Privacy policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you use our website comeback-tracker.de, the Comeback app or the Comeback web portal. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in this privacy policy. Data processing in the app and the web portal is described in section 8.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the section “Information about the controller” in this privacy policy.

How do we collect your data?

Some of your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form.

Other data is collected automatically or after your consent when you visit the website by our IT systems. This is mainly technical data (for example internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and any other questions on the subject of data protection.

Analysis tools and third-party tools

When you visit this website, your surfing behaviour may be statistically analysed. This is done mainly with so-called analysis programs.

Detailed information on these analysis programs can be found in the following privacy policy.

2. Hosting

We host the content of our website, our app and our web portal with the following provider:

External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host. This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access data and other data generated via a website.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Article 6(1)(b) of the General Data Protection Regulation) and in the interest of secure, fast and efficient provision of our online services by a professional provider (Article 6(1)(f) of the General Data Protection Regulation). Where consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the General Data Protection Regulation and § 25(1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (German Telecommunications and Digital Services Data Protection Act), insofar as the consent covers the storage of cookies or access to information on the user’s end device (for example device fingerprinting) within the meaning of that Act. Consent can be revoked at any time.

Our host will only process your data to the extent necessary to fulfil its service obligations and will follow our instructions with regard to this data.

We use the following host:

Hostinger International Ltd.
61 Lordou Vironos Street
6023 Larnaca
Cyprus

We have concluded a data processing agreement with Hostinger pursuant to Article 28 of the General Data Protection Regulation.

3. General information and mandatory information

Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, the app or the web portal, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (for example when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website, in the app and in the web portal is:

Revenite UG (haftungsbeschränkt)
represented by the managing director Aron Brocher
Welscher Heide 19
51429 Bergisch Gladbach
Germany

Phone: +49 172 9575008
E-mail: aron.brocher@comeback-tracker.de

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (for example names, e-mail addresses or similar).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (for example retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons cease to apply.

General information on the legal bases of data processing

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) of the General Data Protection Regulation or Article 9(2)(a) of the General Data Protection Regulation if special categories of data pursuant to Article 9(1) of the General Data Protection Regulation are processed. In the case of express consent to the transfer of personal data to third countries, data processing is also based on Article 49(1)(a) of the General Data Protection Regulation. If you have consented to the storage of cookies or to access to information on your end device (for example via device fingerprinting), data processing is additionally based on § 25(1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz. Consent can be revoked at any time. If your data is required to fulfil a contract or to carry out pre-contractual measures, we process your data on the basis of Article 6(1)(b) of the General Data Protection Regulation. Furthermore, we process your data if this is necessary to fulfil a legal obligation on the basis of Article 6(1)(c) of the General Data Protection Regulation. Data processing may also be carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation. The relevant legal bases in each individual case are explained in the following paragraphs of this privacy policy.

Information on data transfers to the United States and other third countries

Some of the services we use are offered by companies that are based in the United States or may transfer data there. For the United States, an adequacy decision of the European Commission has been in place since 10 July 2023 (EU-U.S. Data Privacy Framework). It applies to companies certified under this framework. If a company is not certified, we base the transfer on the standard contractual clauses of the European Commission (Article 46(2)(c) of the General Data Protection Regulation). For each service in this privacy policy, we state the basis on which the transfer is made.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.

Right to object to data collection in special cases and to direct marketing (Article 21 of the General Data Protection Regulation)

IF DATA PROCESSING IS BASED ON ARTICLE 6(1)(E) OR (F) OF THE GENERAL DATA PROTECTION REGULATION, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21(1) OF THE GENERAL DATA PROTECTION REGULATION).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ARTICLE 21(2) OF THE GENERAL DATA PROTECTION REGULATION).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the General Data Protection Regulation, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, deletion and correction

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to correction or deletion of this data. You can contact us at any time regarding this and any other questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data was or is unlawful, you can request the restriction of data processing instead of deletion.
If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Article 21(1) of the General Data Protection Regulation, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a member state.

Encrypted transmission

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us, this website uses TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser begins with “https://” and by the lock symbol in your browser line. The app and the web portal also transmit all data in encrypted form.

If encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising e-mails

We hereby object to the use of contact details published as part of the legal notice obligation for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example through spam e-mails.

