Privacy Policy

1. General

1.1

At Couda, we know how much you care about your personal information, so we have prepared this privacy policy to explain how we collect, use, and share it with third parties.

1.2

We want to show you that we handle your personal information in a confidential and responsible way and that any processing of your personal information happens in compliance with the General Data Protection Regulation ("GDPR") as well as local information privacy laws such as the Austrian data protection act ("DSG") and the California Consumer Privacy Act ("CCPA").

1.3

To avoid unauthorized access to your personal data and generally secure such data, we use encrypted transmission and encrypted storage. Those safety measures are constantly revised to comply with the latest technological developments.

1.4

We may update our privacy policy to reflect changes to our information practices. If we do this and the changes are material, we will post a notice that we have made changes to this privacy policy on the Websites for at least 7 days after the changes are made, ask for your consent, and indicate the date these terms were last revised at the bottom of the privacy policy. Any revisions to this privacy policy will become effective the earlier of (i) the end of that 7-day period or (ii) the first time you access or use the Services after any such changes.

2. Information we collect

When you register for, access, or use the Services, we process certain of your personal information (“Data” or “Information”).

2.1

If you visit the Websites, we process only Data that your browser communicates to our servers. We collect the following Data, which is necessary for us in order to display the Website correctly and guarantee the necessary stability and safety:

• IP address;
• date and time stamp;
• time difference to GMT;
• requested site;
• access status/HTTP status code;
• transmitted data volume;
• site from which the request was sent;
• browser;
• operating system and interface; and
• language and version of the browser software.

2.2

Depending on your choice of registration, we process the following Data:

Couda:

• email address and full name.

Apple single sign-on application:

• email address and full name (unless hidden)
• language, country, time zone;
• devices, browser, IP address;

Facebook single sign-on application:

• email address, full name, gender, age range;
• language, country, time zone;
• devices, browser, IP address;
• third-party ID; and
• profile picture, cover picture.

Google single sign-on application:

• email address, full name, gender;
• language, country, time zone;
• IP address; and
• profile picture.

2.3

When you make purchases in the Services, we process the following Data:

• country;
• credit card information; and
• subscription status.

2.4

When you use the Services, we process the following Data:

• when you launch, signup to, log into, and log out of the Services;
• when you purchase something in the Services; and
• what kind of tracks, courses, and exercises you complete.

3. Use of Information

3.1

The processing of Data pursues the following purposes ("Purposes"):

• providing the Services;
• customer relations management (e.g. support);
• marketing for our own products (newsletters, push messages);
• personalizing your experience of the Services;
• research and development;
• communicating with you about the Services;
• market, promote and drive engagement with the Services;
• ensuring safety and security; and
• protecting our legitimate business interests and legal rights.

3.2

The lawfulness of processing (Art. 6 GDPR) stems from

• the consent pursuant para. 1 subpara. a GDPR upon registration;
• the necessity for the performance of contract fulfillment pursuant para 1 subpara. b GDPR, as your Data is needed for a satisfactory use of the Services; and/or
• the necessity for the purposes of the legitimate interests pursued by the Company or by a third party.

4. Information we share

4.1

We transmit Data to third parties only if this is necessary for the Purposes, due to a request from a national authority, due to a court ruling, or if you have consented beforehand.

4.2

For some tasks we use the help of carefully chosen and instructed third parties (e.g. analytics services and tax advisors). Some of these third parties are based in the United States. Therefore, Data is transferred to third parties in third countries, all of which adhere to the EU-US privacy shield (see https://www.privacyshield.gov/welcome for more information):

• Facebook Inc., 1601 South California Ave, Palo Alto, CA 94304, USA (“Facebook”);
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”);
• Mixpanel Inc., 405 Howard St, 2nd Floor, San Francisco, CA 94105, USA (“Mixpanel”);
• Peaberry Software Inc., 921 SW Washington St, Suite 820, Portland, OR 97205, USA (“Peaberry”);
• Slack Technologies Inc., 500 Howard St, San Francisco, CA 94105, USA;
• Snap Inc., 63 Market St, Venice, CA 90291, USA;
• Stripe Inc., 185 Berry St, Suite 550, San Francisco, CA 94107, USA;
• TikTok Pte. Ltd., 201 Henderson Rd, Singapore 159545, Singapore; and
• Zendesk Inc., 1019 Market St, 6th Floor, San Francisco, CA 94103, USA.

5. Updating or deleting Information

5.1

We store your Data as long as you are a registered user of the Services. Where we retain information for Service improvement and development during your membership, we take steps to eliminate information that directly identifies you and we only use the information to uncover collective insights about the use of our Services, not to specifically analyze personal details about you.

5.2

After you have deleted your account we only store Data if it is legally necessary (because of warranty, limitation or retention periods) or otherwise required.

5.3

Data will be deleted if you (a) revoke your consent to the storage (b) Data is not needed to fulfill the user contract concerning the Services anymore, or (c) the storage is or becomes legally impermissible. A deletion request does not affect Data, if the storage is legally necessary, for example for accounting purposes.

6. Rights

6.1

To exercise the rights defined in Section 6.2 to 6.8, please send a request via email to the Email Address or via letter mail to the address provided in the legal notice on the Website (https://getcouda.com/legal).

6.2

You can revoke the consent for future data processing at any time. However, this does not affect the lawfulness of Data processing based on the consent before the revocation. Should the processing of Data be lawful due to another reason stated in 4.2, we may continue to process your Data on these grounds.

