Privacy Policy

§ 1 Controller

The controller responsible for the processing of personal data in connection with Mapnovi is:

Volkan Genc, sole proprietor, trading under the business names V-Momentum / Mapnovi, Wiesenstraße 11, 57537 Selbach, Germany.

Email: info@mapnovi.de

Website: mapnovi.de

For general support inquiries, the support address given on the website may also be used.

§ 2 General Information on Data Processing

We process personal data only to the extent necessary for operating our website and platform, performing our technical and administrative services, communicating with customers, invoicing, ensuring technical security, or complying with statutory obligations.

Mapnovi is directed exclusively at entrepreneurs. Nevertheless, the personal data of natural persons may be processed in the course of use, in particular that of sole proprietors, managing directors, contact persons, employees, authorized representatives, partners, and authors of publicly accessible reviews.

Personal data is processed only for specified purposes and only to the extent necessary for those purposes.

§ 3 Accessing the Website and Server Log Data

When you access our website or platform, technically necessary information may be processed.

This may include in particular:

• IP address,
• date and time of access,
• page or function accessed,
• browser type and version,
• operating system,
• referrer URL,
• device and connection information,
• technical log data,
• error messages, and
• security-relevant events.

Processing takes place for the technical provision of the website, to ensure stability and security, for error analysis, and to prevent misuse or attacks.

The legal basis is Art. 6(1)(f) GDPR.

Our legitimate interest lies in the secure, stable, and functional provision of our website and platform.

Server and security logs are deleted once they are no longer required for the purposes stated. Longer storage may take place to the extent necessary to investigate specific security incidents, pursue misuse, or assert or defend against legal claims.

§ 4 Hosting and Technical Infrastructure

To operate the website and platform, we use technical infrastructure and, where applicable, external hosting, database, storage, security, or software service providers.

These service providers may process, in particular, technical connection data, server logs, customer account data, and such information as is necessary to provide the respective technical function.

To the extent service providers process personal data exclusively on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Depending on the purpose, the legal bases for the underlying processing are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

§ 5 Order Submission and Contract Performance

When a customer submits an order via Mapnovi, we process the data required for the technical and administrative execution of the order.

This may include in particular:

• name or company name,
• name of a contact person,
• billing address,
• email address,
• telephone number, if provided,
• Google business profile,
• the affected business location,
• links to submitted reviews,
• screenshots of reviews,
• publicly visible review information,
• order number,
• processing status,
• dates of submission and processing,
• the customer's factual confirmation,
• the time of the factual confirmation,
• technical order and evidentiary data,
• the outcome of the process,
• invoice data, and
• payment status.

Processing takes place to receive and carry out the order, to technically submit the process initiated by the customer, and for status display, documentation, and invoicing.

The legal basis is Art. 6(1)(b) GDPR, to the extent the data of the person concerned is necessary to initiate or perform a contract with Mapnovi.

To the extent data is stored for the prevention of misuse, documentation, evidentiary purposes, debt enforcement, or defense against possible claims, processing is additionally based on Art. 6(1)(f) GDPR.

Our legitimate interest here lies in particular in documenting proper orders, preventing abusive use, and asserting and defending legal claims.

§ 6 Factual Confirmation Regarding Submitted Reviews

Under the standardized reporting procedure offered by Mapnovi, the customer confirms, to the best of their knowledge and after reasonable review of their own records, for each individual review submitted, that they are not aware of any customer, business, applicant, employment, or other actual contact to which the submitted review can be attributed.

The confirmation given by the customer, together with its timing and its association with the relevant order, is stored.

The confirmation serves to carry out and document the order initiated by the customer.

The confirmation does not constitute consent under data protection law, but rather a factual statement made by the customer in the course of performing the contract.

The legal basis for processing the customer's data is Art. 6(1)(b) GDPR.

To the extent the confirmation is stored for documentation, the prevention of misuse, or defense against possible claims, processing is additionally based on Art. 6(1)(f) GDPR.

Mapnovi does not conduct its own research into whether a customer, business, or other contact actually existed between the reviewer and the business.

§ 7 Processing of Personal Data of Review Authors

In the course of a customer order, personal data contained in a publicly accessible review may be processed.

This may include in particular:

• the reviewer's publicly visible name or profile name,
• the reviewer's publicly visible profile picture, to the extent necessary for identification,
• the star rating,
• the review text,
• the date of the review,
• the link to, or technical identification of, the review,
• publicly visible profile information, and
• information on whether the review remains publicly retrievable.

We limit processing to such data as is necessary for the technical assignment, submission, documentation, and follow-up of the process initiated by the customer.

Mapnovi does not conduct any independent legal or substantive assessment of the review author or their review.

