The controller responsible for processing of personal data is:

Apryl GmbH
Dircksenstr. 47
10178 Berlin

privacy@apryl.co

We have appointed an external data protection officer for our company: PROLIANCE GmbH, www.datenschutzexperte.de, Leopoldstr. 21, 80802, Munich, e-mail: datenschutzbeauftragter@datenschutzexperte.de. If you wish to contact our external data protection officer, please mention that your request relates to Apryl GmbH and refrain if possible from enclosing sensitive information such as a copy of an ID card with your request.

2.1 Logfiles

Each time the Website is visited, we collect personal data that the browser used to access the Website transmits to our server. In doing so, we collect the following access data, which is technically necessary for us to display our Website and to be able to offer our content through the Website, including the Apryl Benefits, as well as to ensure stability and security. The access data includes the IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (i.e. name of the specific website accessed), access status/HTTP status code, amount of data transferred in each case, referrer URL (previously visited page), operating system and its interface, language and version as well as type of browser software, notification of successful retrieval.  

We process the aforementioned data in accordance with Art. 6 para. 1 s. 1 lit. f GDPR to protect the legitimate interests of us or of third parties. In particular, we pursue the following legitimate interests:

• Ensuring IT security, in particular the security of the Website,
• Assertion of legal claims and defense in legal disputes.

In addition, we statistically evaluate the use of the Website by its visitors using the services of ZoomInfo (see section 9.3 (13)) and Google Analytics (see section 9.3 (3)).

2.2 Cookies, consent management tool

Within the framework of our Website and the Apryl Benefits we are using cookies to analyze how the Website is being used so we can improve our services and give Website visitors a more personalized experience and for statistical purposes. A cookie is a small data file that is sent to the respective device when a website is visited. When that website is visited again, the cookie allows it to recognize your browser. We also allow some of our service providers to use cookies on our Website.

We use the following types of cookies:

Technically necessary cookies. These cookies are necessary to make the Website easier for the visitors to navigate and provide access to its features. They also help us to make sure that the Website is working properly and fix any errors, and to personalize it to the visitors by remembering their preferences. Some functions of our Website cannot be offered without the use of cookies. These functions require the browser to be recognized again after switching pages. The legal basis for the use of technically necessary cookies is § 25 sec. 2 German Telecommunications and Telemedia Data Protection Act (TTDSG) and for the collection and processing of data collected and processed by means of such cookies is Art. 6 para. 1 s. 1 lit. f GDPR.

Analytics cookies. We use analytics cookies to help us understand things like how long visitors stay on our Website, what pages they find most useful, and how they arrived at our Website. To do so we use the services of Google Analytics (see section 9.3 (3)) and ZoomInfo (see section 9.3 (13)).

We have integrated a consent management tool (hereinafter “CMT”) on our Website. The CMT provides visitors of our Website with information on the cookies used and allows them to adjust the use of these in relation to certain service providers. Visitors can also use the CMT to grant and withdraw their consent to the setting of cookies. When they enter our Website and make settings via the CMT, a necessary cookie is placed on their device in which the settings they have made are stored. The CMT is used in accordance with § 25 sec. 1 TTDSG, Art. 6 para. 1 s. 1 lit. c GDPR to obtain and document given consent to certain data processing procedures and in accordance with Art. 6 para. 1 S. 1 lit. f GDPR, due to our legitimate interest in being able to offer a convenient way to control the processing of personal data.

Apryl informs that most web browsers allow to adjust cookie preferences in their settings. Some browsers also offer a “Do Not Track” (“DNT”) signal where preferences can be set regarding tracking and cross-site tracking. However, if the ability of websites to set cookies is limited, it may impair the overall user experience, as it will no longer be personalized.

3.1 Contact

When contacting us (e.g. via e-mail), we process the information provided to us (e-mail address, name, telephone number, if applicable, and the content of the inquiry) in order to respond to the inquiry. The legal basis of the processing is Art. 6 para. 1 s. 1 lit. b GDPR if the subject of the inquiry is (pre-)contractual information, in accordance with Art. 6 para. 1 s. 1 lit. f GDPR if Apryl has a legitimate interest to do so or in accordance with Art. 6 para. 1 p. 1 lit. a or Art. 9 para. 2 lit. a GDPR if we have been provided with information that serves neither (pre-)contractual purposes nor our legitimate interests and/or contains special categories of personal data (see section 4).

3.2 Newsletter

We will inform people who register for the Apryl newsletter with their e-mail address about us and our services. Only a valid e-mail address is required to register for the newsletter. We use the so-called double-opt-in procedure to register for our newsletter. This means that after registration we send an e-mail to the specified e-mail address in which we ask the recipient to confirm that he or she wishes to receive the newsletter. In addition, we store the IP addresses used and the times of registration and confirmation. The purpose of this procedure is to document the respective consent and, if necessary, to be able to clarify a possible misuse of personal data.

