Echometer App Privacy Policy

Echometer is a browser-based online tool (hereinafter also referred to as "Service" or "Echometer Tool") that supports organizations in implementing a healthy feedback culture by initiating and accompanying a continuous improvement process through team retrospectives.

Our privacy policy explains in detail which personal data is processed in connection with the use of our service via  my.echometerapp.com and in what way.

Responsible within the meaning of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) for the processing of personal data is

Echometer GmbH
Tondernstraße 1
48149 Münster
E-mail:  info[at]echometer.de

We process personal data only if this is permitted by law. Personal data will only be disclosed to recipients that we expressly designate in this privacy policy.

As soon as the purpose of the processing no longer applies, personal data will be deleted or blocked for further use by technical and organizational measures. This also takes place if a prescribed storage period expires, unless there is a need for further storage of the personal data for the conclusion or fulfillment of a contract.

Unless we are legally obliged to store it for a longer period or to pass it on to third parties (in particular law enforcement authorities), the decision as to which personal data is collected by us, how long it is stored and to what extent you may have to disclose it depends on which functions of our website or our service are used in individual cases.

Links on our websites and in our services may lead to other websites and services that are not operated by us but by third parties. Such links are either clearly marked by us or are recognizable by a change in the address bar of the browser. We are not responsible for compliance with data protection regulations and the secure handling of personal data on these websites and services operated by third parties.

This privacy policy uses the terms of the legal text of the GDPR. The definitions (Art. 4 GDPR) can be found, for example, at https://dejure.org/gesetze/DSGVO/4.html.

We collect different types of data during your use of our website and service.

The first type is data that you provide to us directly and consciously. This includes the information you enter when creating an account for the Service (name, email address, and password) as well as data that you create while using the Service, such as feedbacks, interactions in the retrospective, created measures, etc. This data belongs to you. Echometer may use the email address and name to contact them directly for the purposes of troubleshooting, sales contact, feedback collection and proactive support.

The second type is data that we collect automatically while you use our website and services. This data is used only to operate and improve our service. This is also our legitimate interest, which is why the processing is permitted under Art. 6 para. 1 letter f GDPR.

By using our service, you grant us permission to store this data and process it within the framework of this privacy policy. You may decide at any time to withdraw this consent, which may, however, reduce or even prevent the usability of our service for you.

In accordance with the European GDPR according to chapter 3, the following "rights of data subjects" apply:

Data subjects have the right...

• to information about data processing pursuant to Art. 15 GDPR
• to rectification of data pursuant to Art. 16 GDPR
• to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR
• to erasure (also known as "right to be forgotten") pursuant to Art. 17 GDPR
• to restriction of processing pursuant to Art. 17 GDPR
• to data portability pursuant to Art. 20 GDPR
• To object to the processing, provided that it takes place on the basis of Art. 6 para. 1 letter e or f GDPR.

Our privacy policy may change. Updates will be made available directly on this page. In the event of significant changes, we will also inform you on the login screen or by e-mail. If data subjects do not agree with future changes to this privacy policy, they must discontinue using our services and delete their account. We are obliged to inform data subjects about the rectification or erasure of personal data or the restriction of processing.

Cookies are text files that are stored or read out by a website on end devices. They contain combinations of letters and numbers in order to, for example, recognize the person concerned when reconnecting to the cookie-setting website, restore the previous settings, enable the person to remain logged in to a customer account, or statistically analyze a certain user behavior.

We use cookies to:

• Save preferences for our website
• Save login status

If you have any questions about our privacy policy, security measures, or to exercise your rights as a data subject, please contact us by e-mail at info (at) echometer.de.

Telekom Deutschland GmbH

We use the Telekom Open Cloud for our app, which is provided by:

Telekom Deutschland GmbH, Landgrabenweg 151, 53227 Bonn

Data Protection Officer: Herrn Dr. Claus D. Ulmer, Friedrich-Ebert-Allee 140, 53113 Bonn, [email protected]

The Open Telekom Cloud offers Infrastructure as a Service from German high-security data centers.

Purposes of Processing

Provision of the hosting infrastructure in which Echometer runs.

Legal Basis

Performance of a contract pursuant to Art. 6 para. 1 letter b GDPR.

Recipient / Categories of Recipients

The recipient of the collected data is Telekom Deutschland GmbH.

Transfer to Third Countries

There is no transfer to third countries.

PostHog

We use the product analytics tool "PostHog" in our app, which is provided by:

PostHog Inc, 2261 Market Street #4008, San Francisco, CA 94114

Data Protection Officer: Charles Cook (VP Operations), [email protected]

PostHog is a product development and analysis platform that enables new features to be rolled out sequentially as part of release management, to ensure their stability and to analyze their use. So-called session replays are created to analyze usage behavior without tracking user input. Data is also processed for support and analysis purposes.

Purposes of Processing

PostHog is used for release management as well as product support and product analysis.

Legal Basis

The purposes described constitute a legitimate interest within the meaning of Art. 6 para. 1 letter f GDPR.

Recipient / Categories of Recipients

The recipient of the data collected is PostHog Inc., whereby Echometer exclusively uses EU hosting.

Transfer to Third Countries

There is no transfer to third countries.

We offer optional Google features provided by Google LLC:

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Login or registration via Google

Users can log in to Echometer with their Google account. Registration takes place via a redirect to the Google website, where users can log in with their login details.

Processed data

We receive first name, last name and your email address from Google in order to create the user account in Echometer.

Purpose and use

We use this data exclusively to create the Echometer account and to link the login of the Echometer account with the Google account.