The legal basis for processing the review author's personal data is generally Art. 6(1)(f) GDPR.

Our legitimate interests, as well as the legitimate interests of our customers, lie in particular in being able to,

• technically carry out the platform process expressly initiated by the customer,
• clearly identify the relevant publicly accessible review,
• technically assign and submit the factual statement given by the customer,
• document the processing status, and
• prevent misuse and unauthorized or duplicate billing, and provide evidence of processes.

In balancing these interests, we take into account in particular that only the data necessary for the relevant process is processed, that the review information concerned is already publicly accessible, that Mapnovi does not create comprehensive profiles of review authors, and that processing generally remains limited to the specific customer order.

The public accessibility of personal data does not, in itself, mean that it may be processed without limitation for any purpose.

§ 8 Information for Review Authors Pursuant to Art. 14 GDPR

To the extent a review author's personal data is not collected directly from them, it typically originates

• from the review made publicly accessible by the review author on Google or another platform, and/or
• from information, links, or screenshots transmitted to Mapnovi by the client.

The relevant data categories, purposes, and legal bases are set out in particular in Section 7 of this Privacy Policy.

Recipients may include in particular:

• the respective platform operator,
• technical hosting and software service providers,
• technical support and security service providers, and
• other recipients where applicable, to the extent a transfer is legally required.

Processing generally takes place only for as long as is necessary for the technical execution, documentation, and follow-up of the relevant process, and for legitimate evidentiary and defense interests.

To the extent individual notification of the review author is legally required under Art. 14 GDPR, it is provided in accordance with the applicable statutory requirements and deadlines.

To the extent a statutory exception to the individual notification obligation applies in a specific case, it is applied only under the statutory conditions applicable to it. In such cases, this publicly accessible Privacy Policy also serves as an additional transparency measure.

Review authors may contact us at any time at info@mapnovi.de to exercise their data protection rights.

§ 9 Special Categories of Personal Data

Mapnovi generally does not ask customers to submit special categories of personal data within the meaning of Art. 9 GDPR.

These include, for example, information about health, political opinions, religion, trade union membership, sexual orientation, or biometric data used to uniquely identify a person.

However, it may occur that a publicly accessible review contains such information.

We do not deliberately process such information and limit processing to what is technically and legally necessary.

Customers are asked not to provide Mapnovi with any additional sensitive personal data that is not required to carry out the order.

To the extent special categories of personal data are processed, this only occurs where, in addition to a legal basis under Art. 6 GDPR, a statutory exception under Art. 9(2) GDPR also applies.

§ 10 Transfer to Google or Other Platform Operators

To carry out the process initiated by the customer, the information required for this purpose is transmitted to Google or the respective platform operator via the intended or permitted reporting and communication channels.

The following may be transmitted in particular:

• the affected business profile,
• the specific review,
• its technical identification or link,
• the factual statement given by the customer, and
• other technically necessary order information.

Mapnovi does not create any independent legal justification for the report in this context.

Processing on the part of the respective platform operator takes place in accordance with that operator's own data protection provisions and responsibilities.

For Google services, depending on the service used, the relevant companies of the Google group may be recipients of the information.

Further information on data processing by Google can be found in Google's privacy policy.

The legal basis for transmitting the customer's data is Art. 6(1)(b) GDPR.

To the extent a review author's personal data is transmitted, processing is generally based on Art. 6(1)(f) GDPR and the legitimate interests described in Section 7.

§ 11 Business and Location Search

Mapnovi enables the search for, or assignment of, publicly accessible business profiles and locations.

To the extent technical services or interfaces of a platform operator are used for this purpose, search inputs, location or business information, and technically necessary connection data may be transmitted to the respective provider.

Processing serves exclusively to provide the user with the search and assignment function they requested.

The legal basis is Art. 6(1)(b) GDPR, to the extent the function is used in connection with the initiation of a contract or an order, supplemented by Art. 6(1)(f) GDPR based on our interest in a functional and user-friendly platform.

§ 12 Use Without a Customer Account

To the extent Mapnovi enables order submission without a customer account, we process the data provided by the customer to carry out the specific order, for communication, status provision, documentation, and invoicing.

Status information may be provided, for example, via email, an individual order link, or a comparable technical function.

The legal basis is Art. 6(1)(b) GDPR.

§ 13 Customer Account

When a customer account is set up, we process in particular:

• master data,
• email address,
• authentication and login data,
• stored orders,
• status information,
• communication information,
• invoicing and payment status,
• the time the account was created,
• the most recent logins, and
• security-relevant technical information.

Processing takes place to provide and secure the customer account and to manage orders.

The legal basis is Art. 6(1)(b) GDPR.

Security-relevant data may additionally be processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing unauthorized access and abusive use.

