Privacy Policy

The cookies are divided into the following categories:

Technically required (“Essential”)

These are strictly necessary cookies that are needed in order to enable you to move around a website and use its features. Without these cookies, some functionalities cannot be guaranteed.

Performance (“Statistics”)

Performance cookies collect information about how a website is used – for example which pages a visitor visits most often and whether he receives error messages from a page. These cookies do not store any information that would allow the user to be identified. The information collected is aggregated and thus evaluated anonymously . These cookies are only used to improve the performance of a website and thus the user experience.

Third Party Providers (“External Media”)

Third party cookies are created by embedded plugins or addons on our website. An example of this is the integration of Google Maps.

a. Legal basis

The legal basis for the processing of personal data using technically necessary cookies is legitimate interest (Art. 6 Para. 1 lit. f GDPR).

The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6 Para. 1 lit. a GDPR

b. Purpose of processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these it is necessary that the browser is recognized even after a page change.

The user data collected by technically necessary cookies are not used to create user profiles.

Performance cookies are used to improve the quality of our website and its content. Through these statistics, we learn how the website is used and can thus constantly optimize our offer.

c. Duration of storage

Cookies are stored on the user’s computer and transmitted to our site. Therefore, as a user, you also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.

The default expiry time and further information on the respective cookies can be found in the list of tools as described in the process.

i.e. Further possibilities of restriction by the user

Furthermore, users can take the following steps to activate the “Do Not Track” function in common browsers:

• Firefox:
  • https://support.mozilla.org/de/kb/wie-verhindere-ich-dass-websites-mich-verfolgen

• Internet explorer:
  • https://support.microsoft.com/de-de/help/17288/windows-internet-explorer-11-use-do-not-track

• Chrome:
  • https://support.google.com/chrome/answer/2790761
    
    
• Edge:
  • https://privacy.microsoft.com/de-de/windows-10-microsoft-edge-and-privacy
  • Tracking Prevention in Microsoft Edge (Chromium) – Microsoft Edge Development | Microsoft Docs

Please note that you can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. These can be found for the respective browsers under the following links:

• Firefox:
  • https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

• Internet explorer:
  • http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
• Chrome:
  • http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647

Please note that if cookies are not accepted, the functionality of our website may be restricted.

2. Use of the contact form on the Nova App websites

a. Scope of processing

There is a contact form on our website which can be used to contact us electronically. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and saved. These dates are:

• Name (optional)
• Company (optional)
• Address (optional)
• E-mail address
• Message

At the time the message is sent, the following data is also stored:

• The IP address of the user
• Date and time of registration

Alternatively, you can contact us via the email address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.

In this context, the data will not be passed on to third parties. The data will only be used to process the conversation.

b. Legal basis

The legal basis for processing the data is the legitimate interest (Art. 6 Para. 1 lit. f GDPR).

The legal basis for the processing of the data that is transmitted in the course of sending an e-mail is also the legitimate interest (Art. 6 Para. 1 lit. f GDPR). If the e-mail contact is aimed at concluding a contract, the legal basis for processing is the implementation of pre-contractual measures (Article 6 (1) (b) GDPR).

c. Purpose of data processing

The processing of the personal data from the input mask serves us solely to process the contact. If contact is made by e-mail, this is also the necessary legitimate interest in the processing of the data.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

i.e. Duration of storage

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is over when it can be inferred from the circumstances that the facts in question have been finally clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

e. Possibility of objection and elimination

The user has the option to object to the storage of personal data at any time. If the user contacts us by email, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

All personal data that was saved in the course of making contact will be deleted in this case.

3. Use of the Nova App

When using the Nova App, various personal data and information are requested, which are stored in our systems for various purposes. As explained at the beginning, some processing is carried out by RLE under its own responsibility (see a.), while other processing is carried out by RLE on behalf of an operator of a facility or event (order processing, see b.). In detail:

a. RLE as responsible

(1) Scope and purpose of processing during registration

The following data is collected when a user registers with the Nova app:

1. credentials

• Name first Name
• E-mail address (possibly also pseudonymised with Apple)
• Date of birth (only for the purpose of determining the required minimum age of the applicant of 16 years).

