POLÍTICA DE PRIVACIDAD

Política de privacidad

Data protection and the private sphere of the users are very important to Goaly (hereinafter referred to as "Goaly"). The collecting and use of your personal data takes place exclusively within the framework of the statutory provisions of applicable data protection laws. With this data privacy policy, Goaly is providing information concerning the processing of personal data in the mobile applications (hereinafter referred to jointly as "Goaly apps" or simply "apps").

1 Point of contact

The point of contact and so-called responsible body for the lawfulness of the processing of your personal data under data protection laws is

Should you have any questions relating to data protection, you can get in touch with our company's data protection officer at any time. The data protection officer can be contacted at the postal address above, as well as by email info@goalyapps.com. The data protection officer is also available should you have any queries concerning the transfer of data to third countries and can provide copies or guarantees in the form of standard data protection clauses. Should you have any general concerns or queries, you can also contact Goaly by email at info@goalyapps.com.

2 Area of applicability

This data privacy policy applies to all Goaly apps with all content, functions and services, even if these only contain seasonal, short term or event related services within the operating systems which are offered (iOS, Android). Should you be interested in data protection on our websites, please read the Data Privacy Policy (web) of the Goaly websites.

3 Processing of personal data

Personal data will be processed before and during the downloading and installation of the apps and during handling with and without a registration. Personal data is information relating to factual or personal relationships of a defined or definable natural person. Above all, this includes information which allows your identity to be traced, for example name, address or email address. Statistical data which we collect during a visit to our apps for example and which cannot be connected to you does not come under the definition of personal data. Rather this is so-called anonymous data.

3.1 Processing before downloading and installing the apps

Before the app is downloaded, the marketing attribution may by calculated by Adjust. This is the case if the apps are not searched for and downloaded directly in the app store, rather when the user is redirected to the app store via an advert of our apps. In such a case, a connection of the advertising ID with Localytics and Adjust takes place before the downloading (see point 10 analysis and point 11 advertising).

3.2 Processing when downloading and installing the apps

In order to be able to download and install our apps from an app store (for example Google Play Store or Apple App Store), you need to register first with the provider of the app store for a user account and finalize a corresponding use contract with the provider of the app store. We have no control over this, in particular we are not party to such a use contract. When downloading and installing the apps, the necessary information in this respect will be transferred to the respective app store, in particular your username, email address and customer number of your account, the time of the download and the individual device number. We have no control over this data collecting and are not responsible for this. We only process this data which has been provided should this be necessary for downloading and installing the app on your mobile end device (for example, smartphone, tablet). Should this concern a chargeable Goaly app, we only process billing and payment data in order to carry out the purchase. In such as case, the legal basis is Article 6 Paragraph 1 b) GDPR.

3.3 Processing when using the apps without registration

You can use key parts of our apps without registration. Should you use the basic functions of our apps which do not require a registration, personal data is still processed, however.

The Goaly apps provide the following basic functions:

• Naming of a favorite team and the "following" of players, competitions and clubs
• Provision of content (text and video) on the basis of these preferences (if selected)
• Provision of the current results of football matches in the apps and via push notifications

In order to use the basic functions, the apps generate a number which is specific to the device when opened for the first time. This number cannot be assigned to a specific affected person (pseudonym). In addition, in order to technically display the named content, the operating system used (for example, Android or iOS), the hostname of the accessing device (IP address) and the time of the server request are processed.

Due to the way the Internet functions, the brief saving of the IP address is technically necessary. The IP addresses are deleted or anonymized after the processing. In case of anonymization, the IP addresses are changed in such a way that the affected person cannot be identified or can no longer be identified. On the basis of the anonymized IP address, a location search will be carried out. For reasons connected to data protection, this only takes place on the geographical level of the country from where the access is taking place. By means of this, it is not possible to trace the concrete location or place of residence of a user. If you have consented to specific advertising technologies described under §10, these may have more specific localization services in place.

The data in technical protocols (so-called log files) are evaluated by us in anonymized form in order to continually improve our apps and make them more user friendly, as well as in order to find and correct errors more quickly.

The data processing is necessary so that you can find out about the content of our apps. The legal basis is Article 6 Paragraph 1 f) GDPR, based on our interest in informing users of our content. The processing of the named data is necessary in order to provide the content. Otherwise, it is not possible for you to use the apps as requested.