4. Data collection on this website

Cookies

Our websites use so-called “cookies”. Cookies are small data packages and do not cause any damage to your end device. They are stored on your end device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser.

In some cases, cookies from third-party companies may also be stored on your end device when you enter our site (third-party cookies). These enable us or you to use certain services of the third-party company (for example cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (for example the shopping cart function or the display of videos). Other cookies are used to analyse user behaviour or to display advertising.

Cookies that are required to carry out the electronic communication process or to provide certain functions you have requested (for example for the shopping cart function) (necessary cookies) are stored on the basis of Article 6(1)(f) of the General Data Protection Regulation, unless another legal basis is stated. We have a legitimate interest in storing necessary cookies for the technically error-free and optimised provision of our services. Where consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Article 6(1)(a) of the General Data Protection Regulation and § 25(1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz); consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

Insofar as cookies are used by third-party companies or for analysis purposes, we will inform you about this separately in this privacy policy and, where applicable, request your consent.

Server log files

Our host automatically collects and stores information in so-called server log files, which your browser or our app automatically transmits to us. These are:

browser type and browser version
operating system used
referrer address (the previously visited page)
host name of the accessing computer
time of the server request
IP address

This data is not merged with other data sources.

This data is collected on the basis of Article 6(1)(f) of the General Data Protection Regulation. We have a legitimate interest in the technically error-free presentation and optimisation of our services – for this purpose, the server log files must be recorded.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. Data is only passed on to the recipients named in this privacy policy, in particular to service providers acting on our behalf.

This data is processed on the basis of Article 6(1)(b) of the General Data Protection Regulation if your enquiry is related to the fulfilment of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the General Data Protection Regulation) or on your consent (Article 6(1)(a) of the General Data Protection Regulation) if this has been requested; consent can be revoked at any time.

The data you enter in the contact form will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (for example after your enquiry has been processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Enquiries by e-mail or phone

If you contact us by e-mail or phone, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. To fix errors in the app and to handle technical support requests, we pass on the necessary data, such as account data, the device number (IMEI) of the Comeback trackers used in your account and activation data, to our development partner Smartdings GmbH. To process e-mails, we also use Microsoft 365, our support system and the service “Claude” of Anthropic Ireland, Limited; details can be found in the following sections.

The data you send us via contact enquiries will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (for example after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

E-mail service Microsoft 365

We receive, store and send our e-mails via Microsoft 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data on our behalf on the basis of a data processing agreement pursuant to Article 28 of the General Data Protection Regulation. A transfer to the United States cannot be ruled out. It is based on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which Microsoft is certified, and additionally on standard contractual clauses.

Processing is based on Article 6(1)(b) of the General Data Protection Regulation if your enquiry is related to a contract, and otherwise on our legitimate interest in reliable e-mail communication (Article 6(1)(f) of the General Data Protection Regulation).

Support system

We process e-mail enquiries in our own support system at support.comeback-tracker.de. It retrieves the e-mails from our mailbox, creates them as cases and sends our replies. The system is also operated by Hostinger International Ltd., named in the section “Hosting”, which processes the data exclusively on our behalf. The legal basis is Article 6(1)(b) and (f) of the General Data Protection Regulation.

Processing of e-mail enquiries with the support of artificial intelligence

If you write to us at info@comeback-tracker.de, we may use the service “Claude”, an artificial intelligence system, to process your enquiry. In doing so, the content of your e-mail, including any file attachments and the information contained therein (for example name, e-mail address, order number, information about your device), is transmitted to the provider. The system categorises your enquiry and creates a suggested reply. Every suggested reply is checked and approved by an employee before it is sent.

The provider is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Anthropic processes the data exclusively on our behalf. We have concluded a data processing agreement with Anthropic pursuant to Article 28 of the General Data Protection Regulation. Processing may also take place on servers in the United States. This transfer is safeguarded by the standard contractual clauses of the European Commission (Article 46(2)(c) of the General Data Protection Regulation).

Anthropic does not use your data to train artificial intelligence models. Inputs and outputs are deleted at Anthropic within 30 days unless longer storage is required to enforce Anthropic’s usage policies or due to legal obligations. At our company, the storage period stated in the section “Enquiries by e-mail or phone” applies.

