Privacy Statement for the FoxMobile App

Who is responsible for processing my data?

Responsible for processing your data is:

FoxInsights GmbH Ganghoferstraße 66e 80339 Munich, Germany Phone: 089 21540220 Email: info@foxinsights.ai

If you have questions or suggestions, you can reach us using the contact details listed above.

How can I contact the Data Protection Officer?

You can reach our Data Protection Officer at datenschutz@foxinsights.ai. They are happy to assist you with any questions regarding data protection.

How is my data processed when I download and use the app?

We only collect and process your data if we have obtained your consent to the data processing or if the processing is permitted by law.

Data processing when downloading the app

If you download our app from an app store, the information required for this — in particular your account's username, email address and customer number, the time of the download, payment information, and the individual device identifier — is transmitted to the app store. This is not carried out by us, but as part of your usage relationship with the respective app store. We have no influence over this data transmission. For further information, please refer to the privacy notices of the respective app store.

Collection of technically necessary data and log files when using our app

When you install the app, the following identifiers of your mobile device are automatically transmitted to us:

• Device ID (the app's ID (iOS Vendor ID or Android Advertising ID [GAID])
• App version (clientApplicationVersion)
• App operating system version (clientOsVersion)
• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Volume of data transferred in each case
• Website from which the request originates

This data is collected and processed to ensure the app's functionality, to maintain and improve its stability, and for security reasons. The legal basis for this processing is Art. 6(1)(b) and/or (f) GDPR. The data is deleted as soon as it is no longer required for the purposes stated above. Where an IP address is stored, it is deleted or anonymized after 7 days at the latest. The collection of this data and its storage in log files is mandatory for using the app. There is therefore no possibility for the user to object.

Permissions

The app requests the following permissions and uses them for the purposes shown below:

• Bluetooth — Providing a connection to the FoxHardware
• Location — Required for Bluetooth use on Android

Collection of data for use of the product

The app only works in connection with a FoxHardware device, a level sensor for tanks or storage containers. Before you can use the app, you must connect your FoxHardware to the app. For technical reasons, the following data is automatically transmitted in the process:

• The system data (IP address, date, time, amount of data transferred, the operating system running on the accessing device, and a notification as to whether the process was successful) of the mobile device on which the app is running.

In parallel, the following data is transmitted after being entered by the user:

• Serial number of the FoxHardware
• Tank data
• Email address
• First and last name
• Password
• Postal code
• Country

Optional: full address, phone number.

The data listed above is recorded in the app, processed, and transmitted to the servers in SSL-encrypted form. There, it is processed and stored. The processing and storage of this data serves to technically enable your use of the app, in particular to correctly link your FoxHardware with our partners.

Collection of data during use of the product

After successful setup, the FoxHardware automatically connects to the mobile network or WiFi and periodically transmits the following data to the Fox Cloud, where it is processed and stored:

• Serial number
• IP and MAC address
• Software version
• Measured distance and temperature
• Battery level

Use of data

Insofar as your personal data is required for the establishment, content, or modification of the contractual relationship between you and FoxInsights, it is used exclusively to carry out the contracts concluded, for example to enable us to contact you.

Your personal data, which is required to enable you to use the services offered by FoxInsights, is used for the performance of the contract.

In addition, we anonymize your data and use it in anonymized form to improve the products we offer. This use, however, does not allow us to draw any conclusions about your identity.

The legal basis for this data processing is Art. 6(1)(b) GDPR.

Further processing of your data due to statutory requirements

Where we are subject to statutory obligations that require further processing of your data, we will also process your data for the purposes provided for by the legislator. The legal basis for this data processing is Art. 6(1)(c) GDPR in conjunction with the provision containing the respective statutory obligation.

Further processing of your data based on consent you have given

In addition to the purposes explicitly named here, data processing takes place if and to the extent that you have consented to data processing pursuant to Art. 6(1)(a) GDPR. The purposes of the data processing arise from the respective consent.

To which categories of recipients is my data transmitted?

We treat your data confidentially. Within FoxInsights GmbH, only the departments and employees who need it to fulfil the purposes stated above are given access to your data.