§ 14 Status Tracking

Mapnovi may show customers the processing status of their submitted processes.

The following status information may be used in particular:

• Received,
• Submission being prepared,
• Submitted,
• No longer publicly visible, and
• Completed without removal.

For status tracking, only the data required to assign and display the relevant process is processed.

The status information does not constitute a legal or substantive assessment of the review in question.

The legal basis is Art. 6(1)(b) GDPR.

§ 15 Communication by Email

If you contact us by email, we process the information transmitted with your message.

This may include in particular:

• name,
• company,
• email address,
• content of the message,
• order number,
• links to business profiles or reviews, and
• communication history.

Where the communication relates to an existing or prospective contract, processing takes place on the basis of Art. 6(1)(b) GDPR.

For other business inquiries, processing takes place on the basis of Art. 6(1)(f) GDPR.

Our legitimate interest lies in processing and documenting business inquiries.

§ 16 Communication via WhatsApp

Our website may offer a contact option via WhatsApp.

Using WhatsApp is voluntary. Alternatively, you may contact us by email at any time.

If you message us via WhatsApp, we process the data you transmit in order to handle your inquiry.

This may include in particular:

• telephone number,
• display name,
• profile information, to the extent released by you,
• message content,
• transmitted files, and
• times of communication.

Where the communication relates to the initiation or performance of a contract, processing by Mapnovi takes place on the basis of Art. 6(1)(b) GDPR.

For general business inquiries, it takes place on the basis of Art. 6(1)(f) GDPR.

In the course of its use, WhatsApp also processes data under its own data protection responsibility. We have no full influence over the scope and purposes of this independent processing by WhatsApp.

This may also involve the processing of data outside the European Union or the European Economic Area.

Further information can be found in WhatsApp's respective current privacy information.

We recommend not transmitting particularly sensitive information via WhatsApp.

§ 17 Invoicing and Payment Processing

For invoicing, accounting, and payment processing, the following data may be processed in particular:

• name or company name,
• billing address,
• email address,
• order and service data,
• invoice number,
• invoice amount,
• payment status,
• payment reference,
• outstanding claims, and
• accounting data required by law.

Processing takes place to perform the contract and for invoicing pursuant to Art. 6(1)(b) GDPR, as well as to fulfill statutory retention and bookkeeping obligations pursuant to Art. 6(1)(c) GDPR.

Where necessary, data may be transmitted to banks, payment service providers, accounting service providers, tax advisors, or other bodies involved in payment and invoice processing.

§ 18 Debt Collection and Legal Enforcement

In the event of outstanding claims or legal disputes, personal data may be processed and, where necessary, transmitted to attorneys, debt collection service providers, courts, authorities, or other bodies authorized for this purpose.

The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.

Our legitimate interest lies in asserting, enforcing, and defending legal claims.

§ 19 Cookies and Similar Technologies

Our website and platform may use cookies, local storage, or comparable technologies.

Technically necessary technologies may be used in particular to

• provide login sessions,
• ensure security,
• store settings,
• technically assign orders,
• provide a shopping cart or multi-step ordering process, or
• technically enable functions expressly requested by the user.

To the extent storing information on the end device, or accessing information already stored there, is strictly necessary to provide a digital service expressly requested by the user, no consent under § 25(2) TDDDG is required for this.

The subsequent processing of personal data takes place, depending on the purpose, in particular on the basis of Art. 6(1)(b) or (f) GDPR.

Cookies or comparable technologies that are not technically necessary, used for analytics, marketing, or tracking purposes, are only used after prior consent, to the extent such consent is legally required.

In these cases, the legal basis for accessing, or storing information on, the end device is § 25(1) TDDDG. The subsequent processing of personal data generally takes place on the basis of Art. 6(1)(a) GDPR.

Consent given may be withdrawn at any time with effect for the future via the privacy or cookie settings provided.

The categories used, and where applicable the specific non-essential services involved, are shown as part of the consent management tool.

§ 20 Service Providers and Recipients

Personal data may, to the extent necessary, be transmitted in particular to the following categories of recipients:

• hosting and infrastructure providers,
• software and database providers,
• email and communication service providers,
• payment and banking service providers,
• accounting and invoicing service providers,
• IT and security service providers,
• platform operators such as Google,
• attorneys or debt collection service providers, where necessary,
• authorities and courts where legally required, and
• other technical service providers, to the extent necessary to provide Mapnovi.

To the extent a service provider processes personal data exclusively on our behalf, a data processing agreement pursuant to Art. 28 GDPR is concluded, where legally required.

Service providers that process personal data for their own purposes and under their own responsibility are subject to their own data protection obligations.

