Last updated: 15 October 2026

1. General information and scope

This Privacy Policy explains, pursuant to Articles 12, 13 and 14 of the General Data Protection Regulation (GDPR), how we process personal data when you use our websites, online shop, mobile applications, connected products and devices, digital programmes and subscriptions, customer service, or otherwise interact with us.

It applies in particular to www.vulpes-smartwear.com, www.vulpes-health.com and www.vulpes-tech.com, the online shop offered through those websites, the mobile application “Vulpés Smartwear”, "Vulpés", "Vulpés Health" and successor versions for iOS and Android, and the Vulpés products and digital services connected to the app.

The data we process depends on the functions you use. Not every processing operation described in this Privacy Policy applies to every person.

2. Controller

The controller within the meaning of the GDPR is:

Vulpés Electronics GmbH

Einsteinstraße 1

24118 Kiel

Germany

Represented by Managing Director Rustam Ismailov

Phone: +49 40 32511759

Email: support@vulpes-tech.com

Privacy enquiries: support@vulpes-tech.com

3. Definitions and processing principles

Personal data means any information relating to an identified or identifiable natural person. This may also include device identifiers, online identifiers, usage data and profiles derived from several pieces of information.

Information concerning body areas, discomfort, wellbeing, mobility, recovery, menstrual or abdominal comfort, safety screening, assessments and reactions to programmes may, depending on content and context, constitute health data within the meaning of Article 9 GDPR. We process such data only where, in addition to a legal basis under Article 6 GDPR, an exception under Article 9(2) GDPR applies. For the personalised wellness and recovery functions described here, we generally rely on your explicit consent under Article 9(2)(a) GDPR in conjunction with Article 6(1)(a) GDPR. We obtain this explicit consent separately before collecting the relevant health data for the first time. Consent is voluntary and may be withdrawn at any time with effect for the future.

We observe, in particular, the principles of purpose limitation, data minimisation, transparency, accuracy, storage limitation, integrity and confidentiality, as well as data protection by design and by default.

5. Legal bases

 

Where consent is required for storing information on your device or accessing information already stored there, we additionally obtain consent in accordance with Section 25(1) TDDDG. Consent is not required where access is strictly necessary to provide a digital service expressly requested by you under Section 25(2) TDDDG.

6. Sources of data

We obtain personal data:

directly from you, for example during registration, ordering, onboarding, check-ins, assessments, support interactions or newsletter registration;

automatically from your browser, smartphone, app or connected Vulpés device;

from app-store, payment, login, shipping or support providers where necessary to provide the relevant function;

from your consent and privacy settings.

7. Processing on websites and in the online shop

7.1 Website provision and server logs

When you access our websites, technically necessary log data may be processed, including IP address, date and time, requested page or file, amount of data transferred, referrer URL, browser type, operating system, language settings and status codes.

The purpose is to provide the website securely, stably and without errors, to detect and defend against attacks and to analyse technical faults. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our digital services.

Log data is generally stored for 14 days and then deleted or anonymised unless longer retention is necessary to investigate a security incident or pursue legal claims.

7.2 Consent management, cookies and similar technologies

We use cookies, local storage technologies, pixels, software development kits and comparable technologies. Technically necessary technologies are used, for example, for shopping-cart functionality, login, saving language and privacy preferences, fraud prevention and secure website provision.

Non-essential analytics, marketing or personalisation technologies are activated only after you have given consent through our consent-management solution. You can change or withdraw your choice at any time via the permanently available “Privacy settings” link.

For consent management we use the consent-management solution implemented on our Shopify website. In particular, your choice, a consent ID, date and time, browser/device information and the version of the consent text are processed. Records of granted or refused consent are generally stored for up to three years after the most recent consent decision or withdrawal, unless longer retention is required to establish, exercise or defend legal claims.

7.3 Shopify and online shop

Our online shop is provided through Shopify. Depending on use, Shopify may process in particular IP address, browser and device information, shopping-cart data, orders, customer-account data, delivery and billing data and payment-status data. Shopify supports us with hosting, shop functionality, checkout, fraud prevention and shop analytics.

Processing for performance of your order is based on Article 6(1)(b) GDPR. Where statutory retention and evidence obligations apply, Article 6(1)(c) GDPR is the legal basis. Optional shop analytics and advertising functions are used only with your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

7.4 Customer account, orders and contract processing

When a customer account is created or an order is placed, we process in particular name, contact, delivery and billing information, order contents, customer and order numbers, communications, returns, warranty claims and payment status. Mandatory fields are marked accordingly.