After confirmation, we process the respective e-mail address for the purpose of sending the newsletter. The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file via which technical information on the browser and operating system used by the recipient, as well as the respective IP address and the time of the respective retrieval of the newsletter, are processed. We also use this information to better understand the interests of newsletter recipients and to improve our newsletters and their content.

At the end of each newsletter there is a link that can be used to unsubscribe from the newsletter at any time. The newsletter can also be unsubscribed at any time by sending a message to privacy@apryl.co. Upon unsubscribing from the newsletter, the personal data stored for the purpose of providing the newsletter will be deleted, unless there is a legal obligation to retain such data.

The use of the web beacon is based on the respective newsletter recipient’s consent pursuant § 25 sec. 1 TTDSG. The legal basis for sending newsletters and evaluating the usage behavior of newsletter recipients is the respective consent pursuant to Art. 6 para. 1 s. 1 lit. a GDPR. The consent can only be withdrawn together for the use of the web beacon, the receipt of the newsletter and the evaluation of the usage behavior.

Apryl provides its services to eligible employees of Apryl´s cooperation partners (hereinafter referred to as the “Employer”). The employees´ eligibility will be determined by the respective Employer (hereinafter “Aspiring Members” or “Eligible Members”).

Eligible Members receive a budget from their Employer for the use of service providers´ services in the scope of the Apryl Benefits. The requirements for qualification as Aspiring or Eligible Members depend on the respective contract between Apryl and the Employer. If the Employer does not (currently) provide a budget, all eligible employees are hereafter referred to as Aspiring Members.

In the following, we provide information on the type, scope and purpose of the processing of personal data in connection with the use of Apryl Benefits, including the Member Portal in accordance with our General Terms and Conditions for Aspiring Members and Eligible Members. The use of the Apryl Benefits is voluntary. Apryl points out that for effective use, it is necessary for us to process personal data of Users that is as specific as possible and, in some cases, also very intimate. So-called “special categories of personal data” (Art. 9 GDPR) therefore also become relevant, in particular health data, data on sexual life or sexual orientation, which we may only process on the basis of the express consent of the Users concerned.

Sections 1 – 3, 7 – 10 shall apply for Users equally.

Due to technical differences in the implementation of the Apryl Benefits at the respective Employer, the data processing procedures may differ. The version applicable in each individual case will be communicated separately to Users by Apryl or the Employer.

4.1 Disclosure of personal data by the Employer

Where the eligible employees have given their consent to do so, the Employer provides us with the following personal data of the respective Aspiring Members and/or Eligible Members according to Art. 6 para. 1 s. 1 lit. a GDPR in the course of the cooperation and as applicable:

• Quantity of Aspiring Members and Eligible Members,
• first names and surnames,
• business e-mail addresses,
• staff numbers,
• the information that each Aspiring Member and Eligible Member is at least 18 years old;
• the information that each Aspiring Member and Eligible Member work a certain minimum number of hours per week for the Employer;
• in case the Employer is a multinational company: Countries of employment for each Aspiring Member and Eligible Member,
• as soon as known: employment end date of the respective Aspiring Member or Eligible Member.

Where the Employer provides a budget to Eligible Members also:

• the amount of the respective Budget, and
• the employment start date for each Aspiring Member and Eligible Member.

We require this information in order to identify the respective Aspiring Members and – where applicable – Eligible Members upon registration (section 4.2) and to be able to create an account for the use of the Member Portal (hereinafter “Member Account”). For multinational companies we need the country of employment to determine the scope of eligible services (as described in the Benefits Guide which employees receive at the beginning of the Apryl Benefits program) according to the law applicable in the respective country.

4.2 Registration in the Member Portal

When using the Member Portal for the first time, Aspiring Members and Eligible Members have to register with their respective business e-mail address and by choosing a password. As an option Aspiring Members and Eligible Members can choose to provide their private email address. We process this information in accordance with Art. 6 para 1 s. 1 lit. b GDPR in order to be able to offer the respective Aspiring Members and Eligible Members a secure and personal Member Account as well as individual consulting services with consideration for the local accessibility of service providers.

Aspiring Members and Eligible Members can voluntarily decide whether they would prefer to be contacted in the future via their private e-mail address instead of the business e-mail address. If a private e-mail address is stored, this is done on the basis of the express consent of the respective Aspiring Members and/or Eligible Members pursuant to Art. 6 para. 1 s. 1 lit. a GDPR. In this regard we use the so-called double opt-in procedure. This means that after registration, we send the respective Aspiring Member or Eligible Member an e-mail to the private e-mail address provided, in which we ask for confirmation that the e-mail address is actually to be used. This procedure is automated and we use the service of typeform SL in this regard (see section 9.3 (6)). If the registration is not confirmed within 24 hours, the respective e-mail address is blocked and automatically deleted after one month. In addition, we store the IP addresses used and the times of registration and confirmation. The purpose of the procedure is to be able to prove the respective registration and, if necessary, to clarify a possible misuse of personal data.