3.4 Processing when using the apps with registration

You can use the apps both with and without registration. You can register with your account of a social network, in order to further personalize the apps. In addition, there is the option of uploading a profile picture and selecting a username. This takes place solely on a voluntary basis.

The Goaly apps therefore provide extended personalization functions in order to

• keep the settings concerning favorite teams and competitions up to data between different devices and
• to provide the apps with a profile picture and name

a) Via incorporated social media services, this personalization can be carried out by the user in the apps. For this purpose, Goaly uses the systems "Facebook Sign In" (a service of Facebook Inc, 1601 Willow Road, Menlo Park, California, 94025, USA) and "Google+ Sign In" (a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. A connection between the apps and the Facebook or Google account takes place. From Facebook, we save and process the email address, the URL of the profile picture, the name, the public profile and the token. From Google, we save and process the standard entitlements set by Google. These are the profile, JWT (token) and Google ID. We transfer our app ID to both services. These extended personalization functions are optional and you can remove the personalization and connection with the social media services in the app at any time. The purpose and scope of the data collecting and the subsequent processing and use of the data by the social media providers, as well as your rights and settings options in this respect concerning the protection of your private sphere can be found in the data protection notices of Facebook or Google.

b) You can register and sign in to our apps with "Sign in with Apple". "Sign in with Apple" is a service of Apple Inc. One Apple Park Way, Cupertino, California, USA, 95014. This will link your Apple ID and the Goaly apps together. You have the option to share or hide your email address in your iPhone settings. If you choose "share email address", we will receive the email address and name associated with your Apple ID. With hide e-mail address, Apple's email relay service, you can create a unique, random email address that forwards email to your home email address. This allows you to receive messages from the app without sharing your home email address with us.

We do not share any information with Apple; through your connection to Apple, your IP address is transferred to Apple. Responsible for the processing of personal data for individuals, within the European Economic Area, is Apple Distribution International ltd., Hollyhill Industrial Estate, Hollyhill Cork, Republic of Ireland. In the event that personal data is processed outside of the European Union, the provider has undertaken to comply with EU data protection standards. For more information about any data processing by Apple, please refer to the Apple Privacy Policy.

The legal basis is Article 6 Paragraph 1 f) GDPR, based on the legitimate interest of Goaly in providing extended functions for a more personal use experience. This is also the legal basis for the general processing when using the apps with registration, based on the legitimate interest in creating synchronization options between end devices and providing functions with social interaction options. Should you not wish to use the registration, the described functions cannot be used, however basic use of the apps is possible.

c) You can register using your email address. When you register by email, we collect the following data:

E-mail address

Name

The legal basis for this data processing is Art. 6 para. 1 b) GDPR.

We use Firebase. Firebase authenticates users with their email addresses and passwords. The Firebase Authentication SDK provides methods to create and manage users logging in with their email addresses and passwords. Firebase is a service provider of the company Google Inc. responsible for Google services in the European area in Google Ireland Limited.

If data is processed outside the European Union, Iceland, Liechtenstein and Norway, in so-called, third countries, Google uses so-called standard contractual clauses, Art 64 (2) & (3) DSGVO, which are based on the implementing decision of the EU Commission Google Privacy Policy: and the Google Ads Data Dissemination Terms

3.5 Processing when using the feedback/report content option

If you chose to give us feedback using the relevant features in the apps or website, we will use SurveyMonkey to process the information (SurveyMonkey Europe UC, 2nd Floor, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland). SurveyMonkey enables us to learn more about your enquiry and direct you to relevant articles in our FAQs. If there is yet to be a relevant answer listed then SurveyMonkey allows us to categorize your enquiry, helping us process it more quickly. SurveyMonkey will process your email address, country, device language, app version, OS version, device ID, device name, IP address, and the information you enter in the comments in case you are accessing the feature through the app. If you use the feedback option/"Report Content" feature on the website, only your email address, IP address and the information you provided will be processed.

The legal basis for the processing operations described above is Article 6 Paragraph 1 f) GDPR, based on our legitimate interest in improving our product and being accessible for our users.