1. Contact details

In order to enable contact tracing with regard to health protection (e.g. in the case of COVID-19 infections), we store the following data in addition to your login data when you register:

• Telephone number (mobile phone)
• Address (street, zip code, city, country)

• Image data

In the course of registration, image data is collected for identification. With the user’s consent, this image data is converted into biometric data / distance data, on the basis of which the check-in can be carried out on site at the hygiene column. The user also has the option of using the photo taken during registration as a profile photo and sending it to the operator of a facility or event.

(2) Add vaccination and testing certificates

The Nova App offers users the option of importing vaccination and test certificates from other sources (e.g. the Corona-Warn-App) into the Nova App user account.

(3) Self-test at participating test centers

Nova App users can get tested for COVID-19 at participating testing centers listed in the Nova App. The participating test centers provide a QR code on site that users can scan using the Nova app. Then, with the user’s consent, the registration data and contact details required to carry out the test (see above, Section 8 a. (1) i. and ii.) will be transmitted by RLE to the respective test center. The corresponding test certificate is created by the test center via the Nova app and stored there in the user account. The test center processes the data transmitted by the user, the swab samples taken and the test result (positive / negative / ambiguous test result) for identification purposes, for the assignment of samples and test results, for the administrative processing of the desired examination, as well as for testing, statistical and billing purposes. The test certificate is then stored in the user account of the user concerned in the NOVA app for their purposes of use.

(4) Use of the Robert Koch Institute’s Corona warning app for test certificates

Users have the option of using the Robert Koch Institute’s Corona Warn App to call up their test result for an antigen test. For more information, see no. 8.g. described.

(5) Use of the Nova App as a digital key for hotel rooms

(6) RLE can process user data anonymously for statistical purposes.

b. Scope and purpose of processing when visiting a facility or attending an event (RLE as processor)

If the user decides to use the Nova App when visiting a facility or participating in an event, the operator of the facility or event is responsible for this visit or participation in the sense of data protection law, while RLE controls the data processing via the Nova App carries out on its behalf by way of order processing.

A user first receives an invitation from the operator for an event or a series of several events or visits, for which the user then registers. Here, the under no. 8 a. (1) i. and ii. described data of the user is transmitted to the operator. The operator will also be informed whether the user meets the applicable certificate requirements (e.g. negative COVID-19 antigen test, full vaccination certificate); the certificates themselves are not transmitted to the operator. The operator collects further personal data from the participant as part of its events:

• Times and place of stay

As part of the contact tracing regarding health protection (e.g. in the case of COVID-19 infections), we store the time of your stay in the facility or at the event on behalf of the respective operator in order to be able to report this to the authority responsible for health protection (e.g. the health department ) in the case of an infected person to identify potential contacts to enable contact tracing. The following data is collected:

• Time at which the facility/event is entered (“Check-In”)
• Time at which the facility/event is left (“Check-Out”)
• Name of facility/event and its address

• health issues

In order to decide whether a person should be granted access to a facility/event, we ask users of the Nova App certain health questions on behalf of the respective operator. The answers to the health questions are not stored by us, but only used by the operator to decide who should be granted access to a facility or event.

• On-site test by a test center or doctor commissioned by the operator

If necessary, COVID-19 tests may be carried out on site by a test center or doctor commissioned by the operator. The corresponding test result/certificate is stored in the Nova app by the operator or the test center or doctor commissioned by him and used by the operator for his participation or visitor management for his event, event series or facility.

• Health data and quick test slot

As part of participation and visitor management, we collect and store the following data on behalf of the respective operator:

• Body temperature (normal, elevated) (not saved)
• Date/time slot and location for on-site quick tests
• Copy of SARS-CoV-2 test results (e.g. PCR, rapid tests), which are carried out in accordance with the above no. (3) carried out on site on behalf of the operator.

• Possible use of a profile photo to register for events

If an operator collects profile photos of the participants when registering for access to a facility or participation in an event, the user has the option of using the photo collected during registration, on the basis of which the check-in is carried out on site at the hygiene column, to use.

