Privacy Policy of the Echometer App

General

Echometer is a browser-based online tool (hereinafter also referred to as “service”, or “Echometer tool”) that supports organizations in implementing a healthy feedback culture by initiating and accompanying a continuous improvement process through team retrospectives.

Our privacy policy explains in detail which personal data is processed in the context of using our service via my.echometerapp.com in what way.

Responsible in the sense of the General Data Protection Regulation (GDPR) as well as the Federal Data Protection Act (BDSG) for the processing of personal data is

Echometer GmbH Tondernstraße 1 48149 Münster Email: info (at) echometer.de

We process personal data only if this is legally permissible. Personal data is only passed on to recipients that we explicitly designate in these privacy policies.

As soon as the purpose of the processing no longer applies, personal data is deleted or blocked for further use by technical and organizational measures. This also occurs when a prescribed storage period expires, unless there is a necessity for further storage of the personal data for the conclusion or fulfillment of a contract.

Unless we are legally obliged to store data for a longer period or to pass it on to third parties (in particular law enforcement authorities), the decision as to which personal data is collected by us, how long it is stored and to what extent you may have to disclose it depends on which functions of our website or our service are used in the individual case.

Links on our websites and in our services may lead to other websites and services that are not operated by us, but by third parties. Such links are either clearly marked by us or are recognizable by a change in the address bar of the browser. We are not responsible for compliance with data protection regulations and the secure handling of personal data on these websites and services operated by third parties.

Definitions

These privacy policies use the terms of the legal text of the GDPR. You can read the definitions in the definitions in Art. 4 GDPR read.

What data we process

We collect various types of data during your use of our website and our service.

The first type is data that you provide to us directly and consciously. This includes the information you enter when creating an account for the service (name, email address and password) as well as data you create while using the service, e.g. feedback, interactions in the retrospective, created measures, etc. This data belongs to you. Echometer may use your email address and name to contact you directly for troubleshooting, sales outreach, feedback collection and proactive support purposes.

The second type is data that we collect automatically while you use our website and services. This data is only used to operate and improve our service. This is also our legitimate interest, which is why processing is permissible according to Art. 6 Para. 1 lit. f GDPR.

By using our service, you give us permission to store this data and process it within the framework of this privacy policy. You can decide to withdraw this consent at any time, which may, however, reduce or even prevent the usability of our service for you.

Rights of the data subject

In accordance with the European GDPR pursuant to Chapter 3, the following “data subject rights” apply:

Data subjects have the right…

  • to information about data processing according to Art. 15 GDPR
  • to rectification of data according to Art. 16 GDPR
  • to lodge a complaint with a supervisory authority according to Art. 77 GDPR
  • to erasure (also known as the “right to be forgotten”) according to Art. 17 GDPR
  • to restriction of processing according to Art. 17 GDPR
  • to data portability according to Art. 20 GDPR
  • to object to the processing, provided that this is based on Art. 6 para. 1 lit. e or f GDPR.

Our privacy policy may change. Updates will be provided directly on this page. In the event of significant changes, we will also inform you on the login screen or by email. If you do not agree with future changes to this privacy policy, you must stop using our services and delete your account. We are obliged to inform you about the rectification or erasure of personal data or the restriction of processing.

Use of Cookies

Cookies are text files that are stored on or read from end devices by a website. They contain combinations of letters and numbers in order to, for example, recognize the data subject when reconnecting to the cookie-setting website, restore previous settings, enable staying logged into a customer account or statistically analyze a specific usage behavior.

We use cookies to:

  • save preferences for our website
  • save the login status

In-app feedback and support messages

Within the app, you can send messages to the Echometer team via the support menu to provide feedback, report bugs or receive support. When sending such a message, the current browser URL, the IP address and, if you are logged in, your email address are automatically recorded and sent to Echometer along with the message.

To process these messages, we use Google Workspace (Gmail) for email communication and Notion for internal task and ticket management. The message content as well as the context and contact data recorded in the process are processed in both systems for this purpose. This serves to process and evaluate the feedback, to assign and track support requests and, if necessary, to contact you in case of queries or for your support.

Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, and Notion Labs, Inc., 685 Market Street, San Francisco, CA 94105, USA, are used as processors in accordance with Art. 28 GDPR.

When using these services, personal data may be processed outside the European Economic Area, particularly in the USA. For transfers that are not covered by an adequacy decision, the providers’ data processing terms provide for EU standard contractual clauses in particular as appropriate safeguards.

Further information can be found in the Data Processing Terms for Google Workspace and in the Data Processing Agreement of Notion.

Online Demo Agreement

In some places, we proactively offer you an online demo. You can book the appointment for the online demo via our calendar tool HubSpot.

Contact options

If you have any questions about our privacy policy, security measures or the exercise of data subject rights, we are available via email at info (at) echometer.de.

Integrated third-party providers

Telekom Deutschland GmbH

We use the Telekom Open Cloud for our app, which is provided by:

Telekom Deutschland GmbH, Landgrabenweg 151, 53227 Bonn

Data Protection Officer: Mr. Dr. Claus D. Ulmer, Friedrich-Ebert-Allee 140, 53113 Bonn, [email protected]

The Open Telekom Cloud offers Infrastructure as a Service from German high-security data centers.

Purposes of processing

Provision of the hosting infrastructure on which Echometer runs.

Performance of a contract pursuant to Art. 6(1)(b) GDPR.

Recipients / categories of recipients

The recipient of the collected data is Telekom Deutschland GmbH.

Transfer to third countries

No transfer to third countries takes place.

PostHog

We use the product analytics tool “PostHog” in our app, which is provided by:

PostHog Inc, 2261 Market Street #4008, San Francisco, CA 94114

Data Protection Officer: Charles Cook (VP Operations), [email protected]

PostHog is a product development and analysis platform that makes it possible to roll out new features sequentially as part of release management, ensure their stability and analyze their usage. To analyze usage behavior, so-called session replays are created without tracking user input. In addition, data is processed for support and analysis purposes.

Purposes of processing

PostHog is used for the purposes of release management as well as product support and product analysis.

The purposes described constitute a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

Recipients / categories of recipients

The recipient of the collected data is PostHog Inc., whereby Echometer uses EU hosting exclusively.

Transfer to third countries

No transfer to third countries takes place.

Google

We offer optional Google features provided by Google LLC:

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Use only takes place after explicit connection of your Google account.

Login or registration via Google

You can log in to Echometer with your Google account. The login takes place via a redirect to Google’s website, where you can sign in with your login details.

Processed data

We receive your name, first name, and email address from Google in order to create the user account in Echometer.

Purpose and use

We use this data exclusively to create the Echometer account and link the login of the Echometer account with the Google account.

Data sharing

We do not share this data with third parties.

Storage & protection

Processing takes place on our infrastructure in Germany (Telekom Open Cloud). Transmission between the end device and our systems is encrypted (TLS).

Storage period & deletion

The data is stored for as long as the Echometer account exists, or until Google login is deactivated.

Google Calendar integration for 1:1s

In the 1:1 tool in Echometer, you can optionally activate a Google Calendar integration. This allows you to connect your Google Calendar recurring events with 1:1 recurring events in Echometer so that appointments from Google Calendar are synchronized in Echometer and you can open the appropriate Google Meet directly in Echometer.

Processed data

We access the calendar list as well as calendar and event data. This includes in particular calendar IDs as well as appointment details such as title, date/time, recurring details, location, description, and video conference links (e.g. Google Meet), insofar as these are available in the selected calendars.

Purpose and use

We use this data to display 1:1 appointments in Echometer, synchronize recurring appointments with Google Calendar, and enable you to directly join the associated video conference.

Data sharing

We do not share Google Calendar data with third parties.

Storage & protection

We store only the data necessary for synchronization. Processing takes place on our infrastructure in Germany (Telekom Open Cloud) and data transmission is encrypted (TLS).