Processing takes place for account and contract administration, delivery, payment processing, communication, returns, guarantee and statutory warranty handling on the basis of Article 6(1)(b) GDPR. Tax- and commercial-law records are retained to the extent legally required under Article 6(1)(c) GDPR.

7.5 Payment services

Depending on your choice and sales channel, we may use payment providers including PayPal, Klarna, Shopify Payments, card networks such as Visa, Mastercard, American Express, Maestro and UnionPay, Apple Pay, Google Pay, and local payment methods such as iDEAL/Wero, MobilePay, BLIK and EPS. Local payment methods are in particular made available through Shopify Payments.

Payment providers may process payment and identification data under their own data-protection responsibility. We generally receive only payment confirmations, transaction identifiers and status information necessary for contract processing. The privacy information of the payment provider selected by you applies in addition.

7.6 Shipping and fulfilment

For delivery we transmit necessary recipient, address and, where applicable, contact details to Click & Pack Fulfillment GmbH, Charlottenburger Str. 3a, 21502 Geesthacht, Germany. The legal basis is Article 6(1)(b) GDPR. Email address or telephone number may be transmitted for delivery notifications where necessary or requested by you, on the same basis or with your consent.

7.7 hCaptcha

To protect our forms and digital services against automated access, misuse and fraud, we use hCaptcha by Intuition Machines, Inc. Data processed may include IP address, device and browser information, date and time, mouse, keyboard, touch and interaction data and the result of the abuse check.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting our systems and forms against automated misuse. Where access to the end device is strictly necessary for the function, we rely on Section 25(2) TDDDG. Data may be processed in the USA; recognised transfer mechanisms are used, in particular an adequacy decision for certified recipients and/or Standard Contractual Clauses.

7.8 Web analytics with Google Analytics

Where you have consented, we use Google Analytics to statistically analyse use of our websites. Data processed may include pseudonymous online identifiers, IP address, device and browser data, approximate region, page views, interactions, source of the visit and technical events.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google Analytics is not activated without consent. You may withdraw consent at any time through the privacy settings.

The configured retention period for event-level data is 14 months. The provider in the EEA is generally Google Ireland Limited; processing by affiliated companies in third countries may occur. Recognised transfer mechanisms are used for such processing.

7.9 Online marketing and personalised advertising

Where you have expressly consented, we may use technologies such as Shopify Audiences, Meta Pixel, Google Ads and TikTok. Usage, device, purchase and interaction data may be linked to online identifiers to measure reach, attribute campaigns or personalise advertising. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent at any time in the privacy settings.

7.10 Newsletter and direct marketing

If you subscribe to our newsletter, we process your email address, registration time, confirmation within the double-opt-in procedure and any voluntary information. The legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time using the unsubscribe link in each message.

We use Shopify for sending and managing newsletters. After unsubscribing, we may store the email address in a suppression list to prevent further mailings and to document compliance with the withdrawal.

7.11 Product reviews and user-generated content

If you publish a product review or other content, we process the content you provide, the display name selected, the product reference, the time and, where applicable, technical verification data. Published content is publicly visible. The legal basis is Article 6(1)(b) GDPR where publication is carried out at your request and Article 6(1)(f) GDPR for moderation, misuse prevention and verification of authenticity.

8. Processing in the Vulpés app and connected products

8.1 Installation, app access and technical data

When the app is installed and used, we process technical information such as app version, operating system, device model, language, time zone, IP address, installation identifier, access time and technical error and security events. These data are required to provide the app, check compatibility, deliver updates, detect security incidents and resolve errors.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide the app and otherwise Article 6(1)(f) GDPR based on our interest in secure and stable operation.

8.2 Registration, login and account administration

For registration we process in particular email address, user ID, password hash or login token, account status, language, region and timestamps. Optional profile information is processed only where you provide it voluntarily. The legal basis is Article 6(1)(b) GDPR.

8.3 Social login

If you sign in via a third-party provider, depending on your choice and the provider’s settings, we may receive a provider ID, email address, name and, where applicable, profile image. Supported providers include Apple and Google. The legal basis is Article 6(1)(b) GDPR or your consent where additional data are transmitted. The provider’s own privacy notice applies to its independent processing.

