Audiorella

I. Name and address of the person responsible

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is the:

Audiorella GmbH

Tal 44

80331 Munich

Germany

E-mail: info@audiorella.com

Web-site: www.audiorella-data.com

II. General Information on Data Processing

1. Scope of Processing Personal Data

We process personal data of our users only to the extent necessary for providing a functional website and our content and services on our All-in-One Analytics Platform for Podcast Publishers.

2. Legal Basis for Processing Personal Data

When we obtain the consent of the data subject for processing personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for the performance of pre-contractual measures.

When processing personal data is necessary to fulfill a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

If the processing is necessary to protect vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis.

If processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, and the interests, fundamental rights, and freedoms of the data subject do not override the first-mentioned interest, Article 6(1)(f) GDPR serves as the legal basis for the processing.

3. Data Deletion and Retention Period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may occur further if required by European or national law, or regulations to which the data controller is subject. Data will also be blocked or deleted when the retention period required by the aforementioned norms expires, unless further retention of the data is necessary for the conclusion or fulfillment of a contract.

III. Provision of the Website and Creation of Logfiles

1. Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the calling device.

The following data is collected:

Information about the browser type and version used
The user's operating system
The user's internet service provider
The user's IP address
Date and time of access
Websites from which the user's system reaches our website
Websites that are accessed by the user's system through our website

The data is also stored in our system's logfiles. These data are not stored together with other personal data of the user.

2. Legal Basis for Data Processing

The legal basis for the temporary storage of the data and the logfiles is Article 6(1)(f) GDPR.

3. Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. To do this, the user's IP address must remain stored for the duration of the session.

The data stored in logfiles is necessary to ensure the functionality of the website. It also serves to optimize the technical aspects of the website and to ensure the security of our information technology systems. Data is not evaluated for marketing purposes in this context.

Our legitimate interest in data processing lies in these purposes according to Article 6(1)(f) GDPR.

4. Duration of Storage

The data is deleted once it is no longer needed for the purpose it was collected. In the case of data collected for the provision of the website, this is the case when the respective session is completed.

In the case of data stored in logfiles, this happens after a maximum of fourteen days. Further storage is possible, in which case the IP addresses of the users are deleted or anonymized so that identification of the calling client is no longer possible.

5. Right to Object and Removal

The collection of data for the provision of the website and the storage of data in logfiles is essential for the operation of the platform. Therefore, there is no right to object on the part of the user.

IV. User Accounts

1. Description and Scope of Data Processing

When creating and managing user accounts for employees of our customers and their partner companies, the following personal data of these individuals is collected:

Name
First name
Email address

2. Legal Basis for Data Processing

The processing of data is carried out under Article 6(1)(b) GDPR for the performance of the contract with the customer.

3. Purpose of Data Processing

The creation and management of personalized user accounts is necessary to ensure the security of our customers' corporate data.

4. Duration of Storage

The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected.

This is the case during the registration process for the fulfillment of a contract or for carrying out pre-contractual measures when the data is no longer required for contract performance. Even after the contract has been completed, it may still be necessary to store the personal data of the contractual partner to comply with contractual or legal obligations.

5. Right to Object and Removal

Objections to the processing of data and requests for deletion can be sent to our email info@audiorella-data.com. If the data is necessary for fulfilling a contract or pre-contractual measures, early deletion of the data is only possible if no contractual or legal obligations prevent deletion.

V. Contact Form and Email Contact

1. Description and Scope of Data Processing

Our website has a contact form that can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored. This data includes: first name, last name, email address, message text.

For data processing, your consent is obtained during the submission process, and reference is made to this privacy policy.

We also offer a contact option via the provided email address info@audiorella-data.com. If contacted via email, the personal data transmitted with the email will be stored.

No data will be passed on to third parties in this context. The data will only be used to process the conversation.

2. Legal Basis for Data Processing

The legal basis for processing the data is the user’s consent under Article 6(1)(a) GDPR.

The legal basis for processing the data transmitted in the course of sending an email is Article 6(1)(f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

3. Purpose of Data Processing

The processing of personal data from the input mask is solely for the purpose of handling the contact request. In the case of contact via email, the required legitimate interest in processing the data is also present.

