Home/Privacy policy

Privacy policy

Note: This is a legally binding document in German. Translations into other languages are for informational purposes only; in case of doubt, the German version always prevails.

1. Controller

The controller within the meaning of the GDPR is:

Paw Control
Leideck & McCutchan GbR
Zum Heinenberg 8
42555 Velbert
Germany

Email: security@paw-control.eu

A separate data protection officer is currently not appointed. The contact person for data protection is the management at the email address above.

2. General notes on data processing

We process personal data only insofar as this is necessary to provide our website, the Paw Control app, to communicate with you or to fulfil our contractual obligations.
The legal basis is in particular Art. 6 para. 1 lit. a, b, c and f GDPR.

3. Provision of the website and app, server log files

When visiting our website and using the app, the following data is processed automatically:

  • IP address
  • Date and time of the request
  • Time zone difference to GMT
  • Content of the request (specific page/resource)
  • HTTP status code
  • Amount of data transferred in each case
  • Referrer URL
  • Browser type, version and language
  • Operating system and interface
  • For app usage: device type, operating system version, app version

The purpose is to ensure stability, security and functionality of our services.
The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest).

The log files are usually stored for a maximum of 30 days and then deleted, unless a longer retention is necessary to investigate security incidents.

4. Hosting in the EU

Our website as well as the backend infrastructure for the app (including the GPS tracking server Traccar and other microservices) are operated on servers of Hetzner Online GmbH in a German data centre.

A data processing agreement exists with Hetzner in accordance with Art. 28 GDPR. No transfer to third countries takes place in this context.

For the app platform base44 the following applies in addition: base44 is a separate SaaS product from a third-party provider; regardless of the location of our own servers, base44 itself may process data on its own infrastructure. The server location of base44 and the DPA status with base44 must be requested directly.

5. User account in the Paw Control app

To use central functions of the Paw Control app (e.g. linking trackers, managing pets), registering a user account is required.

Processed data:

  • Name or username
  • Email address
  • Encrypted password
  • Profile picture if applicable
  • Language settings
  • Assignment of trackers and pets (e.g. pet name, profile picture, breed – if provided)

The purpose is the setup, management and use of your account as well as the provision of app functions.
The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract).

The data is stored for the duration of the account's existence. After deletion of the account (see Terms), the data is deleted subject to statutory retention obligations.

6. Tracker usage and location data

When using our trackers in connection with the app, we process in particular:

  • Location data of the tracker
  • Times of position determination
  • Assignment to the user account and the respective pet
  • Technical status information of the device (e.g. battery level, connection)

The processing and storage of position data is technically handled via the GPS tracking server Traccar, which we operate at Hetzner Online GmbH in a German data centre (see section 4).

The purpose is to provide tracking, safety and history functions. The legal basis is Art. 6 para. 1 lit. b GDPR.

Location and history data is only stored as long as is necessary to provide the respective functions (e.g. display of the current and a selected history period) and then deleted or anonymised. Specific history periods can be set in the app or viewed in the settings.

7. Contact

When contacting us by email or via provided forms, we process your details (in particular name, email address, content of the message) to process your request.

The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract or pre-contractual measures) or Art. 6 para. 1 lit. f GDPR (legitimate interest in processing requests).

The data is deleted as soon as the request has been finally processed and no statutory retention obligations oppose this.

8. Simple mailing list / information by email

If you expressly ask us or agree within the scope of using our services that we send you information (e.g. updates about Paw Control) by email, we process your email address and, if applicable, your name.

The purpose is to send information about our product.
The legal basis is your consent according to Art. 6 para. 1 lit. a GDPR.

You can withdraw your consent at any time with effect for the future, e.g. by an informal email to hello@paw-control.eu.
Your data is stored for this purpose until you withdraw your consent.

9. Transactional emails (Resend)

To send necessary transactional emails within the scope of account and app usage (e.g. registration confirmation, password reset, geofence and activity notifications), we use the service Resend (Plus Five Five, Inc., USA).

Processed data: email address, name if applicable, content of the respective message.

The purpose is the reliable technical delivery of required emails within the scope of performance of the contract. The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract) or Art. 6 para. 1 lit. f GDPR (legitimate interest in reliable technical communication).

Transfer to third countries:

Since Resend is based in the USA, a data transfer to a third country takes place. This is safeguarded by standard contractual clauses as well as the certification of Resend under the EU-US Data Privacy Framework (incl. UK extension). A data processing agreement exists with Resend in accordance with Art. 28 GDPR. Further information can be found in Resend's privacy policy.

