. When revisiting our website, the new updated privacy policy applies.

15. Cookies

A cookie is a text file that we store on the hard disk via the user's web browser. It is possible to configure the settings of the web browser so that the storage of cookies on the computer is no longer possible. This affects the functionality of our website. We use cookies to extend the functionality of our website and to make it easier for our users to use them. We need cookies to identify users and enable them to log on to our website.

Timezone Cookie: We use this cookie to store your time zone and show you date fields and times in the correct time for you. This cookie is automatically deleted by your browser (unless otherwise configured) when you end your session.

Session Cookie: We use this cookie to store an identification code. This code does not contain any personal data and is used to link you to your account or settings. This cookie is stored for 2 months.

PollUnit-Cookie-Check: We use this cookie to easily find out if your browser can store cookies.

16. Digital wallets

When a Stripe account is linked to PollUnit, the Stripe account can receive donations and charges. The link is stored in PollUnit as a wallet. In the process, payment data is made available to the payment provider Stripe. The owner of the Stripe account, who becomes the responsible merchant by linking with PollUnit, can access data necessary for billing via the Stripe Platform.
The payee is obligated to comply with all applicable laws and regulations related to the processing of personal data collected in connection with the payments they accept. This includes compliance with the General Data Protection Regulation (GDPR) and other applicable laws for the protection of personal data.

Legal Basis: The processing of the data entered during the payment is based on the consent of the user and serves the execution of the payment (Article 6(1)(a) GDPR).
The processing of data entered when linking a Stripe and PollUnit account is based on our legitimate interest and serves the execution of the contract (Article 6(1)(b) GDPR).

Recipients: PollUnit, Stripe, and the payee can view payers' payment and contact information. Credit card numbers of payers are kept secure and used only for processing payments. PollUnit as well as the payee does not have access to the complete credit card number.
For more information, please see Appendix 2.

Storage period: You can delete your wallets from PollUnit on your own at any time or contact us and ask us to delete them.

Version: 02.2023

Anlage 1

Technische und organisatorische Maßnahmen

1. Vertraulichkeit

Maßnahmen die dazu geeignet sind, dass Unbefugte keinen Zugang auf personenbezogene Daten erhalten:

Server-Passwörter sind nur ausgewählten Personen bekannt.

Das Passwort zur Administrationsoberfläche wird vom Auftraggeber selbst vergeben.

Verschlüsselte Übertragung von Authentisierungsgeheimnissen.

Durch regelmäßige Sicherheitsupdates stellt der Auftragnehmer sicher, dass der Zugriff Unberechtigter verhindert wird.

Eine Verarbeitung der personenbezogenen Daten erfolgt automatisch, so dass keine Speicherung der Daten in den Büroräumen des Auftragnehmers nötig ist. Ausgenommen hiervon sind manuelle Bearbeitungen von Anfragen des Auftragnehmers sowie temporäre Kopien zur Fehleranalyse.

Umsetzung von Zugriffsbeschränkungen.

Maßnahmen die dazu geeignet sind, dass Unbefugten der Zutritt zu Datenverarbeitungsanlagen, in denen personenbezogene Daten verarbeitet oder genutzt werden, verwehrt wird:

Der Serverstandort von Hetzner ist unter anderem ISO 27001 zertifiziert.

Maßnahmen die dazu geeignet sind, dass zu unterschiedlichen Zwecken erhobene Daten getrennt verarbeitet werden können:

Datensätze von unterschiedlichen PollUnits werden speziell mit einer PollUnitID sowie mit einer UserID markiert.

Test- und Produktivdaten werden in unabhängigen Systemen gespeichert. Die PollUnit Test- und Entwicklungssysteme sind strikt vom Produktivsystem getrennt.

Das Produktivsystem hat seine eigene Domain und SSL Zertifikate.

Für die Pseudonymisierung ist der Auftraggeber verantwortlich.

2. Integrität

Maßnahmen die dazu geeignet sind, dass keine personenbezogene Daten an Unbefugte weitergegeben werden:

Sichere Datenübertragung zwischen Server und Client.

Der Auftraggeber kann selbst den Zugriff auf seine PollUnits steuern.

Alle Mitarbeiter und Entwickler sind zur Vertraulichkeit verpflichtet und unterliegen einer Geheimhaltungsverpflichtung.

Maßnahmen die dazu geeignet sind, dass personenbezogene Daten kontrolliert werden können:

Personenbezogenen Daten werden vom Auftraggeber selbst eingegeben und können in seinen Benutzereinstellungen kontrolliert werden.