§ 21 Data Transfers to Third Countries

In connection with certain technical or communication service providers, the processing of personal data outside the European Union or the European Economic Area cannot be completely ruled out.

Such a transfer only takes place where a legally permissible basis for it exists.

This may include in particular:

• an adequacy decision of the European Commission pursuant to Art. 45 GDPR,
• appropriate safeguards pursuant to Art. 46 GDPR, in particular EU standard contractual clauses, or
• another legally provided basis.

To the extent a provider is certified under an applicable adequacy decision, a transfer may be based on that adequacy decision.

§ 22 Storage Period

We store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

In particular, the following criteria apply to the storage period:

• Order data: until the order has been fully processed and invoiced, and beyond that where storage is necessary for evidentiary, warranty, limitation, or defense purposes.
• Factual confirmations: for as long as necessary to document the underlying order and to assert or defend possible claims.
• Review data: only for as long as necessary for the specific process, its documentation, invoicing, or legitimate evidentiary and defense purposes.
• Customer account data: generally until the customer account is deleted or closed, provided there are no statutory or legitimate grounds for further storage.
• Communication data: for as long as necessary to handle the relevant matter and, where applicable, to document the contractual relationship.
• Invoicing and accounting data: for the duration of the applicable statutory retention obligations.

Once the relevant processing purpose no longer applies, the data is deleted or anonymized, provided there is no statutory or other permissible basis for further storage.

§ 23 Deletion of Customer Accounts and Data

Customers may request the closure of a customer account or the deletion of personal data at info@mapnovi.de.

A right to deletion exists in accordance with the statutory requirements.

Immediate, complete deletion may in particular be excluded to the extent data is still needed

• to fulfill statutory retention obligations,
• to invoice outstanding orders,
• to enforce outstanding claims,
• to document a process,
• to prevent or investigate misuse, or
• to assert, exercise, or defend legal claims.

In such cases, processing is limited to the extent still permissible or necessary.

§ 24 Rights of Data Subjects

In accordance with the statutory requirements, data subjects have in particular the following rights:

• the right of access pursuant to Art. 15 GDPR,
• the right to rectification pursuant to Art. 16 GDPR,
• the right to erasure pursuant to Art. 17 GDPR,
• the right to restriction of processing pursuant to Art. 18 GDPR,
• the right to data portability pursuant to Art. 20 GDPR, to the extent its requirements are met,
• the right to object pursuant to Art. 21 GDPR, and
• the right to withdraw consent given, with effect for the future.

To exercise your rights, you may contact us at: info@mapnovi.de

Where there are reasonable doubts as to the identity of a requesting person, we may request additional information to the extent necessary to prevent the unauthorized disclosure of personal data.

§ 25 Right to Object Pursuant to Art. 21 GDPR

To the extent we process personal data on the basis of Art. 6(1)(f) GDPR, data subjects have the right, for reasons arising from their particular situation, to object at any time to the processing of their personal data.

We will then no longer process the personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing serves to assert, exercise, or defend legal claims.

Objections may be addressed to info@mapnovi.de.

§ 26 Withdrawal of Consent

To the extent processing is based on consent pursuant to Art. 6(1)(a) GDPR, such consent may be withdrawn at any time with effect for the future.

The withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

§ 27 Right to Lodge a Complaint with a Data Protection Supervisory Authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data.

The following supervisory authority is responsible in particular for our place of business:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, Germany.

Postal address: Postfach 30 40, 55020 Mainz.

Data subjects may also contact another data protection supervisory authority with jurisdiction under the applicable statutory provisions.

§ 28 No Automated Decision-Making by Mapnovi

Mapnovi does not make decisions based solely on automated processing within the meaning of Art. 22 GDPR that produce legal effects concerning a data subject or similarly significantly affect them.

Technical automations, for example in status displays, assignments, or notifications, do not constitute such automated decision-making.

Decisions by an external platform operator regarding the removal or non-removal of a review lie outside Mapnovi's area of responsibility and are governed by the respective platform operator's data protection and procedural provisions.

§ 29 Data Security

We take appropriate technical and organizational measures to protect personal data.

Depending on the type of processing, these include in particular:

• encrypted data transmission,
• access restrictions,
• authentication and authorization concepts,
• technical security measures,
• protection against unauthorized access,
• backup and recovery measures, and
• organizational requirements for handling personal data.

Our security measures are reviewed and adjusted in line with the state of the art, the scope of processing, and the respective risk involved.

§ 30 Changes to This Privacy Policy

We may amend this Privacy Policy where legal requirements, technical functions, the service providers we use, or our processing procedures change.

The version published on mapnovi.de at the relevant time shall govern.

In the event of material changes, we will update the Privacy Policy accordingly.