6.3

You have the right to obtain (i) confirmation as to whether or not your Data is being processed by us and, if so, (ii) more specific information on the Data. The more specific information concerns, among others, processing purposes, categories of Data, potential recipients or the duration of storage.

6.4

You have the right to obtain from us the rectification of inaccurate Data concerning you. In case the Data processed by us is not correct, we will rectify these without undue delay and inform you of this rectification.

6.5

If you decide you do not want us to process your data any further, please send a request via email to the Email Address or via letter mail to the address provided in the legal notice on the Website (https://getcouda.com/legal). We will erase your Data immediately and inform you of this process. Should mandatory provisions of law prevent such erasure, we will inform you without undue delay thereof.

6.6

You have the right to obtain from us a restriction of processing of your Data in the following cases:

• You make an inquiry pursuant para. 7.4, if you so request;
• you are of the opinion, that the processing of your Data is unlawful, but are opposed to an erasure of Data;
• you still require the Data for the establishment, exercise or defense of legal claims; or
• you have objected to the processing pursuant para. 7.8.

6.7

You have the right to (i) receive your Data in a structured, commonly used and machine-readable format and (ii) transmit those Data to another controller without hindrance from us.

6.8

You have the right to object at any time to the processing of Data based on our legitimate interests, including profiling and direct marketing purposes.

6.9

You have the right to lodge a complaint with a supervisory authority if you think that the processing of Data infringes applicable law, especially the GDPR.

7. Cookies

7.1

The Websites may use cookies, small text files that are placed on your computer, smartphone and/or stored by the browser. If the respective server of our Website is again accessed by you, your browser sends the afore received cookie back to the server. The server can evaluate the information received in this manner in various ways. Cookies can, for example, be used in order to manage advertisements on the Website or to facilitate navigation on a webpage.

7.2

You can disable the cookies by entering the corresponding settings in your browser software (e.g. in Internet Explorer, Mozilla Firefox, Opera, or Safari). However, in this case you may jeopardize the use of the complete range of functions on the Websites.

7.3

For additional information, please see our cookie policy.

8. Analytics

8.1 Google Analytics

General. For the Services, we use Google Analytics for Firebase ("Firebase"), a measurement solution that provides insight on app usage and user engagement. Opt-Out. You can opt out of certain Firebase features, e.g. mobile device identification, by changing the appropriate settings on your mobile devices. Purpose. We use Firebase to analyze the use of and improve the Services. Based on Firebase reports, we can identify friction points in the Services and measure how updates to the Services affect overall user behavior. Firebase is provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin 4, Ireland. For exceptional cases in which personal data is transferred to the US, Google is certified via the EU-US privacy shield. The legal basis for processing is Art 6 para 1 subpara f GDPR. The Firebase privacy policy can be found at https://www.firebase.com/terms/.

8.2 Adjust

General. For the Apps on iOS and Android we use the services of Adjust GmbH (Saarbrücker Str. 37a, 10405 Berlin, Germany, “Adjust”). Purpose and Opt-Out. Adjust allows us to us to track and analyze which marketing channels or sources are producing the best results for directing users to download the Services and to help us understand how our users are using the Services. For this purpose Adjust processes mobile identifiers such as the Google Advertising ID (“GAID”) and the ID for Advertising for iOS (“IDFA”)or similar mobile identifiers. For more information on Adjust, see https://www.adjust.com/privacy-policy/, especially section 3. To opt out of tracking by Adjust please go https://www.adjust.com/forget-device/. The basis for the processing is Art 6 para 1 subpara f GDPR.

8.3 Peaberry

General. We use SDKs (Software Development Kits) of Peaberry. We do not have any influence on the scope and the further use of the Data that is collected through these tools and hence inform you to the best of our knowledge. Purpose. We use Peaberry for staying in touch with you via emails for marketing purposes as well as to inform you of your progress, show you statistics or similar usage information. We use Peaberry to track if you open our emails and if you open content available in the emails. This helps us understand what content is well received and which is not (analytics). The basis for the processing is Art 6 sec 1 subsec f GDPA. Please see Peaberry’s privacy policy at https://customer.io/privacy-policy.html.

8.4 Facebook Analytics

General. For the Services and marketing optimization purposes, we use Facebook Analytics ("Facebook"). Opt-Out. You can opt out of certain Facebook features, e.g. mobile device identification, by changing the appropriate settings on your mobile devices. Purpose. We use Facebook to measure the performance of marketing campaigns and creatives. Based on Facebook reports, we can distinguish between profitable and unprofitable marketing campaigns and creatives. For more information on Facebook, see https://developers.facebook.com/docs/analytics. For cases in which personal data is transferred to the US, Facebook is certified via the EU-US privacy shield. The legal basis for the processing of Data is Art 6 sec 1 subsec f GDPA.

8.5 Mixpanel

General. We use SDKs of Mixpanel. We do not have any influence on the scope and the further use of the Data that is collected through these tools and hence inform you to the best of our knowledge. Purpose and Opt-Out. We use Mixpanel for the tracking of users and analyzing the use of our Services in the Apps. The basis for the processing is Art 6 sec 1 subsec f GDPA. Please see their privacy policy at https://mixpanel.com/legal/terms-of-use/, especially its point 4.6 on opting-out of the automatic data retention.

9. Contact

9.1

We are acting as the controller for the data processing within the meaning of the GDPR.

9.2

To understand more about the privacy policy, access your personal information, ask questions about our privacy practices, or issue a complaint, please contact our data protection officer within the meaning of the GDPR at privacy@getcouda.com.

This privacy policy was last modified on