3. Verfügbarkeitskontrolle und Belastbarkeit der Systeme

Maßnahmen die dazu geeignet sind, dass personenbezogene Daten gegen zufällige Zerstörung oder Verlust geschützt sind:

Die Rechenzentren von Hetzner sind mit entsprechenden Schutzvorkehrungen ausgestattet.

Die PollUnit Server sind redundant ausgelegt.

Es werden regelmäßig automatische Sicherungskopien und Backups erstellt.

Monitoring bei kritischen Systemen.

4. Überprüfung, Bewertung und Evaluierung

Verfahren zur regelmäßigen Überprüfung, Bewertung und Evaluierung der Wirksamkeit der technischen und organisatorischen Maßnahmen:

Wir führen regelmäßige Überprüfungen durch, um sicherzustellen, dass die genutzte Software, einschließlich Plugins, kontinuierlich auf die neuesten Versionen aktualisiert wird und alle erforderlichen Sicherheitsupdates durchgeführt werden.

Durch automatisierte Sicherheits- und Codeanalysen gewährleisten wir eine kontinuierliche Überwachung unserer Systeme. Dies ermöglicht uns, potenzielle Schwachstellen frühzeitig zu erkennen und proaktiv zu beheben.

Zusätzlich zu automatisierten Analysen setzen wir auf die Expertise unserer Entwickler. Durch Pairprogramming und Codereviews führen wir gezielte manuelle Sicherheitsanalysen durch, um sicherz ustellen, dass auch subtile Risiken erkannt und behoben werden.

Unsere Überwachungssysteme ermöglichen eine Echtzeitüberwachung unserer Dienste, deren Erreichbarkeit und Geschwindigkeit. Durch kontinuierliches Monitoring sind wir in der Lage, sofort zu reagieren und proaktiv Maßnahmen zu ergreifen.

Full-Stack Monitoring zur Überwachung aller Komponenten oder Schichten (Stacks) unserer Anwendungsarchitektur, angefangen von der Benutzeroberfläche bis hin zur zugrunde liegenden Infrastruktur.

Echtzeit Fehler-Tracking ermöglicht uns, Fehler in Echtzeit zu erkennen und unmittelbar darauf zu reagieren.

Versionskontrolle sorgen für Rückverfolgbarkeit und ermöglichen eine detaillierte Überprüfung aller Codeänderungen im Zeitverlauf.

Anlage 2

Subunternehmer

1. Hetzner

Unser Dienst läuft auf den Servern der Hetzner Online GmbH (Deutschland). Der Serverstandort ist in Falkenstein, Deutschland und ist unter anderem ISO 27001 und SOC2 zertifiziert. Darüber hinaus haben wir mit Hetzner ein »Data Processing Agreement« abgeschlossen welcher Hetzners Verpflichtung zur Einhaltung der DSGVO sowie den Standardvertragsklauseln (SCC) nach dem Durchführungsbeschluss 2021/914 (EU) vom 4. Juni 2021 enthält. Hier werden alle Daten außer Video-Daten (siehe BunnyWay) gespeichert.

Weitere datenschutzrechtliche Informationen von Hetzner findet man unter Hetzner - Legal notice.

2. Amazon Web Services

Alle von Dir hochgeladenen Dateien, wie Bilder, PDF-Dateien und MP3s, werden durch unseren Hosting-Dienstleister »AWS« Amazon Web Services, Inc. (Seattle, USA) verschlüsselt gespeichert. Der Serverstandort ist in Frankfurt am Main, Deutschland und unter anderem nach ISO 27001, ISO 27017, ISO 27018, SOC1, SOC2, SOC3 und PCI DSS Level 1 zertifiziert. Darüber hinaus haben wir mit AWS ein »Data Processing Agreement« abgeschlossen, das AWS' Verpflichtung zur Einhaltung der DSGVO sowie den Standardvertragsklauseln (SCC) nach dem Durchführungsbeschluss 2021/914 (EU) vom 4. Juni 2021 enthält.

Weitere datenschutzrechtliche Informationen von AWS findest Du unter GDPR - Amazon Web Services (AWS).

3. Hetzner

Weitere datenschutzrechtliche Informationen von Hetzner findet man unter Hetzner - Legal notice.

4. Mailgun

Alle System-Emails von PollUnit werden durch unseren Dienstleister Mailgun Technologies Inc. (San Francisco, USA) von einem Server innerhalb der Europäischen Union versendet.

