Privacy policy for the SOOLEY app

This service (hereinafter referred to as “App”) is provided by ShoeFitter GmbH, Turmstraße 878467 Konstanz, Germany, authorized representative managing director: Sanya Zillicb, e-mail: hello@shoefitter.io (hereinafter referred to as “we” or “us”) as the responsible party within the meaning of the applicable data protection law.

You can access this privacy policy at any time under the menu item “Setting” within the app.

Processing of personal data

As part of the app, we allow you to measure the width of your child/children’s feet. The width measurement is used to determine the appropriate shoe size according to the width measurement system (WMS) – shoe size chart and provide it to you. When using the app, we process personal data about you and your child(ren). You must ensure that you have the consent of all guardians within the scope of their authorization to enter your child’s personal data. Personal data means any information relating to an identified or identifiable natural person.

The protection of your personal data is very important to us. We process them primarily to provide a functional and convenient to use app. Furthermore, we only process your data if and to the extent that this is permitted by legal regulations. For further information, please refer to the following explanations.

Our app offer is intended for people over 16 years old.

1.1 Information collected during the download

When downloading the app, certain required information is transmitted to the app store you have selected (e.g. Google Play or Apple App Store), in particular the user name, the e-mail address, the customer number of your account, the time of the download, as well as the individual device identification number may be processed. The processing of this data is carried out exclusively by the respective app store and is beyond our control.

1.2 Information that is collected automatically

As part of your use of the app, we automatically collect certain data that is required for the use of the app. This includes the following data:

Information about the browser type and version used
Version
Your operating system
Your IP address
Date and time of access
Device type
Camera quality, if you have allowed access to your camera
Tilt sensors if you have allowed access to your camera
Internet quality
This data is stored in the log files of our system. The aforementioned data is not stored together with other personal data.

It is necessary for this data to be transmitted to us in order to provide you with the Service and related features, to improve the functions and performance features of the App, and to prevent and remedy misuse and malfunctions. The data will not be used for marketing purposes in this context. The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. b DS-GVO, as the processing is necessary for the performance of the contract (use of the app) between you as the data subject and us. As a further legal basis serves our legitimate interest in ensuring the functionality and error-free operation of the app and to be able to offer a market and interest-oriented service, which here your rights and interests in the protection of your personal data within the meaning of Art. 6 para. 1 lit. f GDPR prevails.

1.3 Information collected during the creation of a user account (registration) and login

When you create a user account or log in, we use your credentials to grant access to and manage your user account. You can sign in using your email address and a password or via Facebook/Gmail/Apple Single Sign-On.

To register, enter the following data in an input mask provided for this purpose. These are transmitted to us and stored by us:

10. first name, last name

11. e-mail address

12. authentication (username and password)

The legal basis for the processing of the data is Art. 6 para. 1 p. 1 lit. b DS-GVO (fulfillment of the contract), as the processing is necessary for the pre-contractual measures, for the provision, implementation and processing of the user account and our services. Furthermore, we process your personal data to protect our legitimate interests or those of a third party in accordance with Art. 6 para. 1 p. 1 lit. f DS-GVO, insofar as this is necessary and insofar as your interests or fundamental rights or freedoms requiring the protection of personal data do not override our interests. On this legal basis, we collect your IP address as well as the date and time of your login and login hash codes to ensure that no unauthorized access is made from your account. If we have indications that unauthorized access is being made from your account, we will inform you by e-mail.

1.4 Information collected when using the app

Within the scope of app usage, you can enter, manage and edit various information, tasks and activities:

In order to be able to offer you the digital foot measurement of your child and the determination of the shoe size according to the WMS measurement table, we need the data of your child, which you transmit to us by placing the bare foot of your child on a white DIN A 4 paper, allowing our app to access your camera and transmitting us the recorded video sequence without sound. The video sequence is then evaluated and the results of the measurement are provided to you. Alternatively, as long as you have the measurement taken by means of a WMS measuring device in a specialist store, you can enter the results into the app yourself.

Furthermore, it is possible to create a footprint (a “digital foot passport”) by recording your child’s name, date of birth (month and year) and gender. The Footprint is used to assign the various measurement results and the measurement history to your child and to keep the information summarized.