3.6 Data processing as part of raffles

a) Raffles solely organized by Goaly

The data required for you to participate in the contest will be collected and stored by Goaly. This data will be used for the following purposes: To execute the contest, to notify prizewinners, and to clarify the shipping address for your prize. Unless otherwise stated, all data collected will be deleted after the conclusion of the contest.

b) Raffles organized by or in cooperation with a raffle partner

The data required for you to participate in the raffle will be collected and stored by Goaly. This data will be used for the following purposes: To execute the raffle, to notify prizewinners, and to clarify the shipping address for your prize. If the raffle partner is responsible for organizing and processing the prize (e.g. shipping, coordinating, or registrations), Goaly will provide the partner with the necessary information. The winner will be expressly notified of this disclosure at that time. If an option to subscribe to a newsletter is provided, your email address will also be collected by Goaly for the purpose of sending a subscription confirmation email. Goaly will collect the data required to sign up for the raffle partner's newsletter and forward it to the partner provided you have given your consent.

The legal basis is Article 6 Paragraph 1 f) GDPR, based on the legitimate interest of Goaly in providing error-free video and picture contents.

In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU.

4 Disclosure of personal data

In principle Goaly does not pass your personal data on to third parties. The data collected by us is only passed on to third parties, if this is necessary to provide the technical functionality of the apps or another legal basis for the disclosure of data exists. Personal data may only be used by our service providers in order to fulfil their tasks. These were carefully selected by us and engaged in writing. They are subject to our instructions and are regularly monitored by us. Other use of the information is not permitted and is not carried out by any of the service providers used by us. Alongside the service providers listed separately in this data privacy policy, data may be disclosed to individual categories of recipients, i.e. to companies in order to support promotions and special campaigns, as well as to external advisors and enforcement authorities.

5 Privacy Screen and Privacy Settings

In one of your first sessions on our apps, you will be presented with a Privacy Screen where you can choose whether you would like to consent to advertising or analysis technologies or not. The apps can be used without your consent to this data processing. You may refuse disclosure to all or some partners by clicking on “Info & Settings” in the Privacy Screen and then choosing “Disagree to all”. Your consent therefore is voluntary and may be revoked at any time by deactivating the relevant processing or all the processing using the switch under Settings - Info - Privacy Settings. In order to review the individual processes, please review our partners and processes in the Privacy Settings. There you will find detailed information about our partners with the links to their respective Privacy Policies and a list of purposes for which the apps process your data. In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. In case that personal data is transferred to other countries which do not have a reasonable level of data protection in accordance with the opinion of the European Commission, similarly the so-called "standard contractual clauses" have been agreed with the partner.

Please note: even if you do not give your consent, some of the partners listed in our Privacy Settings will perform some data processing. Such data processing is provided by the partners on the basis of Article 6 Paragraph 1 f) GDPR in accord with their legitimate interest in such data processing even without your consent. This processing involves, for example the production of statistics, anti-fraud measures, or false-click detection. This may also include data processing that is technically necessary.

If you have deactivated your advertising ID (see below under 12), the dialogue box and the Privacy Settings just described will not be displayed. Personalization of advertising and/or the use of the advertising ID is not possible and therefore a consent to data processing is not necessary. If you activate the use of your advertising ID by making settings in your operating system, you will also see the dialogue described above. If you are using a version of the app that was released before the version with the version number 12.6.0 (Android) and 13.8.0 (iOS), the privacy settings are not provided with Didomi but with a former consent management system. If your version is older than 11.8.0 (Android), 12.16 (iOS), the dialog described above will not be displayed at all. This means that you have NOT GIVEN your consent to the described procedures. This means that only those processing operations will be carried out which can be carried out without your consent.

6 Storage of personal data

Data which is collected for payment processes for chargeable apps is only saved by us for as long as it held to be necessary in order to fulfil contractual or legal obligations, i.e. until the expiry of the statutory limitation period for proof purposes for claims under civil law or due to statutory retention obligations. For proof purposes, we must retain data from payment processes for a further three years from the end of the year in which the business relationships end. Any claims are time-barred according to the regular statutory limitation period, at the earliest at this time. Also following this period, we need to save certain data for bookkeeping reasons. We are obliged to do this due to statutory documentation requirements under the German Commercial Code and German Tax Code. The retention periods for documents stated therein are up to ten years. Data which can be assigned to a device-specific number will be deleted at the latest after 5 years of inactivity.

