Privacy Policy according to Art. 13, 14 GDPR

Status: 22.07.2025

voozaa GmbH (hereinafter "we" or "voozaa") takes the protection of your personal data very seriously. This privacy policy informs you about the nature, extent, and purpose of the processing of personal data when using our website, mobile applications, the power bank rental system, and in the context of our lead generation for B2B purposes.

1. Responsible Party

voozaa GmbH
Rudolfplatz 3
50674 Cologne
Germany
Email: info@voozaa.app
Phone: +49 221 292111-75

2. Data Protection Officer

Email: privacy@voozaa.app

3. Scope of this Privacy Policy

This privacy policy covers:

• the processing of personal data of end customers when using our power bank machines and the mobile app,

• the processing of personal data of interested parties ("leads") from our B2B franchise and partner program, which are generated through online campaigns and further processed via an internal CRM (Pipedrive).

4. Data Processing When Used by End Customers (App and Machines)

a) Types of Data Processed:

• Email address or phone number (upon voluntary registration)

• Location data (for station search, only with consent)

• Payment data (via Stripe/PayPal)

• IP address, device information, usage statistics

b) Purpose of Processing:

• Provision of the power bank rental function

• Billing and payment processing

• Location-based services

• System analysis, error management, security purposes

c) Legal Bases:

• Art. 6 para. 1 lit. b GDPR (contract fulfillment)

• Art. 6 para. 1 lit. a GDPR (consent, e.g., for location data)

• Art. 6 para. 1 lit. f GDPR (legitimate interest in security and functionality optimization)

d) Storage and Deletion:

• Usage and payment data: 12 months

• Contract data: according to § 257 HGB and § 147 AO (6 or 10 years)

5. Data Processing in the Context of Lead Generation for Franchise and Location Partners (B2B)

a) Types of Data Processed:

• Name, email address, phone number

• Company name, location data

• Other voluntary information in the form

b) Source of Data:

• Online contact forms (e.g., on landing pages)

• Digital marketing campaigns (e.g., Meta Ads, Google Ads, TikTok Ads)

c) Further Processing:

• Storage in the CRM system Pipedrive

• Contact by voozaa employees

d) Purpose of Processing:

• Processing of inquiries from interested parties

• Conducting B2B communication

• Contract initiation within our franchise program

e) Legal Basis:

• Art. 6 para. 1 lit. b GDPR (pre-contractual measures)

• Art. 6 para. 1 lit. f GDPR (legitimate interest in corporate development)

f) Retention Period:

• Until the final rejection or completion of a contractual relationship plus statutory retention obligations

6. Hosting and Technical Infrastructure

Our systems operate exclusively on servers of Amazon Web Services (AWS) in Germany The data security meets the state of the art according to Art. 32 GDPR.

7. External Recipients & Processors

We use the following third-party providers:

• Stripe & PayPal (payment processing)

• Amazon AWS (hosting)

• Google Analytics & Firebase (analysis, app performance)

• Pipedrive (CRM for B2B contacts)

• Google Workspace (email communication)

• Meta Ads, Google Ads, TikTok Ads (lead generation)

We have contracts for processing with all service providers in accordance with Art. 28 GDPR. Data transfers to third countries take place on the basis of EU standard contractual clauses.

8. Your Rights as Data Subject

You have the right to:

• Access (Art. 15 GDPR)

• Rectification (Art. 16 GDPR)

• Deletion (Art. 17 GDPR)

• Restriction (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Objection (Art. 21 GDPR)

• Complaint to a supervisory authority (Art. 77 GDPR)

Your inquiries should be directed to: privacy@voozaa.app

9. Currency and Changes to this Privacy Policy

We reserve the right to change this privacy policy at any time while considering applicable data protection regulations. The version published on our website is valid.

10. Newsletter and Push Notifications (in the future)

If you actively sign up for our newsletter or push notifications, we store your consent and process your data solely for this purpose. Unsubscribing is possible at any time via the app or an unsubscribe link.

11. Data Processing on Meta Platforms (Instagram & Facebook)

For our online presences and advertising measures, we use services of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland on the platforms Instagram and Facebook. When visiting our social media pages, Meta collects various personal data, especially IP address, device information, location data, and interactions with our content.

This information is also provided to Meta if you do not have your own Meta account. If you are logged in, this data can be directly attributed to your user profile. Meta stores the data, among other things, for analysis, market research purposes, and personalized advertising.

We have access to so-called "page insights" through Meta. These are aggregated data that allow us to draw conclusions about the usage of our pages without referring to a specific person.

The legal bases for data processing are Art. 6 para. 1 lit. a GDPR (consent, if granted) and Art. 6 para. 1 lit. f GDPR (legitimate interest in effective public relations and communication). Data processing takes place within the framework of joint responsibility according to Art. 26 GDPR. The agreement can be found at: https://www.facebook.com/legal/controller_addendum

Further information on data processing by Meta can be found at: https://www.facebook.com/privacy/policy

12. TikTok

For advertising campaigns and reach analysis, we use TikTok Ads and TikTok Business Services, operated by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

In doing so, TikTok collects data such as IP address, device information, interaction behavior, and location data. This data may be transmitted to servers in third countries (e.g., USA). TikTok uses this data, among other things, for analysis, remarketing, and displaying personalized advertisements.

We only receive aggregated data from TikTok without personal reference. The use takes place based on your consent according to Art. 6 para. 1 lit. a GDPR. Further information can be found in TikTok's privacy policy: https://www.tiktok.com/legal/privacy-policy-eea

13. Google Ads / YouTube Ads

We use advertising services from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, to place ads on Google and YouTube as well as to evaluate campaigns.

In doing so, Google collects personal data such as IP address, device ID, location information, usage behavior, and information about ad interaction. This data can be used for profiling and personalized advertising.

The processing takes place based on your consent according to Art. 6 para. 1 lit. a GDPR via our consent banner. Further information on data processing by Google can be found at: https://policies.google.com/technologies/ads

14. Google Analytics

We use Google Analytics to analyze user behavior on our website and app. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

Google processes IP addresses (shortened), device information, session duration, dwell time, and page views. We use the IP anonymization feature, which shortens your IP address within the EU. Conclusions about individual persons are thereby excluded.

The use takes place exclusively with your consent according to Art. 6 para. 1 lit. a GDPR. The retention period is up to 14 months. Further information: https://support.google.com/analytics/answer/6004245

15. Pipedrive (CRM System)

For the management of franchise leads and potential B2B contacts, we use the CRM system Pipedrive of Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia.

We store the contact details entered by interested parties, communication histories, and internal notes. The data processing is based on Art. 6 para. 1 lit. b GDPR (pre-contractual measures) as well as Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient contact management).

The data processing takes place on servers within the EU. Further information: https://www.pipedrive.com/en/privacy