The following data is therefore processed by us in the context of app use:

Assigned name of measured person for the creation of a foot passport
Date of birth (month and year) of your child
Gender of your child, as voluntary information
Video sequence and images of the right and left foot
Metadata from the video sequence, e.g. Timestamp, resolution and other technical parameters
Analysis data from the measurement of the feet and the corresponding WMS shoe size recommendation
Calculated foot lengths and widths
Documentation of the foot size recommendation
For analog measurement: Measurement results read from the caliper (WMS measuring device)
We process this data for the initiation, provision, execution and settlement of our services, namely the determination and provision of the WMS shoe size recommendation. In this respect, the basis of lawfulness is the processing for the fulfillment of the contract concluded with you on the use of the App pursuant to. Art. 6 par. 1 p. 1 lit. b GDPR. If personal data of your child is processed by us, this processing is carried out on the basis of our legitimate interest pursuant to Art. 6 para. 1 p. 1 lit. f GDPR. Here, our legitimate interest in processing prevails, as we would otherwise not be able to provide our service.

Furthermore, the processing of your personal data is also carried out to protect our legitimate interests or those of a third party in accordance with Art. 6 para. 1 p. 1 lit. f DS-GVO, insofar as this is necessary and insofar as your interests or fundamental rights or freedoms requiring the protection of personal data do not override. Processing required on the basis of legitimate interests may be carried out in particular for the following purposes:

Management, process optimization and organization of work, and needs analysis;
Preparation of other corporate decisions;
Administration and security of the IT systems: Due to the applicable legal data security regulations, a number of your data are processed for the administration and security of the IT systems, such as for the administration of user identifiers, the allocation of hardware and software to the system users, and for the security of the system. This includes automatically created and archived text documents (such as correspondence) in these matters. Without this data processing, secure operation of the IT systems and thus employment in our company is not possible;
Article-related matching recommendation, direct advertising or market and opinion research, insofar as permissible and insofar as you have not objected in this regard;
Proof of the service provided and for billing our business partners;
plausibility checks of the matching algorithm and to improve our services;
Data transfer for the assertion of legal claims and defense in legal disputes, as well as for the prevention and investigation of criminal offenses;
Aggregation of the data for anonymization and for subsequent analysis of the anonymous data and further use;
Further development of our services;
1.5 Period of data storage

Unless otherwise specified, we store your personal data for the duration of the usage or contractual relationship via the app plus. a period of [14] days, during which we keep backup copies after the deletion, unless this data is used for other purposes, e.g., for the purpose of the processing of personal data. are longer needed for criminal prosecution or to secure, assert or enforce legal claims.

We will delete or anonymize your personal data as soon as it is no longer necessary for the purposes for which we collected or used it in accordance with the preceding paragraphs. This is for example in the performance of a contract or in the performance of pre-contractual measures, if the data is no longer required for the performance of the contract. We may be contractually or legally obligated to store data even after termination of the contract (e.g. for tax purposes). Which storage periods apply here must be determined individually for the respective contracts and contracting parties.

2. reminder function

You can give us consent to receive push notifications. Push notifications are messages that appear on your smartphone without opening the respective app. Via push notification you will be provided with relevant information around the determined shoe size and possible updates (to be made), provided that you have given us consent to do so. If you have given us your consent, then we process the following data:

Your first and last name
Customer history about past measurements
Your data will be processed with your consent, which you declare by confirming the permission button. In this respect, Art. 6 para. 1 p. 1 lit. a DS-GVO Legal basis. You can informally revoke your consent at any time by making the appropriate setting in your device.

We process your data for as long as it is required for the reminder function and we have your consent; we delete it after you revoke your consent.

3. advertising consent

When registering, you can give us advertising consent to use your data for advertising purposes and to send you relevant information about our existing and future services and products in the form of newsletters. If you have given us your consent, then we process the following data:

3. your first and last name

4. your e-mail address

5. customer history about past measurements

The processing of your data is carried out with your consent, which you declare by placing a corresponding check mark in the advertising consent window. In this respect, Art. 6 para. 1 p. 1 lit. a DS-GVO Legal basis. You will receive an email after registration asking you to confirm your registration. This confirmation is necessary so that no one can log in with foreign e-mail addresses.

You can revoke your advertising consent at any time informally by sending an e-mail to the contact details above.

We process your data for as long as your consent exists and delete it after its termination. We may be contractually or legally obligated to store data even after termination of the contract (e.g., for tax purposes). Which storage periods apply here must be determined individually for the respective contracts and contracting parties.

Almost all emails sent automatically or not individually addressed only to you are sent via the US provider Mailchimp. For this purpose, we have concluded an order processing agreement with the provider of Mailchimp, Rocket Science Group LLC, including the so-called EU standard contractual clauses. You can read the privacy policy of the shipping service provider here: https://mailchimp.com/legal/.

4. who else receives your personal data?