8.4 Bluetooth, nearby-device and location permissions

To pair and control a Vulpés device, the app requires access to Bluetooth or, depending on the operating system and version, permission for “nearby devices”. On certain older Android versions, searching for Bluetooth devices may technically be linked to a location permission.

We use precise location only if you activate an expressly location-dependent feature, for example an optional weather function, and have previously consented. Permissions can be changed at any time in your device settings. Without necessary Bluetooth permissions, pairing and device control may not be available.

8.5 Device pairing and device control

When you connect a Vulpés product, depending on the product we process in particular device ID, model, serial number, firmware version, pairing status, app version, connection events, device settings, selected modes, intensity, duration, timer, battery status, start and end times and technical error data.

Processing is used for pairing, control, synchronisation, troubleshooting, security, update delivery and display of your usage history. The legal basis is Article 6(1)(b) GDPR. Article 6(1)(f) GDPR may additionally apply to technical data required for product security, misuse prevention or fault analysis.

8.6 Onboarding, safety screening and assessments

If you use personalised programmes, recovery, mobility or wellness functions, we may ask for information concerning your preferred body area, goals, usage context, activity level, intended usage frequency, comfort, mobility, stiffness, tension, recovery, menstrual or abdominal comfort, current treatment, known limitations, safety-screen answers and voluntary free-text input.

These data are used to select suitable programmes, avoid unsuitable or excessive content, adapt recommendations and show changes over time. They do not constitute a medical diagnosis and do not replace individual medical advice.

Where these data constitute health data, we process them only on the basis of your explicit consent under Article 9(2)(a) in conjunction with Article 6(1)(a) GDPR. This explicit consent is obtained separately before the relevant health data are collected for the first time. It is voluntary and may be withdrawn at any time with effect for the future.

Without this consent, basic device-control functions remain available. Personalised programmes, assessments and progress functions may then be unavailable in whole or in part.

8.7 Guided programmes, workouts and session data

When guided programmes are used, we process in particular the selected programme, body area, exercise or recovery flow, planned and actual duration, completion or cancellation status, repetitions, times, device used, mode, intensity and feedback provided by you on exertion and immediate perception.

Processing is used to perform the selected programme, synchronise with the device, display progress and improve your next recommendation. The legal basis is Article 6(1)(b) GDPR. Where the data contain information about your health or physical condition, we additionally rely on your explicit consent under Article 9(2)(a) GDPR.

8.8 Check-ins, check-outs, progress and outcome data

Optionally, before or after a session and at regular intervals, you may provide information about how a body area feels, how recovered, mobile, stiff or tense you feel, whether an application felt comfortable, too light or too intense, and whether you perceive a change. We may derive trend curves, adherence scores and personalised guidance from these data.

These data may constitute health data and are processed only with your explicit consent. You may delete individual entries and, where technically available, the entire history in the app or request deletion via our privacy contact.

8.9 Personalisation and profiling

With your consent, we may derive preference and usage patterns from your information, preferences, body areas, goals, programme usage, session histories, feedback and device settings. This profiling is used solely to adapt content, programmes, reminders and settings more closely to your stated goals and usage behaviour.

The legal basis is Article 6(1)(a) GDPR and, where health data are included, additionally Article 9(2)(a) GDPR. You may deactivate personalisation at any time in the privacy settings. Non-personalised or manually selectable content will remain available where technically provided.

8.10 AI-assisted personalisation and recommendations

If you activate an AI-assisted recommendation function, AI-assisted or AI-personalised recommendations are identified as such in the app. The AI may evaluate profile, preference, usage and feedback data released by you and, where expressly authorised by you, health and wellbeing data in order to suggest suitable programmes, sequences, intensities or reminders. Safety-critical exclusions and load limits are not determined solely by a freely generative AI system but are constrained by defined rules and product specifications.

Vulpés uses internally developed AI and recommendation models to provide suitable programmes, content and application recommendations on the basis of user information and previous usage. Vulpés Electronics GmbH operates and provides these models.

AI-assisted recommendations are used to personalise wellness, mobility, recovery and training offerings. They do not constitute a medical diagnosis, treatment recommendation or individual medical advice.

Depending on the function used, our models may process the following categories of personal data:

profile and preference data, including selected body areas, personal goals, preferred programme duration, desired usage frequency and other programme settings;

device and usage data, including the product used, device settings, selected modes, application duration and time of use;

programme and session data, including selected programmes, completed exercises, completion or cancellation of a session and usage frequency;

assessment, check-in, check-out and feedback data, including information on recovery, mobility, stiffness, tension, comfort, wellbeing and subjectively perceived changes;

derived data, including detected usage patterns, preferences, progress trends and recommendations generated on that basis;

technical metadata, including pseudonymous user identifier, app and model version, timestamps and technically necessary error and security information.