7 Push notification

The apps use push notifications, which you can select, alter or fully deactivate yourself in the apps at any time. Below, we will explain to you - in separate terms according to the mobile operating systems for which we offer the app - how the activation or deactivation of the push notifications work. In order to be able to send you push notifications, we use the technology of Urban Airship Inc, 1417 NW Everett St, Suite 300, Portland OR 97209, USA.

a) iOS

Open the application "settings" of iOS and select the menu point "notifications". In the following menu, you can find an overview of all apps which are installed on your device and which support push functions. Select the corresponding Goaly app. You can activate or deactivate the push notifications as described here.

inside the apps, you can set your preferences and only receive push notifications relating to your selected topics. In order to do this, open the "notifications" which you will find under "settings". Here, you can find an overview of your push settings, such as club, national team or news which you can individualize in detail (for example receipt of messages concerning all match results or only in case of goals, etc.). Finally, you can select the push notification for various events and turn these on or off via the symbol with the bell, which you can find in the top right hand side of the screen for each game.

b) Android

Open the application "settings" in the Android operating system and select the menu point "notifications" under "sounds and notifications. In the following menu, you can find an overview of all apps which are installed on your device and which support push functions. Select the Goaly app. Here, you can activate or deactivate the push notifications. The names may differ slightly according to the Android version used.

In order to set your preferences for push notifications inside the apps, open the menu point "settings". Under "notifications", you can turn on or turn off push notifications for various events.

8 Permissions

For certain functions, the apps need to be able to access certain services and data of your device. Depending on which mobile operating system you use, this may require you express agreement to the accessing. Below, we will explain to you - in separate terms according to the mobile operating systems for which we offer the app - what authorisations the apps requests and what these are necessary for.

a) iOS

Push notifications: Should you click OK in the request "Enable push notifications" , you are permitting the apps to inform you of certain events and topics by means of push notification (for example a goal scored by your favourite team), even if the apps are not currently open. The notifications can take place by means of sounds, reports and/or symbol letter (a picture of a number on the app icon). Further information concerning push notifications and your configuration options can be found under number 6a). Background updating: This function enables the apps to download data in the background and to update this, even if the apps are not currently open or are not being actively used.

Mobile data: This function enables the apps to download and update data outside of a WLAN network via mobile data connections (for example GSM, UMTS or LTE). Camera use: We only request this permission if you wish to take and share a photo within the app. It goes without saying that we do not save the photos.

b) Android

Apart from the standard entitlements for the operation of Android apps (such as the receipt of internet access or the option of letting the device vibrate; also called "normal entitlements" by Google), we do not request any further entitlements. Using data which is saved on an external storage device: This function allows the app to save content on the storage card of your device. This is necessary in order to be able to provide content, for example relating to your favourite team, even if no Internet connection is currently present. For this purpose, the apps only use their own saved content. Other data on the storage card is neither deleted, altered or read.

9 Inclusion of videos

a) YouTube

We have included videos in our apps saved with YouTube which can be played directly from our apps. YouTube is a group company of Google and a service of YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. By means of the visit to our apps, YouTube is informed that you have accessed the corresponding sub-page. This takes place regardless of whether you are logged into YouTube or not. Should you be logged in to YouTube, your data is however assigned directly to your account. Should you not wish for this to take place, you need to log out before viewing the video. YouTube saves your data as usage profiles and uses these for the purposes of advertising, market research and designing its website in line with customer requirements. Such an evaluation takes place even for users who are not logged in. You can prevent the recording of this data by Google by de-activating the "personalised advertising on the web" button in the Google advertising settings. In this case, Google will only continue to display general advertising which was not selected on the basis of the information relating to you which was recorded.

In the cases where personal data is transferred outside of the European Union, the named providers have undertaken to comply with the data protection standards of the EU. The legal basis is Article 6 Paragraph 1 f) GDPR, based on the legitimate interest of Goaly in providing video and picture contents. The purpose and scope of the data collecting by YouTube, as well as the further processing and use of your data there and your rights and settings options for the protection of your private sphere in this respect can be found in the privacy policy of Google.

