Privacy statement
In this privacy policy, we inform you about the processing of your personal data and your data protection rights when you visit our website, use the 2ZERO app or communicate with us. Your privacy is important to us. We attach great importance to handling your data in accordance with data protection regulations and will not use it for purposes other than those specified. To this end, we have taken appropriate technical and organizational measures to ensure that the provisions of applicable data protection law are complied with.
General information
General information about data processing on the website, in the CO2 calculator, and in the 2zero app
1.1 Responsible for data processing
The person responsible for data processing is:
2zero GmbH
Kreuzbergstr. 29, 10965 Berlin
post@2zero.earth
1.2 Contact if you have any questions about data protection
If you have any questions about data protection, all responsible persons are available at the contact details given above or the data protection officer directly at post@2zero.earth.
1.3 Purposes and legal bases
In addition, we process personal data if the following legal bases apply:
If the processing of personal data is necessary and there is no legal basis for such processing, we obtain consent from the data subject in accordance with Article 6 (1) (a) GDPR.
If processing is necessary to fulfill a contractual obligation and to carry out appropriate pre-contractual measures — such as the use of the 2zero app, we process the data on the basis of contract fulfilment on the basis of Art. 6 para. 1 lit. b GDPR.
In order to fulfill a legal obligation to which we are subject in accordance with any applicable law of a country in which the GDPR is applicable in whole or in part, we process data on the basis of legal obligations in accordance with Art. 6 para. 1 lit. c GDPR.
According to Article 6 (1) (f) GDPR, we may process data within the scope of our legitimate interest or to protect the legitimate interests of third parties, unless the fundamental freedoms and fundamental rights as well as the interests of the data subject prevail. Legitimate interests include in particular providing our website to provide information about our products and services, ensuring information security and enforcing our own legal claims and compliance with further legislation.
Our legitimate interest also includes providing users of the 2zero app with information related to the purposes of the app and thus addressing them about further offers. Recipients of advertising material can send us their objection to the use of their data for advertising purposes at any time.
1.4 Categories of recipients of personal data
1.4.1 External recipients
We use service providers committed to confidentiality and data protection. This includes hosting providers, service providers for technical support or used software products, as well as independent consulting companies. We have concluded appropriate data protection agreements with all business partners to ensure an appropriate level of data protection. Personal data will only be passed on to authorities if there is overriding legislation. Data will only be transferred to third countries under the conditions of Art. 44 ff. GDPR.
1.5 Storage period
We process personal data for the purposes of smooth connection setup and system security. The connection data is generally stored for no longer than seven days and is automatically deleted. If the website or the 2zero app is misused, log data can be kept for evidence purposes to further clarify the incident.
1.6 Rights of data subjects
You can exercise your right to access, correct and delete data at any time. Simply contact us using the methods described above. If you wish to delete data but we are still required by law to store it, access to your data will be restricted (blocked). The same applies in the event of an objection. You can exercise your right to data portability as long as the technical options are available to the recipient and to us.
You have the option to file a complaint with a data protection supervisory authority at any time.
2. Data processing on the website
2.1 Purposes and legal basis of data processing on the website
The purpose of data processing on this website is to provide information about the activities and services of 2zero.
When you visit our website, personal data is only processed to the extent necessary for technical reasons. With every visit, our website collects a range of general data and information from the website visitor. This general data and information is stored in the log files of the website's server. The legal basis for data processing is Article 6 (1) (f) GDPR. Can be recorded
- browser types and versions used,
- the operating system used by the accessing system,
- the website from which an accessing system accesses our website (so-called referrer),
- the sub-websites, which are accessed via an accessing system on our website,
- the date and time of access to the website,
- an Internet protocol address (IP address),
- the Internet service provider of the accessing system and
- other similar data and information used to avert threats in the event of attacks on our information technology systems.
2.2 Use of cookies
This website uses so-called “cookies”, text files that are stored on your device and which enable an analysis of your use of the website. The information generated by the cookie about your use of this website is used to evaluate visitor behavior on the website and to improve our range of information. The legal basis for data processing is Article 6 (1) (f) GDPR (legitimate interest). The information obtained is only used for internal statistical evaluation and is not passed on to third parties. The cookies are deleted at the end of the session. You can prevent the installation of cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. The data is collected anonymously; the data collected cannot be related to you personally.
If cookies that are not necessary for the operation of the website are used, we ask for your consent in advance; the legal basis for data processing is Art. 6 para. 1 lit. a GDPR (consent).
