Privacy Policy

If we have the pleasure of welcoming you as a customer, by using the App Catch, please read from section III .

If you visit our website, please read from Section II.

Welcome to our website! Please familiarize yourself with how we process your personal data when you visit our website (Art. 13, Art. 14 GDPR; section 165(3) TKG – Austrian Telecommunication Act).

When you visit our website, the following data may be processed:

• Email address

The processing of this data is necessary to ensure the secure operation of the website and to guarantee the website’s functionality from a technical standpoint. This data is collected in part via technical cookies. These technical cookies are used only to the extent necessary (Section 165(3) TKG). The processing of this data is justified by our legitimate interest in the operation of our website (Article 6(1)(f) GDPR).

For the operation of our website, it may be necessary for us to disclose your data to the following recipients:

Data Recipients

World4You Internet Services GmbH

Purpose of data processing

Website hosting

Legal basis for data processing

Predominantly legitimate interest (Art. 6(1)(f) GDPR); Data processing agreement pursuant to Art. 28 GDPR

Place of business

Austria

The data mentioned above is stored via so-called “cookies”¹ . Cookies are text files that are stored on your computer and enable an analysis of website usage. They serve to recognize and store temporary data about website visitors. We generally use cookies only to the extent necessary to communicate with you via the website.

These technical cookies are activated as soon as you visit our website.

The following cookies are used on our website based on our legitimate interest (Art. 6(1)(f) GDPR):

We do not use any technical necessary cookies

¹You can prevent cookies from being stored by adjusting the settings in your browser software. However, please note that in this case, you may not be able to use all features of this website to their full extent.

In addition to the “technical cookies” described above, we also use so-called advertising cookies (including “statistical cookies”). These advertising cookies enable us to better understand and analyze your interests. With the help of advertising cookies, we can combine your “browsing behavior” beyond the boundaries of our website with data from other websites. This enables us to better understand the interests of our website visitors and address them in a more targeted manner.

We respect that not every visitor to the website wishes this. Therefore, we process your data in connection with advertising cookies only if you consent to it (Art. 6(1)(a) GDPR). You may revoke this consent at any time, although the data processing carried out up to the time of revocation remains justified.

The following advertising cookies are currently used:

We do not use advertising cookies

When using the “Catch” app, the following personal data may be processed, depending on your settings:

• Name
• Email address
• Date of birth
• Gender
• GPS data collected
• Pace
• Photo
• Heart Rate – only with explicit consent

When using the app, the following recipients may receive personal data:

Data recipient

Entities providing technical support services and handling service requests to CatchWorld GmbH, acting on behalf of CatchWorld GmbH

Reason for data processing

Software development company contracted to build the Catch app

Legal basis for data processing

Legitimate interest (Art. 6(1)(f) GDPR) and data processing agreement pursuant to Art. 28 GDPR

Secure transfer to a third country

Within the EU

Data recipient

Apple Inc. (Apple Health)

Purpose of data processing

Recording Catch activities in Apple Health. Please note that health data is not used or shared for advertising, marketing, or use-based data mining. The app only writes completed activities to Apple Health and reads nothing back.

Legal basis for data processing

Consent pursuant to Article 6(1)(a) GDPR

Registered office of the data recipient

United States

Secure transfer to a third country

Please note that Apple Inc. is established in the United States. Please be aware that the United States may not provide the same level of data protection as the European Union. Apple Inc. is not listed under the EU–US Data Privacy Framework. The risks associated with transferring data to the United States include the possibility that US security authorities may access and evaluate your personal data. If you expressly accept these risks, the transfer of personal data will take place on the basis of Article 49(1)(a) GDPR, i.e. on the basis of your explicit consent.

Data recipient

Google LLC. (Android Health Connect)

Purpose of data processing

Recording Catch activities in Android Health Connect. Please note that health data is not used or shared for advertising, marketing, or use-based data mining. The app only writes completed activities to Android Health Connect and reads nothing back.

Legal basis for data processing

Consent pursuant to Article 6(1)(a) GDPR

Registered office of the data recipient

United States

Secure transfer to a third country

Google LLC is listed under the EU-US-Data Privacy Framework.

When using the app, we may receive personal data from the following sources:

Data recipient

Strava Inc

Reason for data processing

Internet service provider for tracking physical exercise

Legal basis for data processing

Legitimate interest (Art. 6(1)(f) GDPR)

Received data

GPS Data, Training history, Two-way Strava API sync

Source of data

Google LLC (Google Play Store)

Reason for data processing

Deployment of the App

Legal basis for data processing

Contractual obligations (Art. 6(1)(b) GDPR)

Secure transfer to a third country

Google LLC is listed under the EU-US-Data-Privacy Framework

Source of data

Apple Inc (App Store)

Reason for data processing

Deployment of the App

Legal basis for data processing

Contractual obligations (Art. 6(1)(b) GDPR)

The processing of the following personal data will only take place if you provide us with your explicit and voluntary consent (within the meaning of Art. 7 GDPR) for this purpose:

• - Health data

If we process your data based on your consent, you have the right to withdraw this consent at any time via email. This does not affect the lawfulness of the data processing carried out up to that point (Art. 7(3) GDPR).

If you choose to connect the Catch app to Apple Health (Apple HealthKit) on iOS or to Health Connect on Android, the app writes your completed activities to that health app on your device. The following data is written for each completed activity:

• Activity type
• Start time
• Duration
• Distance
• The recorded GPS route of the activity – only if you additionally grant the separate route permission

This connection is one-directional and write-only. The Catch app does not read any data from Apple Health or Health Connect and requests no read permissions for these health apps. On iOS, only write access to workout and workout route data is requested; on Android, only write access to exercise session, exercise route and distance data is requested.