Your personal data will not be transferred to third parties for purposes other than those listed below. We will only share your personal information with third parties if:

You according to Art. 6 para. 1 p. 1 lit. a DS-GVO have given your express consent to this,
this is legally permissible and in accordance with Art. 6 para. 1 p. 1 lit. b DS-GVO is necessary for the processing of contractual relationships with you,
in the event that for the transfer according to Art. 6 para. 1 p. 1 lit. c DS-GVO a legal obligation exists, as well as
the disclosure according to Art. 6 para. 1 p. 1 lit. f DS-GVO is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data.
As part of our cooperation with the WMS Association, we transmit to them statistical values concerning the use of the app. These values do not contain any personal data.
5. will your data be transferred to a third country or to an international organization?

Data transfer to third countries (countries outside the European Economic Area – EEA) takes place, but only insofar as this is necessary for the purpose of potential/current/former service provision, is required by law or you have given your consent. If service providers are used in the third country, they must, in addition to written instructions, be supported by the agreement of appropriate guarantees within the meaning of Art. 44ff. DS-GVO to comply with the level of data protection in Europe. For more details, please contact us.

6. is there an obligation for me to provide data?

In the context of our service provision, you only have to provide the personal data that is necessary for the establishment, implementation and termination of our service or for the collection of which there is a legal obligation. Without this data, service delivery will usually not be possible.

7. to what extent is there automated decision-making in individual cases or is my data used for profiling (scoring)?

Such processing does not take place.

8. use of cookies

We use so-called “cookies” in our app. When you access our app, a cookie may be stored on your system. This contains a unique string that can be used to identify your browser the next time you open the app.

In the following sections on technically necessary cookies and cookies for analyzing surfing behavior, we explain in detail what types of cookies we use and what data is processed there in each case.

If cookies are generally deactivated in our app, it may no longer be possible to use all of the app’s functions to their full extent.

When you access our app, you will be informed by an info screen about the above-mentioned use of cookies and referred to this privacy policy. We ask you here for your consent to the use of cookies, which you give us by clicking on the button “Agree”. In this respect, the legal basis for the processing for all non-technically necessary cookie types is Art. 6 para. 1 p. 1 lit. a GDPR.

8.1 Technically required cookies/information

Some features of our app require the use of cookies.

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 p. 1 lit. f DS-GVO. The data collected through technically necessary cookies is not used to create user profiles.

The technically necessary cookies we use are session cookies that are automatically deleted at the end of the session.

8.2 Cookies for the analysis of surfing behavior /Tracking services

We also use cookies in our app that enable an analysis of your surfing behavior. The data can then no longer be assigned to you. This data is not stored together with your other personal data.

In this way, the following data can be transmitted:

(Entered search terms);
Frequency of page views;
Utilization of app functions;
Dwell times on the app screens;
Click distribution;
Navigation path (sequence of screens);
Place of access;
Timestamp;
From which store you come;
Buying behavior;
Size inputs and calculations;
Conversion rate, broken down by group;
Item data, variants, sizes, colors and categories.
The use of analytics cookies is done to improve our services . Through the analysis cookies, we learn how the webapp is used and can thus constantly optimize our offer. The basis for legality is the consent given by you in the context of the cookie banner within the meaning of Art. 6 para. 1 p. 1 lit. a GDPR.

If you do not agree to the use of these cookies or configure your browser accordingly, this will not have any disadvantages for you. All functions of the webapp are still given.

For the storage period of cookies for the analysis of surfing behavior, the same applies as mentioned under 8.

We use the following services in our app that are based on analytics cookies:

Google Analytics

We use Google Analytics, a web analytics service provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: “Google”). This uses cookies. The information generated by the cookie about your use of the website is generally transmitted to a Google server in the USA and stored there.

Google will use this information on our behalf for the purpose of evaluating your use of our website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. In the process, pseudonymous usage profiles can be created from the processed data.

We use Google Analytics only with IP anonymization enabled. This means that your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser is not merged with other data from Google.

You can prevent the storage of cookies by selecting the appropriate settings on your browser software; you can also prevent the collection of data generated by the cookie and related to your use of the online offer to Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

For more information about Google’s use of data for advertising purposes, settings and opt-out options, please visit Google’s websites: https://www.google.com/intl/de/policies/privacy/partners/ (“Google’s use of data when you use our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Use of data for advertising purposes”), http://www.google.de/settings/ads (“Manage information Google uses to show you ads”) and http://www.google.com/ads/preferences/ (“Determine what ads Google shows you”).

As an alternative to the browser add-on or within browsers on mobile devices, please click this link to prevent the collection by Google Analytics within this website in the future. In the process, an opt-out cookie is placed on your device. In this is stored that we may not delete your data for Google Analytics. If you delete your saved cookies, you must click this link again.

9. what rights do you have regarding your data?

Below we would like to summarize your rights under the General Data Protection Regulation.