2.3 Contact form
If you write to us via our contact form, your data from the form will be processed to process your request. The legal basis for the transfer to us is consent in accordance with Article 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future. The data is then deleted. If your request does not result in a storage obligation (e.g. when ordering), the data will be deleted after 2 years. Your data will be forwarded internally to the responsible contact person to process your request.
2zero is committed to protecting and respecting your privacy. We only use your personal information to manage your account and provide you with products and services that are relevant to you. You can unsubscribe from all email notifications at any time using the unsubscribe function in the email.
2.4 Google Analytics
This website uses Google Analytics, a web analysis service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The legal basis for this processing is your consent in accordance with Article 6 (1) (a) GDPR.
Google Analytics also uses “cookies,” text files that are stored on your computer and that enable an analysis of your use of the website. It is not ruled out that the information generated by the cookie about your use of this website will be transmitted to a Google server in the USA and stored there. The transfer of personal data to the USA was judged by the European Court of Justice to be fundamentally uncertain without further security measures, as it cannot be ruled out that US security authorities will have access to this data. IP anonymization is activated on this website; your IP address is abbreviated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there. Data will only be transferred to the USA if the requirements of Art. 44 ff. GDPR are met. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and Internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data from Google. User data will be deleted after 24 months.
You can withdraw your consent at any time with effect for the future and prevent Google from using data by downloading and activating the available browser plug-in: http://tools.google.com/dlpage/gaoptout?hl=de.
You can also prevent cookies from being saved by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.
For more information about Google's privacy policy, please visit https://policies.google.com/privacy.
2.5 Encryption
This website uses “Hypertext Transfer Protocol Secure” (https). The connection between your browser and our server is encrypted.
3. Data processing in the 2zero app and in the CO2 calculator
3.1 Logging in to the 2zero app
You can create a user account in the 2zero app with a Google account, an Apple ID or a valid email address.
- Apple Single Sign-On: authentication service from service provider Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. Privacy information at https://www.apple.com/legal/privacy/de-ww/
- Google Single Sign-On: authentication service from service provider Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Privacy information at https://policies.google.com/privacy
- Registration with a valid email address is carried out using a double opt-in process. After entering the email address, you must click on a confirmation link via a message sent to this address to complete your registration. In this way, we ensure that third parties do not use your email address inappropriately.
- The email address used for registration can be used for prize notifications by 2zero or the contract partner of the respective community.
The app can also be used anonymously, i.e. without creating a user account. When using without registration, please note that it is not possible to assign your data sets and we are therefore unable to restore your data after deleting the app from your device. In addition, due to the lack of identification of your data set, we cannot fully guarantee your data subject rights. You can still use the app with all functions.
3.2 Processing of personal data
The processing of personal information is necessary to achieve the app's goal of relating personal action to the associated CO2 emissions. Generally, the data is processed to fulfill the user agreement on the basis of Art. 6 para. 1 lit. b DSGVO.
The types of data processed relate to the user specified by you. The types of data processed in this process can be:
- socio-demographic information (e.g. age, gender, zip code, income),
- economic preferences (e.g. risk settings, time preferences),
- Personal attitudes (e.g. about climate change, the environment).
You can delete your user account yourself at any time. Please note that the recovery of data after deletion of the user account is not guaranteed. After deleting your user account, it is necessary to create a new account and enter new data. If you delete the app alone, but not your user profile, a new login on a device is possible in connection with the previously used login data.
The following services are used for processing user data:
Sign in with Apple
Service Description: Enables user authentication in the app via Apple.
Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA
Data Processed: Email
Details: The use of this service is optional, and data is only transmitted to Apple if the user consents to using the authentication method.
Legal Basis for Processing: Consent, Contract Performance
Legal Documents: Apple Privacy Policy
Google Single Sign-On
Service Description: Enables user authentication in the app via Google.
Provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland
Data Processed: Email
Details: The use of this service is optional, and data is only transmitted to Google if the user consents to using the authentication method.
Legal Basis for Processing: Consent, Contract Performance
Legal Documents: Google Privacy Policy
Google Cloud Platform
Service Description: Data storage and processing with Google Cloud services to ensure app functionality.
Provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland
Data Processed: App and usage data
Details: A data processing agreement has been established with Google. Data is stored in Google's data centers within the EU.
Legal Basis for Processing: Contract Performance
Legal Documents: Google Privacy Policy
Firebase Crashlytics
Service Description: Monitors and improves app stability by identifying, diagnosing, and reporting app crashes and performance issues.
Provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland
Data Processed: User ID, crash reports, app performance metrics
Details: Data may be transferred to Google LLC in the USA. This occurs only if the requirements of Articles 44 ff. GDPR are met. More information can be found in Firebase Crashlytics' privacy notices.
Legal Basis for Processing: Consent
Legal Documents: Firebase Privacy Policy
Google Analytics
Service Description: Analyzes user interactions and behavior on the website and in the app to optimize user experience and improve functionality.
Provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland
Data Processed: User ID, usage data, device information, event data, user IP
Details: IP anonymization is enabled in the app, and IP addresses are shortened within the EU or EEA. Full IP addresses are only transmitted to US servers in exceptional cases. User consent is required as the transmission of the device's IP address cannot be fully excluded. Data is automatically deleted after 24 months.
Legal Basis for Processing: Consent
Legal Documents: Google Privacy Policy
Vercel Hosting
Service Description: Hosting our cloud infrastructure and functions.
Provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA
Data Processed: IP addresses, request logs
Legal Basis for Processing: Contract Performance
Legal Documents: Vercel Legal Documents
Brevo (Sendinblue)
Service Description: Sending and delivering sign-in confirmation emails.
Provider: Sendinblue (Brevo), 106 boulevard Haussmann 75008, Paris, France
Data Processed: User email
Details: Emails are only sent through this service after the user has signed into the app. No data is transferred outside the EU.
Legal Basis for Processing: Contract Performance
Legal Documents: Brevo Terms of Use
Resend
Service Description: Sending and delivering transactional emails related to initiatives and installation instructions.
Provider: Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA
Data Processed: User email
Details: Emails are only sent through this service after the user has signed up for an initiative.
Legal Basis for Processing: Contract Performance
Legal Documents: Resend Legal Documents
PostHog
Service Description: Product analytics and user behavior analysis to improve product features and optimize user experience.
Provider: PostHog, Inc.
Data Processed: User ID, usage data, device information, event data, user IP
Details: This service is optional, and users can opt out of contributing their data to service and performance improvements.
Legal Basis for Processing: Consent
Legal Documents: PostHog Data Processing Agreement
Knock
Service Description: Managing, delivering, and customizing notifications and alerts for users about app activities, updates, or user-triggered events.
Provider: Knock Labs Inc., 175 Varick St, #413, New York, NY 10014, USA
Data Processed: User email, user ID, push notification keys, device identifier
Legal Basis for Processing: Contract Performance
Legal Documents: Knock Security Documentation
Ghost Newsletter
Service Description: Sending email newsletters to inform users about news and blog posts.
Provider: Ghost Foundation, 160 Robinson Road, #14-04 SBF Center, Singapore 068914
Data Processed: User email
Details: The use of this service is optional, and the email address is only shared if the user subscribes to the newsletter.
Legal Basis for Processing: Consent
Legal Documents: Ghost Data Processing Agreement
Typeform
Service Description: Collecting user feedback and responses via surveys.
Provider: Typeform S.L., C/Bac de Roda, 163, 08018 Barcelona, Spain
Data Processed: Survey responses
Details: The use of this service is optional, and user responses are only collected if the user participates in the survey.
Legal Basis for Processing: Consent
Legal Documents: Typeform Data Processing Agreement
3.3 Use of anonymized data for scientific purposes
When data is exported from the database, user data is anonymized so that the data is not evaluated for scientific purposes on a personal basis.
3.4 Use of anonymized data to evaluate initiatives at local and corporate level
As part of the evaluation and results analysis of initiatives, usage statistics are passed on to the organizers of such initiatives. The data is only made available in anonymized form. No personal data is shared.
3.5 Transfer of email address for prize notification by email
In accordance with our privacy policy, it is possible that winners' email addresses may be passed on to the respective municipality/company. However, this is limited exclusively to those app users who have explicitly agreed to this practice in the app by accepting the corresponding conditions upon registration. This consent allows us to include both individuals and teams who are active in our community and have signed up with an email address in our sweepstakes processes. It is important to emphasize that the data provided may only be used for the purpose of notifying the prize. Use for other purposes, such as for newsletters or transfer to third parties, is expressly prohibited.
4. Up-to-dateness of the privacy policy
We reserve the right to adapt the content of this privacy policy at any time. This usually takes place when the services used are developed or adapted. The current privacy policy can be viewed on our website at https://www.2zero.earth/datenschutz. Status of this declaration: 05.09.2024.