4.3 Using the Apryl Benefits

(1) Specification of personal information

After registration (section 4.2) and after the user agreement has been concluded according to the General Terms and Conditions for Aspiring Members and Eligible Members (hereinafter “User Agreement”), the following additional information of the Aspiring Members and Eligible Members will be requested:

• Date of birth,
• physical sex,
• optional: information about the desire to have children,
• information about partner situation,  

• optional: Gender identity.

We process the above information pursuant to Art. 9 para. 2 lit. a GDPR based on the express consent of the respective Aspiring Members and Eligible Members, which can be withdrawn at any time with effect for the future. However, we would like to point out that we can provide the Apryl Benefits most efficiently if we are able to process as much of this information as possible.

(2) Consultations and further communication with Apryl

Aspiring Members and Eligible Members can use the Member Portal to make an appointment for a telephone consultation with a competent Apryl employee. For this purpose, we use a service of the service provider Calendly LLC. In this process, the name of the respective Aspiring Member or Eligible Member as well as the date and time of the booked consultation are transmitted to Calendly LLC (for more information on Calendly, see section 9.3 (4)).

All information that Aspiring Members and/or Eligible Members provide to an Apryl employee in the context of a consultation, as well as the phone number used in each case, will be processed by Apryl in accordance with Art. 6 para. 1 s. 1 lit. b GDPR, insofar as this is necessary for the provision of Apryl’s services in accordance with the User Agreement and/or in accordance with Art. 6 para. 1 s. 1 lit. a or Art. 9 para. 2 lit. a GDPR (insofar as it concerns special categories of personal data) based on the express consent of the Aspiring Members and Eligible Members.

Such information may include, in particular (as applicable):

• Type and name of health insurance,
• partner status (single, registered partnership, married, etc.),
• cycle dates,
• contraceptive methods,
• desire to have children,

• pre-existing medical conditions.

In addition, the e-mail addresses of the Aspiring Members and Eligible Members (if specified, private, otherwise business e-mail) can also be used by Apryl to provide them with information on the specific contractual relationship between Apryl and the respective Aspiring Member or Eligible Member in accordance with Art. 6 para. 1 s. 1 lit. b GDPR, as well as for advertising purposes (see section 4.6).

(3) Partner Agreement

Within the scope of the User Agreement Apryl Benefits can also be used by a partner of an Aspiring Member or Eligible Member. Where the Employer provides a budget to Eligible Members this also includes the reimbursement of costs for services and or products which are provided by service providers to or together with the Eligible Member’s partner. For this purpose, the respective Aspiring Member or Eligible Member and their partner have to submit the Apryl Partner Agreement. Within the scope of this Partner Agreement, the contact data of the respective partner (first name/last name, private address, telephone number) as well as the respective signature of the Aspiring Member or Eligible Member and their partner will be processed by Apryl in accordance with Art. 6 para. 1 s. 1 lit. b GDPR for the purpose of implementing the User Agreement.

In the event of a consultation with the partner, the personal data mentioned above under section 4.3 (1) and (2) will be processed by Apryl – as applicable. The processing is carried out in accordance with Art. 6 para. 1 s. 1 lit. b GDPR, insofar as this is necessary for the provision of services by Apryl in accordance with the User Agreement with the respective Member, and/or in accordance with Art. 6 para. 1 s. 1 lit. a or Art. 9 para. 2 lit. a GDPR (insofar as it concerns special personal data) based on the express consent of the partner to this.

(4) Contacting service providers through Apryl

Insofar as this is expressly requested by an Aspiring Member or Eligible Member and/or their partner, Apryl will contact the service provider selected in each case and transmit the necessary personal data of the Aspiring Member or Eligible Member and/or their partner to it in accordance with Art. 6 para. 1 s. 1 lit. b GDPR, insofar as this is necessary for the provision of services by Apryl in accordance with the User Agreement and/or in accordance with Art. 6 para. 1 s. 1 lit. a or Art. 9 para. 2 lit. a GDPR (insofar as special categories of personal data are involved) on the basis of the express consent of the data subject in each case.

The transmitted information includes in particular the following:

• First name and surname,
• physical sex,
• date of birth,
• home address,
• phone number
• statutory or private health insurance
• e-mail address (business e-mail or, if voluntarily provided, private), and
• relevant additional information such as pre-existing medical conditions.

The consulting Apryl employee will always inform the Aspiring Member or Eligible Member and/or their partner in advance about the content of the personal data to be transmitted in each case.

4.4 Reimbursement of Eligible Members’ costs by the Employer

In order for an Eligible Member to be able to claim their budget within the framework of the Apryl Benefits, Apryl determines the respective amount on the basis of the invoices submitted by the Eligible Member and/or other documents from which the eligible services clearly result, as well as from declarations of the competent health insurance company, if applicable. This processing is carried out in accordance with Art. 6 para. 1 s. 1 lit. b GDPR, insofar as this is necessary for the provision of services by Apryl in accordance with the User Agreement and/or in accordance with Art. 6 para. 1 s. 1 lit. a or Art. 9 para. 2 lit. a GDPR (insofar as special categories of personal data are involved) based on the express consent of the data subject in each case.