10 Analysis

In order to improve our apps, we use various technologies to analyze the usage behavior and to evaluate the associated data. These procedures take place anonymously or on the basis of pseudonyms, however never in a directly personal way. Below, we wish to explain these technologies and the providers used for this purpose in more detail. For this purpose, we use so-called number pixels with which we create statistics.

The legal basis is Article 6 Paragraph 1 f) GDPR, based on our legitimate interest in analyzing usage behavior in order to improve and further develop the apps.

11 Advertising

In order to showcase relevant adverts to our users, we use various advertising technologies. These procedures take place anonymously or on the basis of pseudonyms, however never in a directly personal way. In case you have consented to the processing, we, respectively our partners collect and process the Apple advertising ID (IDFA) on iOS devices and the Google advertising ID on Android devices in order to analyze and measure, select content and personalize advertisements. The advertising IDs are unique but not personalized and non-permanent identification numbers (see below 10.2 a) and b)) for a specified end device which are provided by the operating systems. In case you want to know more about our partners, check our Privacy Settings described in 5 above.

12 Deactivating Ad IDs

In addition to our Privacy Settings described under 5 above, you can also use settings in your operating system to prevent the delivery of personalized advertising. We will explain to you below - in separate terms according to the mobile operating systems for which we offer the app - how the activation or deactivation of the personalized advertising technologies (usage of advertising IDs) works. By deactivating you ensure that the delivered advertisement is no longer interest-based, as the Apple Ad-ID or Google Advertising ID is no longer used and information about your interaction with the app or advertisements can no longer be associated with an Advertising ID.

13 Your rights

You have the right to information about the processing of your personal data by us at any time. In this context we will explain the data processing to you and provide you with an overview of the data stored about you. If data stored by us is incorrect or no longer current, you have the right to have this data corrected. You can also request the deletion of your data. If, in exceptional cases, deletion is not possible due to other legal regulations, the data will be blocked - provided the necessary conditions are met - so that it is only available for this legal purpose. You can also have the processing of your personal data restricted if, for example, you doubt the accuracy of the data. Under certain conditions, you also have the right to data transferability, i.e. that we send you upon request a digital copy of the personal data you have provided us with. In order to assert your rights described here, you can contact us at any time using the contact details given above. This also applies if you wish to receive copies of guarantees to prove an adequate level of data protection.

Your inquiries regarding the assertion of data protection rights and our answers to them will be kept for documentation purposes for a period of three years and in individual cases for the assertion, exercise or defense of legal claims even beyond this period. The legal basis is Art. 6 Paragraph 1, f.) GDPR, based on our interest in defending against any civil law claims under Art. 82 GDPR, avoiding fines under Art. 83 GDPR and fulfilling our accountability under Art. 5 GDPR. You have the right to revoke a consent previously provided to us at any time. The consequence of this is that we will no longer process your data in relation to that consent in the future. The revocation of the consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation. If we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time for on grounds relating to your particular situation. If you object to data processing for direct marketing purposes, you have a general right of objection, which we will implement without requiring you to state your reasons for objecting. If you wish to exercise your right of revocation or objection, simply send an informal message to the contact details listed above.

How to delete your Goaly account?

Although we are sorry that you want to delete your account, we certainly want to make it easy for you to do so. In order to delete your account, please follow these steps: In order to proceed with your order, you must go through the proper channel. In your Profile tab, navigate to Settings From there, check the option:

"Delete account"

This way, we have all the necessary information we need to delete your account and your data. You will receive a message after having initiated the first steps and a second message once your data was finally deleted.

How to delete your Goaly account and data by e-mail ?

Send us an email to the account "info@goalyapps.com". As the subject of the email should be "I want Goaly to delete my account and data (GDPR)" and the body of the mail must have the username and the email with which the account was registered. This way, we have all the necessary information we need to delete your account and your data. You will receive a message after having initiated the first steps and a second message once your data was finally deleted.

Finally, you have the right to complain to the regulatory authority responsible for data. You can exercise this right at the regulatory authority in the member country of your place of residence, your place of work, or the place in which the violation allegedly took place. Changes to the data privacy policy We reserve the right to alter this data privacy policy. The current version can be accessed via our apps.

As of: Jul 2022