Processing is based on Article 6(1)(b) of the General Data Protection Regulation if your enquiry is related to the fulfilment of a contract or is necessary to carry out pre-contractual measures. In all other cases, it is based on our legitimate interest in fast, reliable and multilingual processing of your enquiry (Article 6(1)(f) of the General Data Protection Regulation). No decision based solely on automated processing within the meaning of Article 22 of the General Data Protection Regulation takes place.

You can object to processing with the support of artificial intelligence at any time, for example with a short note in your e-mail. We will then process your enquiry without this service. Further information can be found in Anthropic’s privacy policy.

5. Social media

Instagram

Functions of the Instagram service are integrated into this website. These functions are offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If the social media element is active, a direct connection is established between your end device and the Instagram server. Instagram thereby receives information about your visit to this website.

If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking on the Instagram button. This allows Instagram to assign your visit to this website to your user account. Please note that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by Instagram.

Where consent has been obtained, the above-mentioned service is used on the basis of Article 6(1)(a) of the General Data Protection Regulation and § 25 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz. Consent can be revoked at any time. Where no consent has been obtained, the service is used on the basis of our legitimate interest in the greatest possible visibility in social media.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Article 26 of the General Data Protection Regulation). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Facebook or Instagram. The processing by Facebook or Instagram that takes place after forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. The wording of the agreement can be found at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook or Instagram tool and for the data protection-compliant implementation of the tool on our website. Facebook is responsible for the data security of the Facebook and Instagram products. You can assert data subject rights (for example requests for information) regarding the data processed by Facebook or Instagram directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

The data transfer to the United States is based on the standard contractual clauses of the European Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.

Further information can be found in Instagram’s privacy policy: https://instagram.com/about/legal/privacy/.

6. Newsletter

Newsletter data

If you would like to receive the newsletter offered on the website, we need an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. Further data is not collected or only collected on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The data entered in the newsletter registration form is processed exclusively on the basis of your consent (Article 6(1)(a) of the General Data Protection Regulation). You can revoke your consent to the storage of the data, the e-mail address and its use for sending the newsletter at any time, for example via the “unsubscribe” link in the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the revocation.

The data you provide to us for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe or once the purpose no longer applies. We reserve the right to delete or block e-mail addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation.

Data stored by us for other purposes remains unaffected by this.

After you have been removed from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a block list if this is necessary to prevent future mailings. The data from the block list is used only for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the General Data Protection Regulation). Storage in the block list is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

7. Data processing for contract processing

Order processing with Billbee

For order processing, we use the following provider: Billbee GmbH, Arolser Straße 10, 34477 Twistetal, Germany.

Name, address and, where applicable, other personal data are passed on to the provider in accordance with Article 6(1)(b) of the General Data Protection Regulation exclusively for the purpose of processing the online order. Your data is only passed on to the extent actually necessary for processing the order.

Amazon Pay

If you select the payment method “Amazon Pay”, payment is processed via the payment service provider Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg (hereinafter: “Amazon Payments”), to which we pass on the information you provided during the ordering process together with the information about your order in accordance with Article 6(1)(b) of the General Data Protection Regulation. Your data is passed on exclusively for the purpose of processing the payment with the payment service provider Amazon Payments and only to the extent necessary for this. If cookies, i.e. small text files stored on the end device, are set when using Amazon Pay, this is done exclusively on the basis of your express consent pursuant to Article 6(1)(a) of the General Data Protection Regulation. You can revoke this consent at any time via the cookie settings on our website. Further information about the data protection provisions of Amazon Payments can be found at: https://pay.amazon.com/de/help/201751600

Apple Pay

If you choose the payment method “Apple Pay” of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the “Apple Pay” function of your end device running iOS, watchOS or macOS by charging a payment card stored in “Apple Pay”. Apple Pay uses security features built into the hardware and software of your device to protect your transactions. To approve a payment, you must enter a code you have previously set or confirm with “Face ID” or “Touch ID” on your end device.

For the purpose of payment processing, the information you provided during the ordering process together with the information about your order is passed on to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to carry out the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the success of the payment.

Insofar as personal data is processed in the transmissions described, processing is carried out exclusively for the purpose of payment processing in accordance with Article 6(1)(b) of the General Data Protection Regulation. Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time and whether the transaction was completed successfully. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve “Apple Pay” and other Apple products and services.