9.1 Right to revoke the declaration of consent under data protection law (Art. 7 (3) DS-GVO)

You have the right to revoke your consents at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You will be notified of this before you give your consent.

9.2 Right to information (Art. 15 DS-GVO, § 34 BDSG)

Gem. Art. 15 DS-GVO, you have the right to request confirmation from us as to whether we are processing personal data concerning you. If this is the case, you have a right of access to this personal data and to the following information:

the purposes for which we process this data;
the categories of personal data that we process;
to whom this personal data has been or will be disclosed, in particular if this is done to recipients in third countries or to international organizations;
if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration;
the existence of a right to rectify or erase the personal data concerning you or to restrict processing us or a right to object to processing by us;
the existence of a right of appeal to a supervisory authority;
if the personal data is not collected from you, all available information about the origin of the data;
whether automated decision making including profiling pursuant to Art. 22 para. 1 and 4 DS-GVO takes place and – if this happens – meaningful information about the logic involved as well as the scope and the intended effects of such processing on you.
If personal data is transferred to a third country or to an international organization, you have the right to be informed about the appropriate safeguards that ensure that the provisions of the GDPR are also complied with by these recipients.

9.3 Right to rectification (Art. 16 DS-GVO, § 35 BDSG)

You may request us to correct any inaccurate data concerning you without delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data – also by means of a supplementary declaration.

9.4 Right to deletion or “right to be forgotten” (Art. 17 DS-GVO, § 35 BDSG)

You have the right to have us delete data immediately if one of the following reasons applies:

The data is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw your consent on which the processing was based and there is no other legal basis for the processing.
You submit a request for reasons arising from your particular situation in accordance with Art. 21 para. 1 DS-GVO objects to the processing and there are no overriding legitimate grounds for the processing.
Pursuant to Art. 21 para. 2 DS-GVO against the processing for direct marketing.
The data has been processed unlawfully.
The deletion of the data is necessary to fulfill a legal obligation under European or German law.
The data has been collected in relation to information society services offered pursuant to Art. 8 para. 1 DS-GVO collected.
If we have made your data public and are obliged to erase it, we will take reasonable steps, taking into account the available technology and the costs of implementation, to inform those responsible that you have requested erasure.

9.5 Right to restriction of processing (Art. 18 DS-GVO)

According to Art. 18 DS-GVO, we may only process data in a restricted manner in the following cases. The is the case when:

you dispute the accuracy of your data, and until we are able to verify the accuracy.
the processing is unlawful and you object to the erasure of your data and request instead the restriction of the use of the personal data;
we no longer need the data for the purposes of processing, but you need them for the assertion, exercise or defense of legal claims, or
you object to the processing pursuant to Art. 21 para. 1 DS-GVO for reasons arising from your particular situation, and for as long as it has not yet been determined whether the legitimate grounds for processing by us outweigh your interests.
If processing has been restricted, we may only store this data. Any processing beyond this is then only permitted with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or a Member State.

You can revoke your consent given in this context at any time.

You will be notified by us before the restriction is lifted.

9.6 Duty of notification (Art. 19 DS-GVO)

We are obliged to inform all recipients to whom your data has been disclosed about a correction or deletion of your data or a restriction of processing. This shall only not apply if this proves impossible or involves disproportionate effort. We will inform you about these recipients if you so request.

9.7 Right to data portability (Art. 20 DS-GVO)

You have the right to receive the data concerning you that you have provided to us in a structured, common and machine-readable format. You also have the right to have us transfer this data to a third party, provided that

the processing of the data is based on your consent or on a contract and
the processing is carried out with the help of automated procedures.
In this context, you may request that we transfer your data directly to the third party, insofar as this is technically feasible. This right must not interfere with the rights and freedoms of other persons.

9.8 Automated decision in individual cases including profiling (Art. 22 DS-GVO)

On our website, your data is not subject to decisions based solely on automated processing (e.g. profiling).

9.9 Right of objection (Art. 21 DS-GVO)

If we process your data on the basis of a legitimate interest (Art. 6 (1) p. 1 lit. f DS-GVO), you have the right to object to this if the reasons for this arise from your particular situation. This also applies to profiling based on these provisions. In this case, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing. This must override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.

If we process your data for the purpose of direct marketing, you may object to the processing of the data. This also applies to profiling, insofar as it is associated with such direct advertising.

After your objection, your data will no longer be processed for these purposes.

To object, simply send an informal message to the contact details listed on page 1.

9.10 Right to complain to a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement, if you consider that the processing of data concerning you infringes the General Data Protection Regulation. This does not affect any other administrative or judicial remedies to which you may be entitled.