PRIVACY POLICY OF THE "K KIOSK APP" (HEREINAFTER "APP")

The controller responsible for processing your personal data in connection with this app is Valora Schweiz AG, Hofackerstrasse 40, CH-4132 Muttenz. 

You can contact our company data protection officer at dataprivacy@valora.comor at our postal address with the addition "the data protection officer".

Valora uses the data you provide primarily for the purpose of the proper operation of this app, as well as for the fulfillment and processing of the app services (including customer satisfaction surveys). Details can be found in this section.

• Data collected during the registration process: During the registration process, we ask you for your first name, last name, date of birth, gender and your cell phone number. We then generate an individual user ID for you. This data is processed to fulfill the terms of use of this app and is necessary to enable you to access the app, maintain your user account and to address you correctly in the event of direct communication (including customer satisfaction surveys). We use your date of birth to send you birthday wishes and a small birthday surprise. We also store your e-mail address if you contact our customer service by e-mail.
• Payment method data as part of the Payment Linked Loyalty program ("PPL"): If you choose to register one or more means of payment in the app so that you can automatically collect stamps and other benefits in the future (without having to show the QR code in the app) whenever you pay with a stored means of payment, we process data relating to the means of payment. We store the type of payment method (e.g. VISA, MasterCard, etc.), if applicable your partially masked card number (e.g. XXX XXX XXX1 234) and a so-called pseudonymous card token (an alpha-numeric identification number that the payment processor creates based on your card number). We also store in which of our sales outlets and at what time the deposited funds were last used. This data is used exclusively for the purpose of making it easier for you to collect stamps. You can delete the stored means of payment in your customer profile at any time. In this case, your payment method data will also be deleted from our systems. The data will also be deleted if you delete your entire customer account.
• Analysis data regarding app usage: Your individual user profile is made up of the data provided during registration (see above), your purchase data (location and time details, data on the products you are interested in, use of discounts or other offers) and other data on app usage (whether and when you have used the app, which functions you have accessed, etc.). Based on the user profiles of all app users, we can carry out analyses that can map consumer behavior and consumer profiles. Such processing is carried out on the basis of our legitimate interests in better understanding user acceptance and continuously optimizing this app and our offers. Depending on the analysis, your data is either aggregated (and therefore anonymized) or pseudonymized.
• Direct advertising: Based on the analysis of your user profile, we can send you attractive offers and relevant information on products and promotions in the app. When setting up the app, you can choose whether you would like to receive push notifications. You can change your selection at any time. You also have the option of subscribing to our newsletter. You can subscribe and unsubscribe via a separate link, which you will be notified of in the app.
• Competitions within the app: In the case of competition campaigns, we record which users have been provided with which campaigns, which users have taken part in which campaigns, which users have won which prizes and which prizes they have redeemed. As part of your participation in one of our competitions, it is also necessary for us to process the following personal data about you: For the purpose of prize delivery, it may be necessary for us to collect your postal address. If you win, we will also use your cell phone number stored in the app to activate the prize in your customer account and/or to contact you directly. We can also provide customer support if something does not work. The described data processing takes place exclusively for the purpose of processing the respective competition. We store data that we require exclusively for the proper processing of the competition (e.g. address) for up to 2 months after the prize has been sent.
• Invitation to use the App to a friend (Tell-a-Friend): When sending an invitation to use the App to a friend, Valora collects the cell phone number of the specified friend and stores this cell phone number in the user profile of the inviting user for one month, provided that the cell phone number of the advertised friend is not yet linked to an existing user account. If the invited friend registers during this one-month period via the invitation link sent by SMS, a voucher will be sent to the inviting user. If the friend does not register within within one month, the cell phone number will be deleted. The cell phone number of the invited friend will not be used for any other purposes.
• Sending a voucher to a friend (Gift-a-Friend): When sending a voucher to a friend via the SMS function, Valora collects the cell phone number of the specified friend to check whether a user account has already been set up with this cell phone number. If the gifted friend is already registered, the voucher will be sent via the app, otherwise via SMS. Immediately afterwards, the friend's cell phone number is pseudonymized. The gifted friend's cell phone number will not be used for any other purposes.
• Personal data as part of the download of this app from the app store
  When downloading this app, the relevant app store processes certain data relating to the user and the user's device, such as: IP address, device identification numbers (IMEI, UDID, IMSI, MAC address), mobile number (MSISDN), name of the device, user-specific app store login data such as user name / password.
  The use of third-party platforms is at your own risk. We have not checked the third-party platforms and accept no responsibility for how the providers process personal data. We recommend that you read the privacy policies of third-party platforms in advance.
• Data processing for fraud prevention: If we discover that a user has violated the terms of the loyalty program (e.g. by using the membership card to make purchases for other people in order to collect stamps), we may block the user account concerned. In this case, we store certain personal data (such as e-mail address, telephone number, user ID) in order to prevent the user from re-registering and to prevent future fraud. This processing is based on our legitimate interests in ensuring the integrity and security of the loyalty program.