Some of these data may reveal information about physical condition or health and therefore constitute special categories of personal data under Article 9 GDPR. Where such health data are included in AI-assisted personalisation, this takes place only on the basis of your prior explicit consent under Article 9(2)(a) GDPR in conjunction with Article 6(1)(a) GDPR.

Where technically possible, the recommendation model does not receive directly identifying information such as name, email address or full payment details. Processing generally uses a pseudonymous user identifier.

Regional processing and international data transfers

Vulpés operates its app infrastructure in regionally separated environments where technically possible. User accounts are assigned to an EU/EEA or US service region based on the country of residence or contracting country stated at registration.

For users in the EU/EEA service region, profile, recovery, assessment, session, outcome and personalisation data are generally stored within the European Economic Area. For these data we use Cloud Firestore at the European multi-region location `eur3`. Primary data replicas are located in Belgium (`europe-west1`) and the Netherlands (`europe-west4`); an additional witness region in Finland (`europe-north1`) is used for availability. Server-side Firebase Cloud Functions used for the app are provided for the EU/EEA service region in `europe-west3` (Frankfurt, Germany).

For registration, sign-in and account administration we use Firebase Authentication. Firebase Authentication is technically operated exclusively through data centres in the United States. In particular, email address, user identifier, authentication data, IP address and technical security information may be processed.

We do not store health, recovery, assessment, check-in, check-out or outcome data in Firebase Authentication. Authentication is linked to app data stored in Cloud Firestore generally by means of a pseudonymous user identifier.

For users assigned to the US service region, the relevant app, profile, session, assessment, outcome and personalisation data may be stored and processed on systems in the United States.

Irrespective of the assigned service region, hosting, system security, troubleshooting, technical support or the use of subprocessors may result in processing or access from other countries. Personal data are transferred from the EEA to a third country only in compliance with Articles 44 et seq. GDPR.

For transfers to the United States, depending on the recipient, we rely in particular on an adequacy decision of the European Commission for certified participants in the EU-US Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission and, where appropriate, supplementary safeguards.

Profile, preference, session, assessment, feedback and recommendation data are generally stored for the duration of the user account and for as long as necessary to provide the personalisation, progress and history functions requested by the user.

Technical model-execution logs are stored only for as long as necessary for system security, error analysis, misuse prevention and traceability of recommendations.

If a user account is deleted or consent required for the processing is withdrawn, we delete or anonymise the relevant data from active systems unless statutory retention obligations or other overriding legal grounds prevent this. Data in backups are removed as part of regular backup and overwrite cycles.

The specific retention period depends in particular on the duration of the user account, the history and personalisation functions activated by the user, requirements for system security and troubleshooting, statutory retention and evidence obligations and any consent given for further development of our models. Once the processing purpose ceases and no statutory retention grounds remain, the data are deleted or effectively anonymised.

Further development of our models

We do not automatically use personal usage, assessment or feedback data for general development or training of our AI models. Such use takes place only where a separate legal basis exists and, where required, the user has expressly and separately consented.

Where possible, we use aggregated or anonymised data for analyses and model improvement. Pseudonymised data remain personal data and are protected accordingly.

Consent to model improvement is voluntary and does not affect basic device control or use of non-personalised programmes. It may be withdrawn at any time with effect for the future.

AI-assisted personalisation and the processing of released health and wellbeing data are based on your consent under Article 6(1)(a) GDPR and, where health data are processed, additionally on your explicit consent under Article 9(2)(a) GDPR. AI personalisation may be deactivated at any time. Deactivation does not affect the lawfulness of processing carried out before that time.

8.11 Improvement of our own recommendation models

If we intend to use personal or pseudonymised data to improve our own recommendation models, we obtain separate, voluntary consent where required. Consent to model improvement is not a condition for device control, purchasing a subscription or receiving personalised recommendations for your own account.

Where possible, we use anonymised or aggregated data for statistical analysis and model development. Truly anonymised data that can no longer be linked to a person are not subject to the GDPR.

8.12 Firebase Authentication, Cloud Firestore and Cloud Functions

To provide the app we use services from Google Firebase / Google Cloud. The relevant Firebase services have different processing and storage locations.

