Privacy Statement

1. Introduction and Controller

This Privacy Statement explains how DIE KebApp processes personal data when you use our website, mobile application, restaurant-discovery functions, account features, location-based functions, QR-code and reward-validation functions, support channels, and beta services.

Controller
DIE KebApp is currently operated by Gbocho Alexandre David as a sole proprietorship (Einzelunternehmen) in Germany.
The establishment of a partnership under the Civil Code (Gesellschaft bürgerlichen Rechts – GbR) is currently in process with the registration authorities. Once the official registration and administrative formalities have been completed by the authorities, Ahmed Abdelhamid Youns Zeid will join Gbocho Alexandre David as a partner in the GbR, which will then assume the role of legal operator of DIE KebApp.
Until this formal transition is fully complete, Gbocho Alexandre David remains the controller responsible for the processing of personal data under applicable data-protection law.

Address
Brunnenstraße 113
13355 Berlin
Germany

Represented by
Gbocho Alexandre David
(currently sole proprietor; with Ahmed Abdelhamid Youns Zeid as future partner upon completion of the GbR formalities)

Email: kebapp030@gmail.com

For our legal notice, see our Impressum.

2. How We Process Personal Data

We process personal data only where this is necessary to provide and secure DIE KebApp, respond to you, comply with legal obligations, establish, exercise, or defend legal claims, or where you have given consent.

Depending on the relevant processing activity, we rely on the following legal bases:

• Article 6(1)(b) GDPR where processing is necessary to provide a service you request or to perform a contract with you;
• Article 6(1)(a) GDPR where you have given consent;
• Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation; and
• Article 6(1)(f) GDPR where processing is necessary for our legitimate interests in operating a secure and reliable service, preventing misuse, and establishing, exercising, or defending legal claims, provided that your interests or fundamental rights and freedoms do not override those interests.

Where we store information on, or access information from, your device, we comply with the applicable requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). Where consent is required, we obtain it before the relevant non-essential storage or access occurs.

We do not use Firebase Analytics, Google Analytics, advertising SDKs, marketing pixels, behavioural analytics, session replay, advertising attribution technologies, or cross-app tracking in the DIE KebApp mobile application.

We do not use personal data collected through the website or mobile application to create advertising profiles or to deliver personalised advertising.

3. Account, Contact, and Support Data

When you create or use an account, or contact us, we may process:

• Internal user ID;
• Email address;
• Optional display name;
• Account status and account-creation date;
• Authentication, login, and security information;
• Legal-document acceptance records;
• Privacy preferences and consent records; and
• Support messages and information you choose to send us.

Purpose and legal basis:
We use this data to create and manage accounts, authenticate users, provide requested functions, communicate with you, respond to support requests, protect the service, and prevent misuse. The legal basis is Article 6(1)(b) GDPR for account management and requested-service functions, and Article 6(1)(f) GDPR for security, misuse prevention, and the protection of legal claims.

Whether you must provide this data:
Your email address and authentication information are necessary to create and maintain an account. Your display name is optional. If you do not provide the data required for account creation, we cannot create or operate your account.
Support information is voluntary. However, we may be unable to investigate, verify, or resolve a support request if you do not provide the information necessary to understand the request.

Retention:
We retain account data for as long as your account remains active.
Following an account-deletion request, we delete or irreversibly anonymise applicable account data within 30 days, unless limited retention is necessary to comply with a legal obligation, prevent fraud or misuse, protect the security of the service, resolve a dispute, or establish, exercise, or defend legal claims.
Data remaining in protected backup systems is isolated from normal active use and removed in accordance with our applicable backup lifecycle and the retention periods of our service providers.

4. Precise Location for Nearby Discovery

DIE KebApp requests access to your device’s precise location only when you actively choose to use a location-based function, such as Nearby restaurant discovery.

Before requesting location permission through your device operating system, we provide a just-in-time explanation of why location is requested and offer a non-location alternative. You can search for restaurants by name, area, or address where that option is available.