• Sharing your data with other Valora companies: To the extent necessary to provide this App or for other legitimate interests of Valora, Valora will share your data with other members of the Valora group of companies.
• Transfer of personal data to third parties: Valora may transfer certain tasks and data to third parties ("Service Providers") engaged by it in order to enable the proper operation (e.g. the registration process), maintenance and various functionalities of this App, as well as to store the data. The service providers are Valora's processors and are contractually bound to the processing purposes described herein. In particular, they may only process your data in the context of fulfilling their contractual obligations to Valora and their obligations under applicable law. If we are involved in a business combination (merger), a joint venture, a business acquisition/sale or a sale of assets, we may disclose your data to any transaction partner for further processing.
• Disclosure in connection with criminal proceedings: To the extent permitted by law, we may disclose information the disclosure of which is necessary or conducive to investigating or preventing an actual or suspected criminal offense or other violation of our rights or the rights of a third party.
• Aggregated and anonymized analytics data: Valora may share summarized (aggregated) or non-personal (anonymized) data with the public and other partners. For example, Valora may publish such information to show trends in customer behavior. However, you as an individual will then no longer be identifiable from this data.

• Passing on your data to other Valora companies: Insofar as it is necessary for the provision of this App or for other legitimate interests of Valora, Valora will share your data with other members of the Valora Group.
• Transfer of personal data to third parties: Valora may transfer certain tasks and data to third parties ("service providers") commissioned by it in order to ensure proper operation (e.g. carrying out the registration process), maintenance and the various functions of this App, as well as to store the data. The service providers are data processors of Valora and are contractually bound to the processing purposes described herein. In particular, they may only process your data within the framework of fulfilling their contractual obligations towards Valora and their obligations under applicable law. If we are involved in a merger, joint venture, acquisition/sale or sale of assets, we may disclose your data to a transaction partner for further processing.
• Disclosure in connection with criminal proceedings: To the extent permitted by law, we may disclose information that is necessary or conducive to the investigation or prevention of an actual or suspected criminal offense or other violation of our or a third party's rights.
• Analysis data: Valora may disclose aggregated or non-personal information to the public and other partners. It is possible, for example, that Valora may publish such information in order to demonstrate trends in customer behaviour. However, you as a person can then no longer be identified from this data.

Your data is processed in Switzerland and in the member states of the European Union. In order to store your data securely in our customer database, we use a cloud service provider that provides data centers in Ireland and Germany. We are also entitled to transfer your personal data to third-party companies abroad, in particular subsidiaries, if this is necessary for the purpose of processing. It goes without saying that the statutory provisions on the transfer of personal data to third parties are complied with. These third parties are obliged to protect data to the same extent as we are. If the level of data protection in a country does not correspond to Swiss data protection law, we ensure by contract that the protection of your personal data corresponds to that in Switzerland at all times. To this end, we will either conclude the recognized standard contractual clauses (including the Swiss Annex) with the recipient or implement other additional suitable guarantees.

All stored personal data will only be retained by Valora (and/or by affiliated companies or third-party service providers on behalf of Valora) for as long as necessary for the use of the App or as permitted or required by law.

Registration data is used for the duration of the user account. User accounts are deleted unsolicited after two years of inactivity.