Data transfer

We do not pass this data on to third parties.

Storage & protection

The processing takes place on our infrastructure in Germany (Telekom Open Cloud). The transmission between the end device and our systems is encrypted (TLS).

Storage period & deletion

The data is stored as long as the Echometer account exists or the Google login is deactivated.

Google Calendar integration for 1:1s

In the 1:1 tool in Echometer, users can optionally activate a Google Calendar integration. Users can connect their Google Calendar series with 1:1 series in Echometer so that the appointments from the Google Calendar are synchronized in Echometer and they can open the appropriate Google Meet directly in Echometer.

Processed data

We access the calendar list as well as calendar and event data. This includes calendar IDs and appointment details such as title, date/time, series details, location, description and video conference links (e.g. Google Meet), provided these are available in the selected calendars.

Purpose and use

We use this data to display 1:1 appointments in Echometer, to synchronize appointment series with Google Calendar and to enable users to directly access the associated video conference.

Data transfer

We do not pass on Google Calendar data to third parties.

Storage & protection

We only store the data necessary for synchronization. Processing takes place on our infrastructure in Germany (Telekom Open Cloud) and data transmission is encrypted (TLS).

Storage period & deletion

The data is only stored as long as the integration is active. Users can deactivate the calendar integration and manually disconnect the connection of meetings to Google Calendar entries.

As part of your registration, you can agree to receive extended product communications. This communication is handled via the CRM tool HubSpot, which is provided by:

HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 United States

Data Protection Officer: Nicholas Knoop, Data Protection Officer

Purposes of processing

HubSpot is used for the purposes of individualized customer communication and for the purposes of market research.

Legal basis

The purposes described constitute a legitimate interest within the meaning of Art. 6 para. 1 letter f GDPR.

Recipient / Categories of recipients

The recipient of the collected data is HubSpot Inc.

Transfer to third countries

The data is transferred to HubSpot Inc. in accordance with HubSpot's Data Processing Agreement.

Users can unsubscribe from this optional communication at any time by clicking on the "Unsubscribe" button in the product emails.

Echometer offers AI-supported functions in some places. These functions are provided through an integration with OpenAI Ireland Ltd (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, [email protected]).

These functions explicitly state that certain inputs and data are processed by OpenAI. No data beyond these inputs and data is transmitted to OpenAI.

All AI-supported functions in Echometer are optional and each requires explicit activation and consent.

Purposes of processing

Provision of AI-supported functions at the request of a user

Legal basis

The purposes described constitute the fulfillment of a contract with the consent of the data subject within the meaning of Art. 6 Para. 1 lit. a and b GDPR

Recipient and transfer to third countries

The data is processed in the USA in accordance with OpenAI's Data Processing Addendum (see https://openai.com/policies/data-processing-addendum). More information on processing can be found in the OpenAI Privacy Policy: https://openai.com/policies/privacy-policy

There are several ways to become an Echometer customer. As part of the self-checkout process, the service provider Stripe is used, among other things. Stripe is provided by:

Stripe Inc., Corporation Trust Center, 1209 Orange Street, Wilmington, New Castle, DE 19801, USA

Data Protection Officer: [email protected], Privacy: [email protected]

Purposes of processing

Stripe is used for the purposes of processing the purchase process and billing.

Legal basis

The purposes described constitute the fulfillment of a contract with the consent of the data subject within the meaning of Art. 6 para. 1 lit. a and b GDPR.

Recipient / categories of recipients

The recipient of the data collected is Stripe Inc.

Transfer to third countries

The data is processed in accordance with Stripe's data processing agreement (see Stripe Data Processing Agreement).

There are several ways to become a customer of Echometer. As part of the self-checkout process, the service provider Paddle is used, among other things. Paddle is provided by:

Paddle.com Market Limited, Judd House, 18-29, Mora Street, England, London, EC1V 8BT

Data Protection Officer: Michael Cox, [email protected]

Purposes of processing

Paddle is used for the purposes of processing the purchase process and billing.

Legal basis

The purposes described constitute the fulfillment of a contract with the consent of the data subject within the meaning of Art. 6 para. 1 lit. a and b GDPR.

Recipient / categories of recipients

The recipient of the data collected is Paddle.com Market Limited

Transfer to third countries

The data is processed in accordance with Paddle's data processing agreement (see Paddle Data Processing Addendum).

The extended product communication with users of the free version of Echometer is partly handled via the MixMax tool, which is provided by:

Mixmax Inc., 548 Market Street, PMB 60764, San Francisco, CA, 94104-5401, United States

Data Protection Officer: Jonathan Grant, Data Protection Officer ([email protected])

Purposes of processing

Mixmax is used for the purposes of individualized user communication and for the purposes of market research.

Legal basis

The purposes described constitute a legitimate interest within the meaning of Art. 6 para. 1 letter f GDPR.

Recipient / categories of recipients

The recipient of the collected data is Mixmax Inc.

Transfer to third countries

The data will be transferred to Mixmax Inc. in accordance with MixMax's Data Processing Agreement.

If data subjects use the paid version of the Echometer app, we process their data in addition to the information in this privacy policy on behalf of the owner of the Echometer workspace (usually the employer). This data processing is governed by the SaaS agreement and the data processing agreement signed between Echometer and the workspace owner.

In this context, Echometer acts only as a data processor, while the workspace owner acts as the data controller. For more information about this data processing, data subjects can therefore contact their workspace owner/employer, as they are the responsible party for the processing of data within the workspace.