Subsequently, Apryl informs the Employer in accordance with Art. 6 para. 1 s. 1 lit. b GDPR to what extent the Eligible Member has used their budget. However, the Employer does not receive any further information (see also section 9.1).

4.5 Analysis of the use of the Member Portal

Apryl collects statistical data on the use of the Member Portal by Aspiring Members and Eligible Members (and their partners, if applicable), which will be reported to the Employer in aggregated form and no conclusions can be drawn about the individual Aspiring Member or Eligible Member and their partner. This includes, for example, the following information:

• Number of registered Aspiring Members and/or Eligible Member,
• number of active Aspiring Members and/or Eligible Members (log-ins),
• number of booked phone consultation,

• amount of budget used by all Eligible Members of the respective Employer.  

For the evaluation, we use the analytics processor Heap Analytics in accordance with Art. 6 para. 1 s. 1 lit. a GDPR (see section 9.3 (2)).

4.6 Activation, Feedback, user surveys, updates and notifications

Apryl also uses the e-mail addresses of Aspiring Members and Eligible Members (where specified, private, otherwise business) to ask for: account activation, feedback on the Apryl Benefits and to participate in user surveys, as well as to send updates and notifications about the Apryl Benefits (hereinafter “Automated E-Mails”). This is intended to improve the Apryl Benefits and will be done only if we have received prior consent in accordance with Art. 6 para. s. 1 lit. a GDPR. The recipients of such Automated E-Mails can withdraw their consent at any time by clicking on the link at the end of an e-mail or by contacting Apryl, e.g. via privacy@apryl.co.

Automated E-Mails contain a so-called “web beacon”, i.e. a pixel-sized file via which technical information on the browser and operating system used by the recipient, as well as the respective IP address and the time of the respective retrieval of the Automated E-Mail, are processed. We also use this information to better understand the interests of recipients and to improve our services.

At the end of each Automated E-Mail there is a link that can be used to unsubscribe from receiving such e-mails at any time. The receipt of Automated E-Mails can also be unsubscribed at any time by sending a message to privacy@apryl.co. Upon unsubscribing, the personal data stored for the purpose of providing those e-mails will be deleted, unless there is a legal obligation to retain such data.

The use of the web beacon is based on the respective newsletter recipient’s consent pursuant § 25 sec. 1 TTDSG. The legal basis for sending and evaluating the usage behavior of e-mail recipients is the respective consent pursuant to Art. 6 para. 1 s. 1 lit. a GDPR. The consent can only be withdrawn together for the use of the web beacon, the receipt of Automated E-Mails and the evaluation of the usage behavior.

For sending Automated E-Mails Apryl uses the services of the companies The Rocket Science Group, LLC and typeform SL (see section 9.3 (6)), to which the above data is also transmitted.

4.7 Automated processing

We do not use fully-automated decision making pursuant to Art. 22 GDPR concerning data of section 4.

In the following we inform Applicants that transmit their application data to Apryl on how we process their personal data in that regard.

We use the application data only for the purpose and within the scope of the application process in accordance with the statutory provisions. We process the data to be able to comply with our pre-contractual obligations in the course of the application process in accordance with Art. 88 GDPR in conjunction with § 26 German Federal Data Protection Act (BDSG). Within our company we will only share the Applicant`s personal data with those departments and persons who need it to fulfill contractual and legal obligations to implement our legitimate interest.

If a special category of personal data in the sense of Art. 9 para. 1 GDPR is processed (for example data concerning health or religious beliefs) the process is based on § 26 para. 3 BDSG.

If the Applicant shares information with Apryl that are not necessary for the employment the data processing takes place in accordance with the Applicants agreement according to Art. 6 para. 1 s. 1 lit. a GDPR.

Furthermore, we can process the Applicants personal data if this is necessary to fulfill legal obligations or to defend or assert legal claims. The legal basis for this is Art. 6 para. 1 s. 1 lit. c and f GDPR. The legitimate interest is, for example, a burden of proof in proceedings under the General Act on Equal Treatment (AGG).

Applicants can also send their applications via the online application form (https://apryl.join.com/). This application form is provided by JOIN Solutions AG (hereinafter “JOIN”, see section 9.3 (11)). In that respect JOIN will process Applicants’ personal data as processor in accordance with Art. 28 GDPR. Applicants data of Applicants who send their applications via JOIN will be linked and stored within our Applicants management platform provided by Greenhouse Software, Inc. (hereinafter “Greenhouse”, see section 9.3 (12)). In that respect Greenhouse will process Applicants´ personal data as a processor in accordance with Art. 28 GDPR.