For registration, sign-in and account administration we use Firebase Authentication. Data processed may include user ID, email address, authentication information, IP address and technical security information. Firebase Authentication is technically operated in data centres in the United States.

For users in our EU/EEA service region we use Cloud Firestore at the European multi-region location `eur3` to store app profiles, settings, programme usage, session data and, where explicit consent has been given, recovery, assessment, check-in, outcome and personalisation data. According to Google’s service architecture, the primary data replicas are located in Belgium (`europe-west1`) and the Netherlands (`europe-west4`); Finland (`europe-north1`) is used as a witness region for availability.

Server-side Firebase Cloud Functions used by Vulpés for the EU/EEA service region are deployed in `europe-west3` (Frankfurt, Germany). Such functions may process pseudonymous user IDs and, depending on the relevant function and consent, app, device, session and health/wellbeing data for server-side app logic, synchronisation, personalisation and device functions.

Health, recovery, assessment, check-in, check-out and outcome data are not stored in Firebase Authentication. Where technically possible, authentication data and sensitive app data are separated and linked using a pseudonymous user identifier.

Google processes data as a processor where applicable on the basis of the relevant data-processing agreement. Where personal data are transferred from the EEA to the United States or another third country, the safeguards described in Section 12 apply.

8.13 Push notifications

If you enable push notifications, we process a push token, operating system, language, app version and your chosen notification settings. Technically, Apple Push Notification Service or Firebase Cloud Messaging are used.

Service-related messages necessary for a function expressly requested by you are processed on the basis of Article 6(1)(b) GDPR. Reminders, marketing or personalised offers are sent only with your consent where required. Push notifications can be disabled at any time in the app or device settings.

8.14 Subscriptions and in-app purchases

If you purchase a subscription or in-app purchase through Apple App Store, Google Play or another sales channel, the respective store processes your payment and store-account data under its own responsibility. We generally receive only information such as product or plan identifier, transaction identifier, purchase time, country, term, renewal and cancellation status and whether payment was successful.

We process these data to activate, administer and bill the subscription under Article 6(1)(b) GDPR and to comply with statutory retention obligations under Article 6(1)(c) GDPR. Other subscription or billing providers may include Stripe, Shopify, Apple and Google depending on the sales channel actually used.

9. Customer service and communication

If you contact us by email, form, telephone, chat or through the app, we process your contact information, the content of your request, related order, device and account data and the communication history. Processing is carried out to handle your request under Article 6(1)(b) GDPR or, for general enquiries, Article 6(1)(f) GDPR.

10. Security, misuse prevention and legal enforcement

We process necessary account, device, network, login, transaction and log data to detect, prevent and investigate unauthorised access, fraud, misuse, security breaches and violations of our terms. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting our users, products, systems and legal positions.

Where processing is necessary to comply with legal obligations, handle official requests or establish, exercise or defend legal claims, it is based on Article 6(1)(c) or (f) GDPR as applicable.

11. Recipients and processors

We disclose personal data only where necessary for the stated purposes, where a legal obligation applies or where you have consented. Categories of recipients may include hosting, cloud, database and IT providers; shop, payment, subscription and app-store providers; shipping, fulfilment, repair and logistics partners; Firebase, analytics, consent, push, support and communications providers; hosting, cloud and IT providers for our internally developed AI and personalisation functions; tax, legal, audit and consulting providers; and authorities, courts or other bodies where legally required or necessary.

 

We enter into data-processing agreements under Article 28 GDPR with processors. Where providers act as independent controllers for their own purposes, their own privacy notices provide additional information.

12. Transfers to third countries

Some providers or their subprocessors are located outside the European Economic Area or access data from there. In particular, Firebase Authentication is operated exclusively in the United States. By contrast, the Cloud Firestore database used for EU/EEA users is operated at the European multi-region location `eur3`, and Firebase Cloud Functions used by Vulpés are provided in `europe-west3` (Frankfurt). Irrespective of resource location, lawful support, security or subprocessor access from third countries cannot always be excluded. Personal data are transferred from the EEA only where the requirements of Articles 44 et seq. GDPR are met.

Safeguards include adequacy decisions of the European Commission, including the EU-US Data Privacy Framework for appropriately certified US recipients, or Standard Contractual Clauses approved by the European Commission together with any necessary supplementary measures. Information on the applicable safeguards can be requested through our privacy contact.