4. Duration of Storage

The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent via email, this will be the case when the respective conversation with the user is concluded. The conversation is considered concluded when it is clear from the circumstances that the matter in question has been resolved.

The additional personal data collected during the submission process will be deleted after a period of seven days at the latest.

5. Right to Object and Erasure

The user has the right to withdraw their consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of contact will be deleted.

Objections to the processing of data and requests for deletion can be addressed to our email address info@audiorella-data.com. If the data is required for the performance of a contract or for pre-contractual measures, early deletion of the data is only possible if contractual or legal obligations do not prevent deletion.

VI. Data Transfers to Third Parties

1. YouTube

We maintain an online presence on YouTube to present our company and services and to communicate with customers/interested parties. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA.

Therefore, we would like to point out that there is a possibility that user data may be processed outside the European Union, especially in the USA. This can pose increased risks for users in that, for example, future access to the user data could be more difficult. Also, we have no access to this user data. The access is exclusively with YouTube.

YouTube’s privacy policy can be found at
https://policies.google.com/privacy
We use the YouTube API solely to enable our users to view YouTube analytics data (video views, likes, etc.) along with other analytics data. For this purpose, we only store YouTube channel data (ID, name, description), YouTube video data (ID, name, description), and YouTube analytics data.

We do not share or publish your data to third parties.

There are security procedures in place to protect the confidentiality of your data.

This service is provided under YouTube’s terms of service. These terms can be viewed at https://www.youtube.com/t/terms.

2. Stripe

We transfer to Stripe Payments Europe, Limited (SPEL), 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, based on Article 6(1)(b) GDPR for payment processing under the contract the following data: name, address, and payment data of customers.

Reference is made to the privacy policy of Stripe Payments Europe at https://stripe.com/de/privacy.

VII. Analysis of Data from Customer-Integrated Data Sources

Most of the analyzed data we receive is already in anonymized form from the data sources.

1. Scope of Processing Personal Data

When importing data from Spotify, the transferred naming and description of the podcast or individual episodes may contain personal data. The same applies to the naming and description of YouTube videos, as well as podcasts from other sources.

The data taken over by the Prefix service is stored for a period of two weeks, including web server log files containing the IP addresses of the visitors.

2. Legal Basis for Processing Personal Data

The legal basis for processing the personal data is Article 6(1)(b) GDPR.

3. Purpose of Data Processing

Processing the personal data of the data subjects allows us to analyze the behavior of users of our customers. By evaluating the collected data, we are able to compile analytical reports for customers.

4. Duration of Storage

The data will be deleted as soon as they are no longer needed for our recording purposes. In our case, this is after the termination of the contract with our customer.

5. Right to Object and Erasure

Objections to data processing and requests for deletion can be directed to our email address info@audiorella-data.com. If the data is required for the fulfillment of a contract or for pre-contractual measures, early deletion of the data is only possible if contractual or legal obligations do not prevent deletion.

VIII. Rights of the Data Subject

If personal data about you is processed, you are the data subject under the GDPR, and you have the following rights against the data controller:

1. Right of Access

You may request confirmation from the data controller as to whether personal data concerning you is being processed by us.

If such processing occurs, you may request the following information from the data controller:

the purposes for which the personal data is being processed;
the categories of personal data being processed;
the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
the planned duration for which the personal data concerning you will be stored, or, if specific details are not possible, criteria for determining the storage period;
the existence of a right to rectification or deletion of personal data concerning you, a right to restrict processing by the data controller, or a right to object to such processing;
the existence of a right to lodge a complaint with a supervisory authority;
all available information regarding the source of the data if the personal data was not collected from the data subject;
the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) GDPR, and – at least in such cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is being transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Article 46 GDPR in relation to the transfer.

Your right of access also extends to AI-based data processing, covering the processing activities and functionalities of the AI systems used for data processing.

2. Right to Rectification

You have the right to request rectification and/or completion of your personal data if the processed personal data concerning you is inaccurate or incomplete. The data controller must promptly make the correction.