If Applicants send their application to us via a third party’s website, their data will also be processed by the respective provider and transmitted to us. Examples for such providers are the Talent.io Recruitment GmbH or Workwise GmbH (this list is not exhaustive). In such case the terms of use and privacy policies of these providers apply for the Applicant as well. Depending on the respective website and the type of application, the provider may act as a processor in accordance with Article 28 of the GDPR or as an independent data controller.

The provision of the aforementioned data is necessary for the application process and for the decision on the establishment of an employment relationship. If Applicants do not provide us with their data, we will unfortunately not be able to consider them in the selection process for filling the vacancy.

The Applicants’ data will be deleted if an employment does not take place. The deletion is done after twelve months after the end of the Application process.  Until then we will store the data to be able to answer follow-up questions concerning the application and to be able to comply with our obligations under the AGG. If there is an employment relationship between the Applicant and Apryl, we can process the personal data already received from the Applicant according to Art. 88 GDPR in conjunction with § 26 BDSG for the purpose of the employment relationship, insofar as it is required for the implementation or termination of the employment relationship or for the exercise or fulfillment of the rights and obligations of the employment relationship, that arise from law or a collective agreement, a company or a service agreement.

The decision on the application is not solely based on automated processing. Thus, there is no automated decision in individual cases within the meaning of Art. 22 GDPR.

For purposes of communication and where Applicants give their consent to do so we might use the messenger tool Slack by Slack Technologies, LLC, to which personal data will be transmitted (see also section 9.3 (8)).

Sections 1 – 3, 8, 9.3 and 10 shall apply for Applicants equally.

In the following, we provide information concerning the type, purpose and scope of the processing of personal data in connection with customers, contract partners and other parties who are interested in Apryl.

6.1 General Information

We process the personal data in accordance with the provisions of the GDPR and the BDSG insofar as these are necessary for the establishment, execution and performance of a contract and for the implementation of pre-contractual measures. If the disclosure of personal data is necessary for the initiation or execution of a contractual relationship or in the context of the execution of pre-contractual measures, processing in accordance with Art. 6 para. 1 s. 1 lit. b GDPR is lawful.

If the persons defined under this section give us the express consent to process personal data for specific purposes (e.g. disclosure to third parties, evaluation for marketing purposes or advertising), the lawfulness of this processing is given on the basis of their consent pursuant to Art. 6 para. 1 lit. a GDPR. Any consent given may be withdrawn at any time with effect to the future (see section 10).

We process only such data which are connected with the contract initiation or the pre-contractual measures. This can be general data about the person or persons of the company (name, address, contact data etc.) as well as further data, if necessary, which is transmitted to us in the context of the initiation of the contract.

Personal data will be processed on our behalf on the basis of data processing agreements in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR. Data will otherwise only be transferred to recipients outside the company if this is permitted or required by law, if it is necessary for the processing of the contract or, at your request, for the implementation of pre-contractual measures, if we have the consent or if we are authorized to provide information. In this case recipients of personal data may be, for example, external tax consultants or public bodies and institutions where there is a legal or official obligation. In principle, we do not use fully automated decision-making pursuant to Art. 22 GDPR for the establishment, performance or execution of the business relationship or for pre-contractual measures. Should we use these procedures in individual cases, we will inform you of this separately or obtain your consent if this is required by law.

In the scope of contract establishment Apryl might use the digital signature service by PandaDoc Inc. (see also section 9.3 (9)).

For purposes of communication and where customers, contract partners and parties give their consent to do so we might use the messenger tool Slack by Slack Technologies, LLC, to which personal data will be transmitted (see also section 9.3 (8)).

Sections 1 – 3, 7, 8, 9.3 and 10 shall apply for persons mentioned in this section 6 equally.

6.2 Further information for Customers (Apryl Benefits) 

Customers who want to provide the Apryl Benefits to their employees (hereinafter “Customer”) will use Apryl’s web-based platform (hereinafter “Dashboard”) in the context of the cooperation agreement with Apryl and according to the respective terms and conditions (https://apryl.co/terms-customers). In this scope, Apryl will process the name, e-mail address and password of the Dashboard user in accordance with Art. 6 para. 1 s. 1 lit. b GDPR.

Apryl also collects statistical data on the use of the Dashboard for internal use based on our legitimate interest to improve the Dashboard according to Art. 6 para. 1 s. 1 lit. b GDPR. This includes, for example, the following information:

• Number of registered users,
• number of active user (log-ins),
• number of times certain product feates have been used,
• number of times certain pages have been loaded,

• amount of time spent at certain pages.

For the evaluation, we use the analytics processor Heap Analytics in accordance with Art. 6 para. 1 s. 1 lit. a GDPR (see section 9.3 (2)).

We process the personal data mentioned above under sections 2 to 6 within the scope of administrative tasks as well as for the organization of our operations, and to comply with legal obligations, such as archiving. The legal bases for this are Art. 6 para. 1 s. 1 lit. b, c or f GDPR. Accordingly, the purpose and our interest in processing lie in the maintenance of our business activities, the performance of our legal duties and the provision of our contractual services. For internal processing we use Google Workspace (see section 9.7 (7)). All data is also stored in our HubSpot customer relationship management tool (see section 9.3 (5)).