Storage period & deletion

The data is stored only as long as the integration is active. You can deactivate the calendar integration and manually disconnect meetings from Google Calendar entries.

Optional newsletter on product updates

When registering, you can optionally subscribe to our product updates newsletter. Signing up is voluntary and not a prerequisite for using the app.

For this purpose, we process your name, your email address, as well as information about your registration and confirmation status. Subscription management is handled using our self-hosted software Listmonk on our hosting infrastructure in the Open Telekom Cloud. Telekom is used as a hosting processor.

For the technical delivery of product updates via SMTP, we use Resend, a service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes in particular recipient addresses, email content, and technical delivery information as a processor pursuant to Art. 28 GDPR.

The newsletter is sent on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the unsubscribe link in every newsletter email. The lawfulness of processing up to the point of withdrawal remains unaffected. Required unsubscribe and suppression notes are stored so that your decision is taken into account in future mailings.

By using Resend, personal data is transferred to the USA. The transfer is safeguarded by the EU Standard Contractual Clauses contained in the data processing agreement. Further information can be found in the Privacy Policy of Resend and in the Data Processing Agreement of Resend.

Optional AI features via OpenAI

At some points, Echometer offers AI-supported features. These features are provided through an integration with OpenAI Ireland Ltd (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, [email protected]) provided.

For these features, it is explicitly stated that certain inputs and data are processed by OpenAI. No further data is transmitted to OpenAI beyond these inputs and data.

All AI-supported features in Echometer are optional and each require explicit activation and consent.

Purposes of processing

Provision of AI-supported features at your request

The purposes described constitute performance of a contract with the data subject’s consent within the meaning of Art. 6(1)(a) and (b) GDPR

Recipients and transfer to third countries

The data is processed in the USA in accordance with OpenAI’s Data Processing Addendum (see OpenAI’s data processing agreement). More information on the processing can be found in the OpenAI Privacy Policy: OpenAI Privacy Policy

Self-checkout for SaaS customers via Stripe

There are several ways to become a customer of Echometer. In the context of self-checkout, the service provider Stripe is used, among others. Stripe is provided by:

Stripe Inc., Corporation Trust Center, 1209 Orange Street, Wilmington, New Castle, DE 19801, USA

Data Protection Officer: [email protected], Privacy: [email protected]

Purposes of processing

Stripe is used for the purposes of handling the purchase process and billing.

The purposes described constitute the performance of a contract with the consent of the data subject within the meaning of Art. 6(1)(a) and (b) GDPR.

Recipients / categories of recipients

The recipient of the collected data is Stripe Inc.

Transfer to third countries

The data is processed in accordance with Stripe’s data processing agreement (see Stripe Data Processing Agreement).

Self-checkout for SaaS customers via Paddle

You can become a customer of Echometer through several channels. As part of the self-checkout process, the service provider Paddle is used, among others. Paddle is provided by:

Paddle.com Market Limited, Judd House, 18-29, Mora Street, England, London, EC1V 8BT

Data Protection Officer: Michael Cox, [email protected]

Purposes of processing

Paddle is used for the purposes of processing the purchase process and billing.

The purposes described constitute the performance of a contract with the consent of the data subject within the meaning of Art. 6(1)(a) and (b) GDPR.

Recipients / categories of recipients

The recipient of the collected data is Paddle.com Market Limited

Transfer to third countries

The data are processed in accordance with Paddle’s data processing agreement (see Paddle Data Processing Addendum).

Registration as a user in a paid workspace

If you use the paid version of the Echometer app, we process your data in addition to the information in this privacy policy on behalf of the owner of the Echometer workspace (usually the employer). This data processing is governed by the SaaS agreement and the data processing agreement signed between Echometer and the owner of the workspace.

In this context, Echometer acts merely as a data processor, while the workspace owner acts as the data controller. For further information about this data processing, you can therefore contact your workspace owner or employer, as this is the responsible party for the processing of the data within the workspace.