10. Payment processing (Stripe)

To process payments (purchase of trackers, subscriptions for Paw Protect basic/Premium) we use the payment service provider Stripe. The contractual partner is usually Stripe Payments Europe, Limited (SPEL), a company based in Ireland.

Processed data: name, email address, payment/card data, invoice or delivery address, transaction data (amount, time), IP address.

The purpose is to process payments for tracker purchases and subscriptions. The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract).

Transfer to third countries:

Stripe partially processes data via group companies outside the EU (including the USA). This transfer is safeguarded by standard contractual clauses as well as Stripe's participation in the EU-US Data Privacy Framework. A data processing agreement exists with Stripe in accordance with Art. 28 GDPR. Further information can be found in the Stripe Privacy Center.

11. Push notifications (OneSignal)

We use OneSignal (OneSignal, Inc.) to send push notifications in the app (e.g. notices about movements, messages, important product information).

Processed data may include:

  • Device token or push ID
  • App version, operating system, device type
  • Language setting if applicable
  • Usage information in connection with the messages (e.g. open rate)

The purpose is to provide push notifications, insofar as you have activated them in your operating system or in the app.

The legal basis is your consent according to Art. 6 para. 1 lit. a GDPR, which you grant by activating push notifications. You can deactivate push notifications at any time in the system settings of your device or within the app.

Insofar as data is transferred to third countries (e.g. USA) in this context, this is done on the basis of suitable safeguards (e.g. standard contractual clauses). Details can be found in OneSignal's privacy policy.

12. Web and app analytics with PostHog (EU Cloud)

We use PostHog (PostHog Inc.) in the EU cloud variant to analyse the use of our website and app.

Processed data:

PostHog processes, among other things, usage data (e.g. visited pages/views, clicks, interactions with functions, navigation paths), technical data (e.g. device type, operating system, browser type, app version, screen size), truncated IP address or other technical identifiers as well as timestamps, session duration and events.

We configure PostHog to be as data economical as possible (e.g. IP anonymisation, no storage of unnecessary personal identifiers, insofar as technically feasible).

Purpose and legal basis:

The purpose is to improve our website, app and product functions, error analysis and the optimisation of the user experience. Insofar as we use PostHog via cookies or similar technologies that are not technically necessary, data processing is based on your consent according to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 TTDSG (website) via a consent tool.

Hosting and data transfer:

We use PostHog's EU cloud, so that data processing primarily takes place within the EU. Insofar as a transfer to third countries cannot be ruled out in individual cases, this takes place on the basis of suitable safeguards in accordance with Art. 46 GDPR (in particular standard contractual clauses). Further information on data processing by PostHog can be found in PostHog's privacy policy.

Withdrawal:

You can withdraw your consent to the use of PostHog at any time with effect for the future via the consent tool used on the website or via corresponding settings in the app.

13. Cookies and similar technologies

We use cookies and similar technologies (e.g. local storage, SDKs).

  • Technically necessary cookies/technologies serve to provide basic functions (e.g. login, security functions, language settings). The legal basis is Art. 6 para. 1 lit. f GDPR or § 25 para. 2 TTDSG.
  • Non-necessary cookies/technologies (e.g. for analysis with PostHog) are only used after your consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TTDSG).

Details on the type, purpose, storage duration and legal basis of the cookies used can be viewed at any time in the consent tool used.

14. Processors and recipients

We use the following service providers as processors: Hetzner Online GmbH (hosting of website, backend microservices and GPS tracking server Traccar, German data centre), base44 (app platform), Resend (email sending), Stripe (payment processing), OneSignal (push notifications) and PostHog (web/app analytics). Contracts in accordance with Art. 28 GDPR have been or will be concluded with all named service providers before going live.

A transfer to other third parties only takes place if this is legally permitted, necessary for performance of the contract, or you have consented.

15. Storage duration

Insofar as nothing to the contrary is stated in this declaration, we store personal data only as long as is necessary for the respective purpose or statutory retention periods exist.
After the purpose ceases to apply or the periods expire, the data is deleted or anonymised.

16. Data subject rights

Under the GDPR, you have in particular the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to certain processing (Art. 21 GDPR)
  • Right to withdraw consent given at any time with effect for the future (Art. 7 para. 3 GDPR)

To exercise your rights, you can contact us at any time at hello@paw-control.eu.

You also have the right to lodge a complaint with a data protection supervisory authority. For Paw Control, based in North Rhine-Westphalia, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia is in particular responsible.

17. Obligation to provide data

You are not obliged to provide personal data. For certain functions (e.g. registration in the app, use of trackers), however, the provision of certain data is required so that we can provide the service.

18. Automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

We use cookies to operate the website (necessary) and to improve statistics and marketing. You can accept or reject optional cookies at any time.