We delete the data mentioned in the above sections 2 to 7 after the storage is no longer required or restrict the processing if there are statutory retention obligations. In particular, the storage duration is determined by the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are usually 3 years, but in certain cases can be up to 30 years. In particular, we are subject to various retention and documentation obligations, which result, among other things, from the German Commercial Code (HGB), the German Fiscal Code (AO), and the German Money Laundering Act (GwG). The retention and documentation periods specified there are 2 to 10 years.

9.1 Employer

The data processing operations described in section 4 above are carried out on the basis of and within the framework of a cooperation agreement between Apryl and the respective Employer, as well as a corresponding data sharing agreement.

Apryl points out that the Employer only receives knowledge of personal data to the extent described in this data protection declaration (see sections 4.1, 4.4). In particular, the Employer will not receive any information about services utilized, special categories of personal data and/or about any existing partnerships.

The contact point for questions regarding data processing within the scope of Apryl Benefits and for the purpose of asserting data subject rights (see section 10) is Apryl.

9.2 Service provider

Insofar as Apryl transmits (special categories of) personal data to service providers as described in section 4.4 (4), 5 and 6 the subsequent processing by the service providers shall be carried out under their own and separate responsibility under data protection law.  

9.3 Others/processors

Within the Apryl company, those departments receive access to personal data that need it to fulfill our contractual and legal obligations. Processors used by us (Art. 28 GDPR) may also receive data for these purposes. These are companies in the categories of IT services, logistics, telecommunications, debt collection, advice and consulting, and sales and marketing. Data is only passed on to third parties within the framework of legal requirements. We only transmit personal data to third parties if this is necessary, for example, on the basis of Art. 6 para. 1 s. 1 lit. b GDPR for contractual purposes or on the basis of legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f GDPR in the economic and effective operation of our business operations, or if the data subject has consented to the transmission of data pursuant to Art. 6 para. 1 s. 1 lit. a or Art. 9 para. 2 lit. a GDPR (insofar as special categories of personal data is concerned).

(1) Amazon Web Services Inc (web hoster and cloud storage)

Apryl works with the provider Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA (hereinafter “Amazon Web Services”), through which we are able to offer our Website and the Member Portal online and to process the data described in sections 1 to 6 securely and efficiently. In the process, all information that is generated in the course of using the Website, including the Member Portal, is transmitted to Amazon Web Services and stored there until we delete it. Amazon Web Services is certified according to the ISO 27001, ISO 27017 and ISO 27018 standards, which includes aspects such as data security, data protection and fail-safe operation. The data centers used by Amazon Web Services are located within Germany in the Amazon Web Services Frankfurt region. Any transfer to a country outside the EU or the EEA that may be necessary in individual cases is carried out on the basis of data protection guarantees pursuant to Art. 45 et seq. GDPR, in particular in the form of a data transfer agreement containing the standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR. More information on data privacy at Amazon Web Services: https://aws.amazon.com/de/privacy/.

(2) Heap Inc 

We use Heap Analytics, a web analytics service provided by Heap Inc, 116 Natoma St, San Francisco, CA 94105, USA (hereinafter “Heap Analytics”, see also sections 2 and 4.5). Heap Analytics uses cookies to enable an analysis of the user behavior of Aspiring and Eligible Members when logging in to and within the Member Portal. The information generated about the use of the Member Portal includes user behavior, browser type and version, operating system used, referrer URL (the previously visited website), host name of the accessing computer (IP address) and time of server request. The information generated by the cookies about user behavior is transferred to a server of Heap Analytics in the USA within the framework of a data protection agreement that contains the standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR and stored there until we request Heap Analytics to delete it. The use of Heap Analytics cookies is based on the express consent of the respective Website visitor/User pursuant to § 25 sec. 1 TTDSG. More information on data privacy with Heap Analytics: https://heap.io/privacy.

(3) Google Analytics

Apryl uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, hereinafter collectively “Google”). Google Analytics uses “cookies”, which are text files placed on the User’s computer, to enable an analysis of the use behavior with regards to the Website and/or Member Portal. In particular, the following information is processed: Browser type/version, operating system used, referrer URL (the previously visited page), IP address, time of server request. The information generated by the cookie about the use of the website and the Member Portal will be transmitted to and stored by Google on servers in the United States. We use IP anonymization so that the respective IP address is shortened by Google within member states of the European Union or in other contracting states of the agreement on the European Economic Area (EEA) before it is transferred to a third country such as the USA. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. Any transfer to a country outside the EU or the EEA that may be necessary in individual cases takes place on the basis of data protection guarantees pursuant to Art. 45 et seq. GDPR, in particular in the form of a data transfer agreement that contains the standard data protection clauses approved by the EU Commission. On behalf of Apryl, Google will use this information to evaluate the use of the Website and the Member Portal and to provide further services to Apryl related to this and the use of the Internet. The (shortened) IP address transmitted by a browser as part of Google Analytics will not be merged with other Google data. The storage of cookies can be prevented by a corresponding setting of the browser software and/or our CMT (see section 2.2); however, it is possible that in this case not all functions of the Website and/or the Member portal can be used to their full extent.