Der Dienst von Mailgun ist auf AWS aufgebaut. Mailgun ist unter anderem ISSAE-16 SOC I und II, HIPAA und ISO27001 zertifiziert. Darüber hinaus haben wir mit Mailgun ein »Data Processing Agreement« abgeschlossen welcher Mailguns Verpflichtung zur Einhaltung der DSGVO sowie den Standardvertragsklauseln (SCC) nach dem Durchführungsbeschluss 2021/914 (EU) vom 4. Juni 2021 enthält. Näheres finder man in den Datenschutzbestimmungen von Mailgun unter https://www.mailgun.com/privacy-policy und https://www.mailgun.com/gdpr

Die Rechtsgrundlage hierfür ist Art. 6 Abs. 1 lit. b DSGVO.

5. Stripe

Zahlungen können über den Zahlungsdienstleister Stripe (Ireland) abgewickelt werden. Außerdem können Ersteller:innen von PollUnits ihren eigenen Stripe Account mit PollUnit verknüpfen um ein PollUnit Wallet (digitale Geldbörsen) zu erstellen um so Zahlungen empfangen zu können. Diese Zahlungen werden über Stripe abgewickelt. Stripe ist PCI DSS Level 1 zertifiziert. Darüber hinaus haben wir mit Stripe ein »Data Processing Agreement« abgeschlossen welcher Stripes Verpflichtung zur Einhaltung der DSGVO sowie den Standardvertragsklauseln (SCC) nach dem Durchführungsbeschluss 2021/914 (EU) vom 4. Juni 2021 enthält.

Stripe verarbeitet den Namen des Karteninhabers, E-Mail-Adresse, Kundennummer, Bestellnummer, Bankverbindung, Kreditkartendaten, Gültigkeitsdauer der Kreditkarte, Prüfnummer der Kreditkarte (CVC), Datum und Uhrzeit der Transaktion, Transaktionssumme, Name des Anbieters und Ort. Informationen, die Stripe zur Verfügung gestellt werden, stehen nicht unter unserer Kontrolle und unterliegen der Datenschutzerklärung von Stripe. Weitere datenschutzrechtliche Informationen von Stripe findet man unter https://stripe.com/privacy-center/legal.

Die Rechtsgrundlage hierfür ist Art. 6 Abs. 1 lit. b DSGVO.

6. BunnyWay d.o.o. (bunny.net)

Um die Ladezeiten von PollUnit zu optimieren, setzen wir auf das Content Delivery Network (CDN) von bunny.net. Ersteller:innen von PollUnit Videowettbewerben können Videos hochladen oder Teilnehmer:innen dazu auffordern eigene Videos hochzuladen. Diese Videos werden von BunnyWay d.o.o. (Slovenia) gespeichert, transkodiert und ausgeliefert (streaming). Personenbezogenen Daten werden anonymisiert und nicht an Dritte weitergegeben. bunny.net erfasst, speichert oder verbreitet keine Informationen, die zur Identifizierung eines Benutzers oder zur Offenlegung seiner persönlichen Daten verwendet werden könnten. Falls die Inhalte der hochgeladenen Videos/Dateien solche Informationen enthalten, werden diese nicht anonymisiert. Darüber hinaus haben wir mit BunnyWay d.o.o. ein »Data Processing Agreement« abgeschlossen. Weitere datenschutzrechtliche Informationen von BunnyWay d.o.o. findet man unter https://bunny.net/privacy/.

Die Rechtsgrundlage hierfür ist Art. 6 Abs. 1 lit. b und f DSGVO.

Anlage 3

Weisungsberechtige Personen

Folgende Personen sind zur Erteilung und Entgegennahme von Weisungen befugt:

Philipp Großelfinger
Mitbegründer PollUnit
philipp@pollunit.com

Markus Huber
Mitbegründer PollUnit
markus@pollunit.com

Anlage 4

Datenschutzbeauftragter

Der Datenschutzbeauftragte ist zuständig für alle Fragen, die den Schutz personenbezogener Daten einschließlich der Datensicherheit betreffen.

Markus Huber
markus@pollunit.com

Anlage 5

Erweiterung um die Anforderungen des California Consumer Privacy Act (CCPA)

Um den Anforderungen des California Consumer Privacy Act von 2018 gerecht zu werden, wird dieser Vertrag um folgende Punkte ergänzt:

Der Auftragnehmer verpflichtet sich...

a) personenbezogene Daten nur für den spezifischen Zweck der Erbringung der Dienstleistungen im Auftrag des Auftraggebers zu sammeln, aufzubewahren, zu verwenden, offenzulegen oder zu verarbeiten;

b) Daten des Auftraggebers nicht für andere kommerzielle Zwecke zu sammeln, aufzubewahren, zu verwenden oder offenzulegen als die im Auftrag des Auftraggebers;

c) keine Daten des Auftraggebers zu verkaufen.