The route permission is optional and independent of the connection itself. If you do not grant it, your activities are still written to your health app without the recorded route.

The data written in this way is stored on your device by Apple or Google and remains under your control. It is not stored in iCloud. You may revoke the permission at any time in your device settings, and you may disconnect the health app at any time using the disconnect function in the app. Once the permission is revoked or the health app is disconnected, no further data is written.

This connection is established only at your request: nothing is written to Apple Health or Health Connect unless you connect the health app and grant the corresponding permission. The processing is therefore based exclusively on your explicit and voluntary consent (Art. 6(1)(a), Art. 7 GDPR). You may withdraw this consent at any time in the manner described above. This does not affect the lawfulness of the data processing carried out up to that point (Art. 7(3) GDPR).

We do not use health or fitness data – including data written to Apple Health or Health Connect – for advertising or marketing purposes, and we do not disclose such data to any third party for advertising, marketing or use-based data mining. We do not sell health or fitness data. We use this data solely to provide the coaching and activity-tracking functionality of the Catch app.

In the course of our business relationship with customers and business partners, we process data based on contractual (execution of the contractual relationship with you, pre-contractual obligations, billing of services, sending of documents, communication for the execution of the contract) and legal obligations (legally required retention pursuant to § 132 BAO) (Art. 6(1)(b) and (c) GDPR) as well as based on our legitimate interests or the legitimate interests of third parties (Art. 6(1)(f) GDPR), namely:

• for the purpose of internal administration and management of your business transaction to the extent necessary (e.g., processing your business transaction, forwarding your business transaction to an assistant, filing, archiving, correspondence with you);
• for the purpose of providing the Catch app,
• due diligence reviews by potential investors,
• assertion and defense of legal claims

to the extent necessary in each case. The processing of your data serves to initiate, maintain, and conduct our business relationships. If you do not provide us with this data, we will unfortunately be unable to process your transaction.

Where applicable, we process your data based on your voluntary, explicit consent (Art. 6(1)(a) GDPR).

We will only store your data for as long as is necessary for the purposes for which we collected it. In this context, statutory retention obligations must be taken into account (for example, for tax reasons, contracts and other documents arising from our contractual relationship must generally be retained for a period of seven years (Section 132 BAO)). In justified individual cases, such as to assert or defend legal claims, we may also store your data for up to 30 years after the termination of the business relationship.

We retain personal data and account information securely in our database for as long as the user maintains an active account with us. We do not automatically delete your data over time, ensuring users' information and preferences are available whenever they log in. User's data is kept continuously until they explicitly request its deletion.

How to Request Data Deletion: Users have the right to request the complete deletion of their account and associated personal data at any time. Users can do this using either of the following methods:

- In-App Deletion: Open the app, navigate to [Settings > Delete Account ], and follow the on-screen prompts to instantly initiate the deletion of data.

- Web Form Deletion: If users prefer, or if they no longer have the app installed on their device, they can request data deletion by filling out our data deletion form at https://docs.google.com/forms/d/e/1FAIpQLSeGxAEZGSQI2JarQ5_qfnUeqWXuYbp4oFUlrdO_77UCYGza4w/viewform?usp=dialog .

The Deletion Process: Upon receiving the user's request via the app settings or our web form, we will permanently remove the user's account and all associated personal data from our active databases within 7-14 days. Please note that certain data may be retained in secure, anonymized backups for a limited time due to legal or regulatory requirements.

In the course of our business relationship, it may be necessary for us to transfer your data to the following recipients:

Recipients

Auditors and tax advisors (Zangrando-Jaklitsch Steuerberatungs GmbH & Co KG)

Purpose

Tax consulting

Legal basis

Contractual necessity

Country

Austria

Basis for transfer to a third country

Within the EEA

Recipient

Bank

Purpose

Payment processing

Legal basis

Contractual obligation

Country

Within the EEA

Basis for transfer to a third country

Within the EEA

Recipient

Attorneys, courts, dispute resolution (Dr. Tobias Tretzmüller Rechtsanwalts GmbH)

Purpose

Pursuit and defense of legal claims

Legal basis

Legitimate interests

Country

Austria

Basis for transfer to a third country

Within the EEA

Our company does not engage in automated decision-making or profiling.

We would like to inform you that, provided the legal requirements are met:

• You have the right to request information about which of your data we process (see Article 15 of the GDPR for details).
• You have the right to request the rectification or completion of inaccurate or incomplete data concerning you (see Article 16 of the GDPR for details).
• You have the right to erasure of your data (see Article 17 of the GDPR for details).
• You have the right to object to the processing of your data that is necessary to safeguard our legitimate interests or those of a third party (see Article 21 of the GDPR for details). This applies in particular to the processing of your data for advertising purposes.
• You have the right to receive the data you have provided in a structured, commonly used, and machine-readable format.

If we process your data based on your consent, you have the right to withdraw this consent at any time via email. This does not affect the lawfulness of the data processing carried out up to that point (Article 7(3) GDPR).

Should, contrary to expectations, your right to lawful processing of your data be violated, please contact us by mail or email. We will endeavor to address your concern promptly. However, you also have the right to lodge a complaint with the supervisory authority responsible for data protection matters in your jurisdiction.

The address of the Austrian Data Protection Authority is:

If you have any further questions about the processing of your data, please feel free to contact our Data Protection Coordinator using the contact information provided below.

The controller within the meaning of Article 4(7) of the GDPR is:

Author of this Privacy Policy: Attorney Dr. Tobias Tretzmüller, LL.M.; www.digital-recht.at

Any use of this privacy policy, or even parts thereof, without the author's consent constitutes a copyright infringement.