The use of Google Analytics cookies is based on the express consent of the respective Website visitors/Users in accordance with § 25 sec. 1 TTDSG.

More information on terms of use and data privacy:  http://www.google.com/analytics/terms/de.html or https://policies.google.com/?hl=en&gl=de.

(4) Calendly LLC (booking of consultations)

For simple, fast and uncomplicated booking of consultations, we use the tool Calendly by the Calendly LLC based in the USA (hereinafter “Calendly”, see also Section 4.4 (2)). When using Calendly, personal data such as name, e-mail address and phone number as well as a request for a consultation are requested. In addition, further voluntary information is possible. The information provided in the request form will be transmitted to Calendly and stored under a data protection agreement until we request deletion. The transfer of data to the USA takes place within the framework of an agreement under data protection law, which contains the standard data protection clauses in accordance with Art. 46 para. 2 lit. c GDPR. More information on data privacy at Calendy: https://calendly.com/pages/privacy; https://help.calendly.com/hc/en-us/articles/360007032633-GDPR-FAQs.

(5) HubSpot (Customer Relationship Management)

Apryl uses the Customer Relationship Management Tool of the processor HubSpot (hubspot.com), 25 First Street, Cambridge, MA 02141 USA (hereinafter “Hubspot”), in order to be able to provide the services in connection with the Apryl Benefit to the Members more quickly and efficiently. For this purpose, the data mentioned under sections 3, 4 and 6 are transmitted to Hubspot and stored within the scope of our instructions until we request deletion. In this context, it is possible that data will also be transferred to servers of companies affiliated with Hubspot that are located outside the EU and the EEA (“third countries”). The transfer to such third countries takes place within the framework of an agreement under data protection law, which contains the standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR.

More information on data privacy at Hubspot: https://legal.hubspot.com/privacy-policy

(6) Typeform (account activation, feedback, surveys)

We use the service of typeform SL, C/Bac de Roda, 163 (Local), Barcelona, Catalonia 08018, Spain (hereinafter “Typeform”) for member account activation, conducting surveys and to obtain feedback; business email address, used browser type and operating system, IP address and the time of interacting with the survey are processed and stored on EU servers.  

Further information on terms of use and data privacy can be found under:

https://www.typeform.com/ 

(7) Google Workspace

Apryl uses Google Workspace for different services. These include Google Mail, Google Drive, PDF Viewer, Google Docs and Digital Contract Storage. This is provided by Google Ireland Limited (for more information about Google, see  section 9.3 (3)). Where personal data will be transmitted to and processed by Google, Google will do so according to a Data Processing Amendment. The data processing in the context of Google Workspace is based on Art. 6 para. 1 s. 1 lit. b GDPR for contractual purposes and/or on the basis of legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f GDPR in the economic and effective operation of our business operations.

More information on terms of use for Google Workspace and data privacy: https://workspace.google.com/intl/en-GB/terms/premier_terms.html, https://workspace.google.com/terms/dpa_terms.html.

(8) Slack Technologies (communication)

As a communication software Apryl uses Slack Technologies (hereinafter as “Slack”) provided given consent of the conversation partner according to Art. 6 para. 1 s. 2 lit. a GDPR. When using Slack, data of the conversation partners is collected, such as IP and email address, but also the data entered in each case and the content of the conversation. This data is transmitted to Slack and stored within the scope of our instructions until we request deletion. In this context, it is possible that data will also be transferred to servers of companies affiliated with Slack that are located outside the EU and the EEA (“third countries”). The transfer to such third countries takes place within the framework of an agreement under data protection law, which contains the standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR.

More information on terms of use and data privacy: https://slack.com/intl/en-gb/terms-of-service/user, https://slack.com/intl/en-gb/terms-of-service/data-processing  and https://slack.com/intl/en-gb/trust/privacy/privacy-policy.