Further information on data protection with Apple Pay can be found at: https://support.apple.com/de-de/HT203027

Google Pay

If you choose the payment method “Google Pay” of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), payment is processed via the “Google Pay” function of your end device by charging a payment card stored in Google Pay or a payment system verified there (for example PayPal).

For the purpose of payment processing, the information you provided during the ordering process together with the information about your order is passed on to Google. Google then transmits your payment information stored in Google Pay in the form of a one-time transaction number to the originating website, with which a completed payment is verified. This transaction number does not contain any information about the real payment data of your payment methods stored in Google Pay, but is created and transmitted as a one-time valid numerical key. In all transactions via Google Pay, Google acts merely as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay.

Insofar as personal data is processed in the transmissions described, processing is carried out exclusively for the purpose of payment processing in accordance with Article 6(1)(b) of the General Data Protection Regulation. Google reserves the right to collect, store and evaluate certain transaction-specific information for every transaction made via Google Pay. This includes the date, time and amount of the transaction, merchant location and description, a description of the goods or services purchased provided by the merchant, the name and e-mail address of the seller and buyer, the payment method used and, where applicable, the offer associated with the transaction. According to Google, this processing is based on Article 6(1)(f) of the General Data Protection Regulation on the basis of the legitimate interest in proper accounting, the verification of transaction data and the optimisation and maintenance of the functionality of the Google Pay service.

Further information on data protection with Google Pay can be found at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

PayPal

Payment methods of the following provider are available on this website: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”).

If you choose a PayPal payment method, we pass on the payment data you provided during the ordering process (including name, address, invoice amount, currency and transaction number) as well as information about the content of your order to PayPal in accordance with Article 6(1)(b) of the General Data Protection Regulation. Your data is passed on exclusively for the purpose of processing the payment and only to the extent necessary for this.

If you choose payment in instalments via PayPal, you conclude the instalment credit agreement directly with PayPal. PayPal checks your creditworthiness under its own responsibility and may obtain information from credit agencies for this purpose. PayPal makes the credit decision; we only receive the information as to whether the payment has been approved. You can find out which data PayPal processes for this purpose and which rights you have vis-à-vis PayPal in PayPal’s privacy statement on paypal.com.

Stripe

If you choose a payment method of the payment service provider Stripe, payment is processed via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to which we pass on the information you provided during the ordering process together with the information about your order (name, address, payment data such as bank details or credit card number, invoice amount, currency and transaction number) in accordance with Article 6(1)(b) of the General Data Protection Regulation. Your data is passed on exclusively for the purpose of processing the payment with Stripe and only to the extent necessary for this. Further information on data protection at Stripe can be found at: https://stripe.com/de/privacy

8. Comeback app and web portal

What data we process

To use the Comeback app and the Comeback web portal (together: the service), you need a user account. In doing so, we process the information requested during registration, your login details as well as the activation codes and the trackers assigned to your account.

An activated tracker continuously transmits position and status data: position, speed, direction of travel and time, for permanently installed devices the ignition status, battery level and power supply, vibration and movement alarms, data on the mobile radio cell and signal strength as well as the device number of the tracker. We display this data to you in the app and in the web portal, for example as the current position, route history or alarm.

If you allow it in the settings of your smartphone, the app also shows your own location on the map. This location is only processed on your smartphone and is not transmitted to our servers. You can withdraw this permission at any time in the settings of your smartphone.

Purpose and legal basis

We process this data in order to provide the service in accordance with our terms of use. The legal basis is Article 6(1)(b) of the General Data Protection Regulation. To improve our products, we use exclusively non-personal product data. The data is not used for advertising purposes, sold or passed on to third parties for commercial purposes.

Locating vehicles used by other persons

If a vehicle that is used by other persons, for example family members or employees, is located, their location data is also affected. Secretly locating persons is not permitted. The user must inform these persons in advance and, where necessary, obtain their consent.

Storage location and recipients

The trackers transmit their data to our servers via a permanently installed SIM card of our mobile network service provider. We operate the app, web portal and database with Hostinger International Ltd., named in the section “Hosting”, in the data centre in Frankfurt am Main; backup copies are stored in France. For maintenance and troubleshooting of the app, our development partner Smartdings GmbH, Stuttgart, may access the data required for this purpose.