13. Retention and deletion

We retain personal data only for as long as necessary for the relevant purpose, statutory retention obligations apply or legal claims may need to be asserted or defended. The data are then deleted or anonymised.

 

Different retention periods may apply in individual cases where statutory retention duties exist, data are required to establish, exercise or defend legal claims, or another legal obligation requires further retention. In such cases processing is restricted to the relevant purpose.

14. Device data and EU Data Act

Our connected products and the associated app may generate product and service data during use. These may include device identifiers, operating states, settings, modes, intensities, runtimes, technical events, fault and usage data. Where such data are personal data, this Privacy Policy and the GDPR also apply.

Information required under the EU Data Act concerning the type, format, scope and generation of product data and access, use, export and possible sharing with third parties is provided separately on our website or in the app.

15. Automated decisions and profiling

We may use profiling to adapt programmes and recommendations to your goals, preferences and previous use. Personalised suggestions are intended to support wellness, mobility, recovery and training. They do not produce legal effects or similarly significantly affect you.

As a rule, we do not make decisions based solely on automated processing within the meaning of Article 22(1) GDPR. If this changes in the future, we will provide separate prior information on the logic involved, significance, scope and intended effects and on your rights.

16. Requirement to provide data

Data required for registration, contract performance, payment, device pairing or a function requested by you are marked as mandatory. Without these data, we may be unable to provide the relevant service.

Health/wellbeing data, optional assessments, analytics, marketing, AI personalisation and model improvement are generally voluntary. Refusal of these optional processing activities must not unreasonably impair basic device control or already purchased core functions. Individual personalised functions may not be available without the necessary data.

17. Minors

Our app and personalised programmes are generally intended for persons aged 18 and over. We do not knowingly process personal data of younger persons for these functions. If you believe that relevant data of a minor have been provided to us, please contact us.

18. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure or destruction. Depending on the risk, these include encrypted transmission, access restrictions, role-based permissions, secure authentication, logging, backups, vulnerability management and separate development and production environments. Health, recovery, assessment and outcome data are, where technically possible, processed separately from directly identifying authentication data and linked using pseudonymous user identifiers.

Despite careful safeguards, no transmission or storage can be guaranteed to be absolutely secure. Please protect your credentials and notify us if you suspect unauthorised access.

19. Your rights

Subject to the statutory requirements, you have the right to access your personal data (Art. 15 GDPR); rectify inaccurate or complete incomplete data (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability for data provided by you (Art. 20); object to processing based on legitimate interests or to direct marketing (Art. 21); withdraw consent with effect for the future (Art. 7(3)); and lodge a complaint with a data-protection supervisory authority (Art. 77).

To exercise your rights, please contact our privacy contact. To prevent unauthorised disclosure, we may request reasonable proof of identity.

20. Special notice regarding the right to object

YOU HAVE THE RIGHT, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT AT ANY TIME TO PROCESSING BASED ON ARTICLE 6(1)(E) OR (F) GDPR. WHERE DATA ARE PROCESSED FOR DIRECT MARKETING PURPOSES, YOU MAY OBJECT AT ANY TIME WITHOUT STATING REASONS.

21. Withdrawal of consent and privacy settings

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected. Cookie and website-tracking consents are managed via the “Privacy settings” link. App consents are managed under “Settings – Privacy & Consents” or through our privacy contact.

If you withdraw explicit consent for health data, we stop the processing based on that consent. Personalised programmes, progress displays or AI functions may then be restricted or unavailable. Statutory retention duties and storage necessary to establish or defend legal claims remain unaffected.

22. Right to lodge a complaint

You may lodge a complaint with a data-protection supervisory authority. The authority particularly responsible for us is:

Independent State Centre for Data Protection Schleswig-Holstein (ULD)

Holstenstraße 98

24103 Kiel

Germany

Phone: +49 431 988-1200

Email: mail@datenschutzzentrum.de

Website: www.datenschutzzentrum.de

You may also contact the supervisory authority of your habitual residence, place of work or the place of the alleged infringement.

23. Changes to this Privacy Policy

We update this Privacy Policy when our processing, services or the legal situation changes. The current version is available on our websites and in the app. In the event of material changes, particularly new purposes or changed consent, we will inform you appropriately and obtain new consent where required.

24. Contact

For questions about data protection or to exercise your rights, please contact:

support@vulpes-tech.com

Vulpés Electronics GmbH · Einsteinstraße 1 · 24118 Kiel · Germany