We only transmit personal data to third parties if this is necessary for the aforementioned purposes and legally permitted, or if you have previously given your consent. Our data processing generally takes place within the European Union. We currently use the following service providers:

• AWS EMEA SARL, Luxembourg (AWS cluster Frankfurt)
• Google LLC, Mountain View (CA), USA

We will inform you of any changes in good time and, where necessary, obtain any required consent for the transfer of data.

Is my data also transmitted to recipients in states outside the European Economic Area? How is an adequate level of data protection ensured?

We also transmit your data to service providers and vicarious agents located in third countries, where they carry out data processing. Compliance with an adequate level of data protection is ensured in all cases. All of our service providers in third countries process the data in accordance with our instructions and are contractually bound to do so. Specifically, we transmit your data to the following third countries:

IT service providers in the USA. The adequate level of data protection is ensured through an adequacy decision of the Commission (Privacy Shield) and/or concluded standard contractual clauses.

What should I be aware of, from a data protection perspective, when using links?

Our app may contain links to other providers, to which our data protection provisions do not extend.

How secure is my data?

We use technical and organizational security measures in line with the current state of the art to protect the data you provide to us against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security measures are continuously improved in line with technological developments.

What applies to children's data?

We strongly encourage parents and legal guardians to supervise their children's online activities. Children should not transmit personal data to us or use our apps without the consent of their parents or legal guardians. We do not knowingly request personal data from children and do not knowingly process such data.

What rights do I have regarding my data?

With regard to the processing of your personal data, you have the right under Art. 15 GDPR to request information about the data we process concerning you. You furthermore have the right to have data corrected under Art. 16 GDPR or deleted under Art. 17 GDPR, and to have processing restricted under Art. 18 GDPR. You furthermore have the right under Art. 19 GDPR to request the provision of the personal data you have provided in a structured, commonly used, and machine-readable format. With regard to the right to information, the restrictions under Section 34 of the German Federal Data Protection Act (BDSG) apply, and with regard to the right to erasure, the exceptions under Section 35 BDSG apply.

RIGHT TO OBJECT — ART. 21 GDPR

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR) or in the performance of a task carried out in the public interest (Art. 6(1)(e) GDPR), and where grounds arising from your particular situation exist against such processing, you have the right, pursuant to Art. 21(1) GDPR, to object to this processing.

In the event of an objection, we will no longer process your data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

You have the right to object — without restriction — pursuant to Art. 21(2) and (3) GDPR to any type of processing for the purposes of direct marketing.

You may raise your objection with us at any time, without any particular form being required. For the best possible processing, we ask that you use the following contact details: datenschutz@foxinsights.ai. Please note that you can only implement your objection to the use of tracking procedures in our app yourself. It is not technically possible to carry this out centrally. For every tracking procedure where you must implement the objection yourself, we have provided an explanation above.

Can I revoke consent I have given?

Where we process your data on the basis of consent you have given, you have the right to revoke your consent at any time. Your data will then no longer be processed for the purposes covered by the consent. Please note that the lawfulness of data processing carried out before the revocation is not affected by the revocation. For details on how to declare your revocation, please refer to the information above or the information contained in the respective consent. You are welcome to send your revocation to: datenschutz@foxinsights.ai

Here, your revocation will — where technically possible — be implemented centrally and directly, or you will be shown how to implement the revocation yourself, since a central implementation by us is not possible for certain technical procedures.

Do I have a right to lodge a complaint with a supervisory authority?

If you believe that the processing of your personal data infringes applicable law, you may, pursuant to Art. 77 GDPR, lodge a complaint with a data protection supervisory authority at any time. This applies without prejudice to any other administrative or judicial remedy.

Am I required to provide the data, or is provision necessary for the conclusion of the contract?

With the exception of the data technically necessary for using our app, any provision of data by you is voluntary. However, individual functions of the app may not work if you do not provide us with the data required for them. Should this exceptionally be otherwise, this is explicitly stated at the relevant point in this statement.

Can this information be changed? And if so, how will I find out?

Since our data processing is subject to change, we will also adapt our privacy information from time to time. We will inform you of any changes in good time. The current version of this privacy statement can be found at this location.

Last updated: November 2021