3. Right to Restrict Processing

Under the following conditions, you may request the restriction of processing of your personal data:

if you contest the accuracy of your personal data for a period that allows the data controller to verify the accuracy of the personal data;
if the processing is unlawful and you oppose the deletion of personal data and instead request the restriction of the use of the personal data;
if the data controller no longer needs the personal data for processing purposes, but you require it for the assertion, exercise, or defense of legal claims; or
if you have objected to the processing pursuant to Article 21(1) GDPR, and it has not yet been determined whether the legitimate grounds of the data controller override your rights and freedoms.

If the processing of your personal data has been restricted, the data may only be processed – aside from storage – with your consent or for the assertion, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

If the restriction of processing is lifted under the conditions mentioned above, you will be informed by the data controller before the restriction is lifted.

4. Right to Deletion

a) Obligation to Delete

You may request the data controller to delete the personal data concerning you immediately, and the data controller is obligated to do so without undue delay if one of the following reasons applies:

The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw your consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for the processing.
You object to the processing according to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing according to Article 21(2) GDPR.
The personal data concerning you has been unlawfully processed.
The deletion of the personal data concerning you is necessary to comply with a legal obligation under Union or Member State law to which the data controller is subject.
The personal data concerning you was collected in relation to the offer of information society services according to Article 8(1) GDPR.

b) Information to Third Parties

If the data controller has made personal data concerning you publicly available and is required to delete it according to Article 17(1) GDPR, they shall, considering the available technology and implementation costs, take reasonable steps, including technical measures, to inform other data controllers processing the personal data that you, as the data subject, have requested the deletion of all links to, or copies or replications of, the personal data in question.

c) Exceptions

The right to deletion does not apply where the processing is necessary:

1) for the exercise of the right of freedom of expression and information;

2) for compliance with a legal obligation that requires processing under Union or Member State law, to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;

3) for reasons of public interest in the field of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR;

4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right mentioned under (a) is likely to prevent or seriously impair the achievement of the objectives of that processing, or

5) for the assertion, exercise, or defense of legal claims.

5. Right to Notification

If you have exercised your right to rectification, deletion, or restriction of processing against the data controller, the controller is obliged to inform all recipients to whom the personal data concerning you has been disclosed about the rectification, deletion, or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed about these recipients by the data controller.

6. Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the data controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another data controller without hindrance from the original data controller, provided that:

1) the processing is based on consent according to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR or on a contract according to Article 6(1)(b) GDPR, and

2) the processing is carried out by automated means.

In exercising this right, you also have the right to request that the personal data concerning you be directly transmitted by one data controller to another, where technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to the processing of personal data which is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

7. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.

The data controller will no longer process the personal data concerning you unless they demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to such direct marketing.

If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

You have the option to exercise your right to object in connection with the use of information society services – notwithstanding Directive 2002/58/EC – through automated means, using technical specifications.

8. Right to Withdraw Consent to Data Processing

You have the right to withdraw your consent to data processing at any time. The withdrawal of consent does not affect the lawfulness of the processing based on the consent before its withdrawal.

9. Automated Decisions in Individual Cases, including Profiling

You have the right not to be subject to decisions based solely on automated processing – including profiling – that produce legal effects concerning you or similarly significantly affect you. This does not apply if the decision:

1) is necessary for entering into or performing a contract between you and the data controller,

2) is based on Union or Member State law to which the data controller is subject, and such law provides appropriate safeguards for your rights and freedoms, or

3) is based on your explicit consent.

However, such decisions must not be based on special categories of personal data under Article 9(1) GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect your rights and freedoms and legitimate interests.

In cases (1) and (3), the data controller will take appropriate measures to safeguard your rights and freedoms, including at least the right to obtain human intervention from the data controller, to present your point of view, and to contest the decision.

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

Privacy policy

I. Name and address of the person responsible

II. General Information on Data Processing

III. Provision of the Website and Creation of Logfiles

IV. User Accounts

V. Contact Form and Email Contact

VI. Data Transfers to Third Parties

VII. Analysis of Data from Customer-Integrated Data Sources

VIII. Rights of the Data Subject

...

...