We use analysis data for a period of three years.

We store the cell phone numbers of friends to whom the app has been recommended for a period of one month.

Data whose specified maximum processing period has been reached will be automatically deleted within one month.

However, aggregated or anonymized data that no longer relates to individual users may be processed beyond the specified period.
For users who have been banned due to fraudulent activity, we store the relevant data (e.g. email address, telephone number, user ID) for a period of two years from the time of banning. This longer storage period is necessary to ensure that blocked users cannot register again and continue the fraud. After the two-year period has expired, the data is automatically deleted, provided there are no legal obligations for further storage.

• Withdrawal of consent: For those data processing operations for which you have given your consent, you have the right to withdraw it at any time. You can adjust your personal settings directly in the app. As you can give your consent for various functionalities, if you withdraw your consent, only the functionality for which you have withdrawn your consent will be deactivated or restricted (e.g. push notifications). If you have subscribed to our newsletter, you can simply unsubscribe by clicking on the unsubscribe link in the newsletter.
• Objection: You can object to such data processing, which we carry out on the basis of our legitimate interests, at any time.
• Right to information: You also have the right to find out from us what data we process about you, on what legal basis and for what purposes, and to request a free copy of your personal data.
• Right to rectification: If your data is incomplete or incorrect, you have the right to request the rectification of your personal data. You can correct some information yourself in the app's customer center.
• Right to erasure: You have the right to have your personal data erased under certain circumstances. In individual cases, the right to erasure may be excluded. You have the right to delete your customer account and the associated data yourself at any time. For technical and administrative reasons, the final deletion of the customer account may take up to 30 days after you have requested the deletion. Please note that uninstalling the app does not automatically lead to the deletion of your customer account and your data will still be retained if you decide to reinstall the app at a later date. If your account has been blocked due to a breach of the terms of the loyalty program, certain data may remain stored for a period of two years for fraud prevention purposes before being permanently deleted. In individual cases, the right to erasure may therefore be restricted in this context.
• Automated decisions and profiling: Where decisions in the context of this app are based exclusively on automated processing, including the creation of a personality profile (in particular personalized offers), you can refuse those decisions that affect you in a legal or other significant way.

If you wish to exercise the rights described above or have any other questions about the processing of your personal data, please contact our company data protection officer at dataprivacy@valora.com or at our postal address with the addition "the data protection officer". To make it easier for our data protection officer to allocate your request as quickly as possible, your message should ideally include the reference "k kiosk app".

If you have reason to believe that Valora is not processing your personal data in accordance with applicable laws and regulations and/or if you do not agree with the response to your request to grant your rights, you may lodge a complaint with the supervisory authority.

We use the developer platform Google Firebase and the associated functions and services of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ("Google"). Google Firebase is a platform for developers of apps for mobile devices and websites. Google Firebase offers a variety of functions, which are presented on the following overview page: https://firebase.google.com/products/.
The functions include the storage of apps including users' personal data, such as content created by you or information regarding your interaction with the apps. Google Firebase also offers interfaces that allow interaction between users of the app and other services.
User interactions are analyzed with the help of the Firebase Analytics service. This service helps us to record the interactions of our users. For example, events such as opening the app for the first time, uninstalling, updating, crashing or frequency of use of the app are recorded. Certain user interests are also recorded and analyzed.
The information processed by Google Firebase may be used together with other Google services, such as Google Analytics and Google marketing services. In this case, only pseudonymous information, such as the Android Advertising ID or the Advertising Identifier for iOS, is processed to identify users' mobile devices. Users can find more information on the use of data for marketing purposes by Google on the overview page: https://www.google.com/policies/technologies/ads, Google's privacy policy is available at https://www.google.com/policies/privacy.

Google is certified under the EU-U.S. Data Privacy Framework and thus offers a guarantee to ensure the level of protection of European data protection law (https://www.dataprivacyframework.gov/list).

Please note that we may change this privacy policy at any time without prior notice. Please check this App Privacy Notice regularly for changes - we will mark changes with an additional label such as "New" or "Update". Any changes will take effect immediately after the revised app privacy information is published in this app.