We use your precise location to show restaurants and participating locations near you and to sort nearby results by distance. We do not access precise location in the background and do not operate DIE KebApp as a continuous location-tracking service.

For ordinary Nearby discovery, we do not store raw precise coordinates in our own database. Your device uses location information to request nearby results. Technical requests may be processed by the providers used to deliver relevant map or location functionality, as described in this Privacy Statement and their own privacy documentation.

Legal basis:
The legal basis for processing precise location is your consent under Article 6(1)(a) GDPR.
You give consent by actively choosing the relevant location-based feature and then granting location permission through your device. You may refuse location access without losing access to non-location features.
You may withdraw consent at any time by changing your preferences in:
Settings → Legal & Privacy → Privacy Preferences
You may also withdraw or revoke location permission through your device settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Location-Based Validation

If you choose to use a location-based event, challenge, promotion, or validation function, we explain the purpose at the point of use.

Where location is needed to confirm that an action occurred at or near a participating venue, we process only the minimum information necessary for the validation. Where technically possible, we store a validation result, venue identifier, timestamp, and fraud-prevention record rather than a persistent history of raw precise coordinates.

Purpose and legal basis:
We process this information to provide the validation function you choose, verify whether the relevant participation condition is met, prevent duplicate claims or fraud, resolve disputes, and secure the service.
The legal basis is Article 6(1)(b) GDPR where validation is necessary for a feature you request. Where consent is required for the relevant location access, we rely on Article 6(1)(a) GDPR.

Retention:
We retain validation records for 30 days after the relevant event, challenge, or promotion ends.
We may retain limited information for longer only where necessary to prevent duplicate or fraudulent claims, resolve a dispute, comply with legal obligations, or establish, exercise, or defend legal claims. Such retained information is restricted to the minimum necessary data and reviewed periodically.

6. Restaurant Discovery and External Navigation

DIE KebApp displays restaurant and local-food information, including restaurant name, address, opening hours, events, voluntary promotions, and restaurant-provided or approved profile content.

When you use “Get directions”, we open the navigation provider you select. The app does not embed an external routing or navigation provider; “Get directions” directly launches the user’s installed navigation application (such as Google Maps, Apple Maps, or a generic geo-intent). We provide only the restaurant address or map location necessary to open the route. We do not intentionally include your email address, account ID, XP history, reward history, or other direct account information in a standard directions link. Furthermore, neighborhood geocoding is performed entirely locally on-device without querying external geocoding APIs.

Once you open an external navigation service, that provider processes information under its own privacy notice and terms. We do not control processing carried out by that provider after you move to its service.

7. Gamification, QR Codes, and Validation

DIE KebApp operates QR-code, event, reward, and participation validation through its own application logic and backend systems. We do not use an independent third-party QR-code, ticketing, or loyalty-validation provider for these functions.

Where you participate in available gamification, QR-code, event-code, or reward-validation functions, we may process:

• XP and points balance;
• Badges, achievements, challenges, and participation history;
• QR, event, reward, or participation-code status;
• Code generation and redemption status;
• Validation result, participating venue identifier, and timestamp; and
• Records necessary to detect duplicate redemption, fraud, misuse, or security incidents.

We use this information to provide the function you request, show your progress, validate participation, prevent misuse, respond to support requests, and protect the service.

The legal basis is Article 6(1)(b) GDPR for the requested function and Article 6(1)(f) GDPR for fraud prevention, security, and the establishment, exercise, or defence of legal claims.

XP means Experience Points. XP is not money, has no cash value, and does not itself create an entitlement to a discount, reward, payment, or other financial benefit.

Retention:
We retain these records while your account is active and for 30 days after the relevant activity ends. Limited records may be retained longer only where necessary for fraud prevention, security, a dispute, legal obligations, or legal claims.

8. Participating Restaurants

For QR, event, reward, promotion, or participation validation, we disclose to a participating restaurant only the information necessary to fulfil or reject the relevant action.