You can share access to a tracker with other Comeback accounts and revoke this sharing at any time. Sharing with recipients without an account is not provided for.

Map display with Google Maps

To display positions and route histories, we use the map service Google Maps of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in the app and in the web portal. When the map is loaded, your device establishes a connection to Google servers. In particular, your IP address, information about your browser or app and the displayed map section are transmitted to Google. A transfer to Google LLC in the United States cannot be ruled out. It is based on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which Google is certified. The map display is necessary for the locating function of the service. The legal basis is Article 6(1)(b) of the General Data Protection Regulation. Further information can be found in Google’s privacy policy: https://policies.google.com/privacy

Push notifications

For notifications, for example in the event of an alarm, we use the service Firebase Cloud Messaging of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf. For this purpose, an identifier of your smartphone for notifications (token) and the content of the notification are transmitted to Google. A transfer to Google LLC in the United States cannot be ruled out. It is based on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which Google is certified. The legal basis is Article 6(1)(b) of the General Data Protection Regulation. You decide in the settings of your smartphone whether you receive notifications; you can switch them off there at any time.

Downloading the app

If you download the app from an app store, for example from Google Play, the operator of the store processes the data required for this (such as your store account and the time of the download) under its own responsibility. We have no influence on this data processing. The data protection provisions of the respective store operator apply.

Storage period and deletion

Position and status data are automatically deleted 24 months after they were generated. We store account data for as long as your user account exists. If you delete your account in the app, all associated data will be deleted. You can request the deletion of individual periods or trips via info@comeback-tracker.de. Statutory retention obligations, for example for invoices, remain unaffected.

Activation codes that you buy from within the app are purchased via our online shop; section 7 on data processing for contract processing applies to this.

9. Analytics and advertising services

Management of your consent

When you first visit our website, we use a notice window to ask whether you consent to analytics and advertising services. For this purpose, we use the Complianz plugin, which runs on our own server; no data is transmitted to the manufacturer. We store your choice in a cookie on your end device so that we can take it into account on your next visit. The legal basis is Article 6(1)(c) of the General Data Protection Regulation in conjunction with § 25(2) No. 2 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (German Telecommunications and Digital Services Data Protection Act). You can change or revoke your consent at any time with effect for the future via the cookie settings on our “Cookie Policy (EU)” page, which is linked in the footer of every page.

Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With this tool, we manage which analytics and advertising services are loaded on our website. Tag Manager itself does not set any cookies and does not analyse any data. However, your IP address is transmitted to Google when it loads. A transfer to Google LLC in the United States cannot be ruled out; it is based on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which Google is certified. The legal basis is our legitimate interest in simple, consent-compliant management of these services (Article 6(1)(f) of the General Data Protection Regulation).

Google Analytics

With your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records how visitors use our website, for example pages viewed, length of visit, origin of the visit, device and browser used, approximate location (country and region, determined from the IP address) and actions such as adding a product to the shopping cart. For this purpose, cookies are stored on your end device. Google Analytics 4 does not store the IP address. We use the analyses to improve our website and our offering.

We use Google’s consent mode. As long as you have not given your consent, Google Analytics does not set any cookies. In this case, however, Google may receive signals without cookies, for example that a page has been viewed, and use them to estimate statistics.

A transfer to Google LLC in the United States cannot be ruled out; it is based on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which Google is certified. The legal basis is your consent (Article 6(1)(a) of the General Data Protection Regulation and § 25(1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz). Event data is deleted by Google after 14 months at the latest. Logged-in users of our website are not recorded. You can find more information in Google’s privacy policy: https://policies.google.com/privacy

Google Ads conversion tracking

With your consent, we use Google Ads conversion tracking from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you reach our website via an advertisement on Google and make a purchase there, Google and we use a cookie to recognise that the advertisement led to a purchase. We only receive aggregated figures, for example how many purchases resulted from an advertisement, and no information that would allow us to identify you personally. We do not use personalised advertising based on your visit (remarketing).

Google’s consent mode applies here as well: without your consent, no advertising cookies are set; however, Google may receive signals without cookies. A transfer to Google LLC in the United States cannot be ruled out; it is based on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which Google is certified. The legal basis is your consent (Article 6(1)(a) of the General Data Protection Regulation and § 25(1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz). You can manage your advertising settings at Google at https://adssettings.google.com.

Last updated: October 2026