(9) PandaDoc Inc. (digital signature)

Apryl uses Panda Doc Inc. (hereinafter as “PandaDoc”) as a digital signature service for signing contracts provided the contract partner’s consent according to Art. 6 para. 1 s. 2 lit. a GDPR. Pixel tags are used in the contract documents, via which the date of sending and opening of the document are saved. In this context, it is possible that data will also be transferred to servers of companies affiliated with PandaDoc that are located outside the EU and the EEA (“third countries”). The transfer to such third countries takes place within the framework of an agreement under data protection law, which contains the standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR. More information on terms of use and data privacy: https://www.pandadoc.com/terms-of-use/ and https://www.pandadoc.com/privacy-notice/

(10) pCloud International AG

Apryl uses the service of pCloud International AG (hereinafter “pCloud”). pCloud is a cloud service which we use for storing all information within the reimbursement process (see section 4.4). The data processing in the context of pCloud is based on Art. 6 para. 1 s. 1 lit. b GDPR for contractual purposes and/or on the basis of legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f GDPR in the economic and effective operation of our business operations. The aforementioned data is transferred to the pCloud server in Switzerland which takes place with the framework of an agreement under data protection law and pursuant to Art 45 (3) GDPR. More information on terms of use and data privacy: https://www.pcloud.com/privacy_policy.html and https://www.pcloud.com/terms_and_conditions.html    

(11) JOIN Solutions, AG.

Apryl uses the service of JOIN Solutions AG. (hereinafter “JOIN”). JOIN is a recruiting software that we use for application processes (see section 5). The use of data results in a legitimate interest according to Art. 6 s. 1 lit. f GDPR. For this purpose, the data mentioned under section 5 is transmitted to JOIN and stored within the scope of our instructions until we request deletion. In this context, it is possible that data will also be transferred to servers of companies affiliated with JOIN that are located outside the EU and the EEA (“third countries”). The transfer to such third countries takes place within the framework of an agreement under data protection law, which contains the standard data protection clauses pursuant to Art. 45 GDPR

More information on data privacy and terms of use at JOIN:  https://join.com/privacy-policy/ and https://join.com/terms-corporate/.

(12) Greenhouse Software, Inc.

Apryl uses the service of Greenhouse Software, Inc. (hereinafter “Greenhouse”). Greenhouse is a software that we use for the management of the recruitment and hiring process with regards to Applicants (see section 5). The use of the data results in a legitimate interest according to Art. 6 s. 1 lit. f GDPR. For this purpose, the data mentioned under section 5 is transmitted to Greenhouse and stored within the scope of our instructions until we request deletion. However personal data of Applicants may be transferred to and processed outside the European Economic Area, including within the United States. The use of the personal data is based on applicable data processing agreements pursuant to Art. 46 (2c) GDPR. 

More information on data privacy and terms of use at Greenhouse: https://www.greenhouse.com/uk/privacy-policy and https://www.greenhouse.com/uk/legal  

(13) Zoominfo Technologies LLC (web analytics)

We use ZoomInfo, a web analytics service provided by ZoomInfo Technologies, 805 Broadway Street Suite 900 Vancouver Washington 98660, USA (hereinafter “ZoomInfo”, see also section 2). ZoomInfo uses cookies to enable an analysis of the user behavior of Website visitors (of the “Login” and “Registration” web pages). Cookies are small text files that are stored on the terminal device used when calling up the Website. The information generated about the use of the Member Portal includes user behavior, browser type and version, operating system used, referrer URL (the previously visited website), host name of the accessing computer (IP address) and time of server request. The information generated by the cookies about user behavior is transferred to a server of ZoomInfo in the USA within the framework of a data protection agreement that contains the standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR and stored there until we request ZoomInfo to delete it. The use of ZoomInfo cookies is based on the express consent of the respective Website visitor/User pursuant to § 25 sec. 1 TTDSG. 

More information on data privacy and terms of use with ZoomInfo: https://www.zoominfo.com/about-zoominfo/privacy-policy#eu.

Every data subject has:

• The right to information according to Art. 15 GDPR,
• the right to rectification according to Art. 16 GDPR,
• the right to erasure according to Art. 17 GDPR,
• the right to restriction of processing according to Art. 18 GDPR, as well as
• the right to data portability under Art. 20 GDPR.
  
  

Furthermore, consent can be withdrawn at any time with effect for the future in accordance with Art. 7 para. 3 GDPR. However, Apryl points out that in this case, the services of Apryl, in particular the Apryl Benefits, can no longer be fully utilized.

The aforementioned rights can be asserted against Apryl by sending a message to the contact details listed in section 1, in particular by e-mail to privacy@apryl.co .

In addition, there is a right of appeal to a data protection supervisory authority (Art. 77 GDPR) in conjunction with § 19 BDSG.  

Information about the right of objection according to Art. 21 GDPR

Data subjects also have the right, pursuant to Art. 21 para. 1 GDPR, to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is carried out on the basis of Article 6 para. 1 s. 1 lit. e GDPR (data processing in the public interest) and Article 6 para. 1 s. 1 lit. f GDPR (data processing on the basis of a balance of interests). Recipients may object to direct advertising by Apryl at any time without stating reasons (Article 21 para. 2 GDPR).

After the objection has been received and the relevant conditions have been met, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject in question, or the processing serves to assert, exercise or defend legal claims.

The objection can be made form-free and no transmission costs other than those according to the prime rates are incurred. The objection is to be addressed to:

postal: Apryl GmbH, Dircksenstr. 47, 10178 Berlin,

via e-mail: privacy@apryl.co.