This may include:

• Whether the code or action is valid, invalid, expired, or already redeemed;
• The relevant event, reward, promotion, or participation action; and
• A short-lived technical validation reference where necessary.

The technical validation reference is designed to identify the relevant validation transaction. It is not your email address, complete account profile, complete XP history, complete location history, or a persistent identifier designed to allow a restaurant to track you across separate visits or campaigns.

Participating restaurants do not receive your email address, complete account profile, complete XP history, or complete location history through DIE KebApp’s standard validation interface.

We may provide participating restaurants with aggregated statistics, such as total validated interactions during a period or campaign engagement, only where designed not to identify individual users.

9. Website Access Logs and Essential Storage

We do not use advertising cookies, marketing pixels, behavioural advertising, or website analytics tools on our website.

Our website is hosted using Firebase Hosting, a service provided by Google. Depending on the contractual entity and service operation, Firebase services may be provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and/or Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

When you access our website, Firebase Hosting processes technical data necessary to deliver, secure, and operate the website. This may include your IP address, date and time of access, requested page or file, browser and device information transmitted by your browser, referrer information where transmitted, server response data, and security-related log data.

We process this data on the basis of Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable, and abuse-resistant operation of our website.

Retention of website access logs:
Google Cloud / Firebase Hosting edge and CDN access logs (IP address, request URL, timestamp, user agent) are retained by Google for security, DDoS protection, and cache diagnostics for a standard period of up to 30 days before automatic purge (automatically deleted thereafter).

We do not use third-party CDNs for fonts or icons.

10. Firebase and Other Service Providers

We use service providers only where necessary to operate DIE KebApp. Where a provider processes personal data on our behalf, we enter into a data-processing agreement where required by Article 28 GDPR.

Firebase / Google
Firebase Hosting is the only live Firebase service used in production.
The mobile application and backend do not use or bundle the Firebase SDK. In particular:

• No Firebase Authentication (handled via native Google/Apple OAuth and self-hosted backend JWTs);
• No Cloud Firestore or Realtime Database (uses PostgreSQL);
• No Cloud Storage for Firebase (all assets bundled in-app);
• No Cloud Functions for Firebase (uses containerized Dart Shelf API on Cloud Run);
• No Firebase Cloud Messaging (FCM); and
• No Firebase Analytics, Crashlytics, or App Check.

Depending on the Firebase products enabled (Firebase Hosting for website delivery), Firebase may process:

• Technical request data; and
• Logs necessary to provide, secure, and operate the relevant Firebase hosting service.

We do not use Firebase Analytics.

Firebase customers generally act as controllers for end-user personal data provided to Firebase, while Google processes relevant customer data under the applicable Firebase data-processing terms.

Other recipients
We may also use the following recipients or categories of recipients where necessary:

• Website hosting provider: Firebase Hosting (Google Ireland Limited / Google LLC);
• Support & contact email: Google Workspace / Gmail (Google Ireland Limited / Google LLC) handling incoming correspondence to kebapp030@gmail.com;
• In-app map display: CARTO (CartoDB Inc., map data © OpenStreetMap contributors) for in-app map tiles (fetched from https://{s}.basemaps.cartocdn.com via flutter_map in map_tab.dart);
• External navigation provider: User-selected external navigation applications (such as Google Maps, Apple Maps, or generic geo-intent via url_launcher in shop_detail_screen.dart) launched directly on your device when you request directions;
• Professional advisers and insurers: where necessary for advice, insurance, or legal protection; and
• Public authorities, courts, and other legally authorised recipients: where required by law or necessary to establish, exercise, or defend legal claims.

We do not sell personal data.

11. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (“EEA”), including where data is accessed from or transferred to another country in connection with service provision, support, security, or operations.

Where personal data is transferred to a country outside the EEA for which the European Commission has not adopted an adequacy decision, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required.

Firebase provides data-processing terms and EU Standard Contractual Clauses for relevant controller-to-processor transfers.

You may request further information about the relevant transfer mechanism or safeguards by contacting us at kebapp030@gmail.com.

12. Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Statement.

The applicable retention periods or criteria are described in the relevant sections above. In particular:

• Account data is retained while the account remains active;
• Applicable account data is deleted or irreversibly anonymised within 30 days following an account-deletion request, subject to limited lawful retention;
• Standard QR, event, reward, and participation-validation records are retained for 30 days after the relevant activity ends;
• Security and fraud-prevention information is retained only for the period necessary to investigate, prevent, or respond to misuse and is reviewed periodically;
• Data required for legal obligations or legal claims may be retained for the applicable statutory retention or limitation period; and
• Backup data is retained only within the applicable backup lifecycle and is not used for normal active processing.

13. Your Data-Protection Rights

Subject to the conditions set out in applicable law, you have the right to:

• Obtain access to your personal data;
• Request correction of inaccurate or incomplete personal data;
• Request deletion of personal data;
• Request restriction of processing;
• Object to processing based on Article 6(1)(f) GDPR;
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• Receive certain personal data in a structured, commonly used, and machine-readable format where the right to data portability applies; and
• Lodge a complaint with a data-protection supervisory authority.

You can use the following privacy functions in the app:
Settings → Legal & Privacy → Download Your Data
Settings → Legal & Privacy → Delete Account
Settings → Legal & Privacy → Privacy Preferences

You can also contact us at kebapp030@gmail.com.

To protect your data, we may request information necessary to verify your identity before responding to a request.

Our competent supervisory authority is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
https://www.datenschutz-berlin.de/

You may also lodge a complaint with the supervisory authority in the EU/EEA country of your habitual residence, workplace, or the place of the alleged infringement.

14. Data Export and Account Deletion

You can request a copy of your personal data through the app or by contacting us.

After verifying your identity, we provide a secure export of the personal data associated with your account, where applicable. This may include:

• Account information;
• Privacy preferences and consent records;
• XP and gamification history;
• QR or redemption history; and
• Location-related records that we actually hold.

You can initiate account deletion in the app.
Signing out ends only the active session on your device. Account deletion requests deletion or anonymisation of applicable account data.

Following an account-deletion request:

• Applicable account and feature data is deleted or anonymised within 30 days;
• Active codes, rewards, promotions, and event participation may become unavailable; and
• Limited information may remain only where necessary for legal obligations, security, fraud prevention, backup rotation, disputes, or legal claims.

We respond to valid privacy requests without undue delay and normally within one month, subject to the GDPR conditions for extension or refusal.

15. Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

16. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, misuse, or disclosure.

Depending on the function concerned, these measures may include:

• Encryption in transit using TLS;
• Access controls and role-based permissions;
• Authentication controls;
• Server-side validation;
• Security logging;
• Backup and recovery measures;
• Measures intended to detect duplicate QR-code redemption, fraud, and misuse; and
• Incident-response procedures.

No system can be completely secure. We review and improve our safeguards in light of the risks associated with our processing.

17. Children and Young People

DIE KebApp is available to users of all ages.

We design our services so that they can be used without unnecessary collection of personal data. We do not knowingly use children’s personal data for behavioural advertising, advertising profiling, or cross-service tracking.

Where we rely on consent to process personal data in connection with an information-society service offered directly to a child, and the user is under 16 years of age in Germany, that consent must be given or authorised by the holder of parental responsibility, where required by applicable law.

This may apply, in particular, to optional features based on consent, such as the processing of precise location for Nearby discovery or optional location-based validation features.

If you are a parent or guardian and believe that a child has provided personal data or consent without the required authorisation, please contact us at kebapp030@gmail.com. We will review the request and take appropriate action in accordance with applicable law.

18. Changes to This Privacy Statement

We may update this Privacy Statement when our services, technical setup, service providers, or legal obligations change.

We will publish the current version in the app and on our website. Where a change materially affects your rights or requires consent, we will provide appropriate notice and obtain consent where required before the relevant new processing begins.