With each check-in, the user receives an automated e-mail confirming the check-in. This function can be deactivated by the user via a link in each relevant e-mail.

c. Legal bases

If RLE collects personal data as the person responsible as part of the user’s registration for the Nova App, this processing is based either on the user’s consent given to RLE (Article 6 (1) (a) GDPR) or on necessity for the fulfillment of the contract (Art. 6 Para. 1 lit. b GDPR) that the user has concluded with RLE in order to be able to use the Nova App.

If a user takes the opportunity to import vaccination and test certificates from other sources (e.g. the Corona-Warn-App) into the Nova App, this processing is based on the user’s consent (Art. 6 Para. 1 lit. a DSGVO) .

If RLE processes user data anonymously for statistical purposes, the anonymization takes place on the basis of legitimate interest (Art. 6 Para. 1 lit. f DSGVO).

If a user is tested for COVID-19 in a participating test center, the required registration data and contact details (see above, Section 8 a. (1) i. and ii.) are transmitted by RLE to the respective test center and stored of the corresponding test certificate in the Nova App on the basis of the user’s consent given to RLE (Article 6 (1) (a) GDPR). The test center processes the data transmitted by the user, the swab samples taken and the test result (positive / negative / inconclusive test result) on the basis of the user’s consent, which the user gives to the respective test center via the Nova app (Art. 6 para. 1 lit. a GDPR). With regard to this data, RLE acts as the processor of the respective test center and, as its receptionist, accepts the user’s declaration of consent via the Nova App.

After transmission of the under no. 8 a. (1) i. and ii. The user’s data described to the operator, which is based on the user’s consent (Art. 6 Para. 1 lit. a DSGVO), will be processed further when using the Nova App when visiting a facility or participating in an event , carried out by RLE as the processor according to the instructions and on behalf of a person responsible in terms of data protection law, i.e. the respective operator of the facility or event. The relevant legal basis for the processing of data in the course of using the Nova App for contact tracing with regard to health protection (e.g. in the case of COVID-19 infections) is the fulfillment of a legal obligation by the operators of the facilities or events that use the Nova App ( Article 6 (1) (c) GDPR). The corresponding obligation results from the respective country-specific Coronavirus Protection Ordinance – CoronaSchV or other relevant health protection regulations.

The data collected by the Nova App beyond the country-specific health protection regulations for the purposes of visitor and participation management and access control by the operator, for billing purposes and for statistical purposes are based either (a) on the consent of the user, which he gives to the respective operator of the facility or event (Art. 6 Para. 1 lit. a DSGVO), whereby RLE acts in its role as the processor of the respective operator as its receptionist and accepts the user’s declaration of consent via the Nova app, or (b) on the necessity for the fulfillment of a contract (Art. 6 Para. 1 lit. b DSGVO) that the user has concluded for visiting a facility or participating in an event.

i.e. Duration of storage

• credentials

Registration data is stored for as long as the user is actively using the account. After a period of 180 days of inactivity , in which no logins are recorded by the system, the user is automatically notified by email. If there is no login in the following 21 days either, the data will be automatically deleted after these 201 days .

The linking of all other data (contact data) with the user account is then also canceled.

• Contact details

Contact data is managed in the same way as the registration data.

They are stored for as long as the user is actively using the account. After a period of 180 days of inactivity , in which no logins are recorded by the system, the user is automatically notified by email. If there is no login in the following 21 days either, the data will be automatically deleted after these 201 days .

• Image data for identification

The image data for identification is stored in the same way as the registration data for as long as the user is actively using the account. As soon as the consent is revoked or at the latest after a period of 180 days of inactivity in which no logins are recorded by the system, the user will be automatically notified by e-mail. If there is no login in the following 21 days either, the data will be automatically deleted after these 201 days .

• Times and place of a user’s stay

Times and places of stays will be deleted no later than one month after the end of the respective event.

• Health issues

The answers to the health questions are only used by the respective operator to decide who should be granted access to a facility or an event, but are not stored.

• Health data

The body temperature is also only used by the respective operator to decide who should be granted access to a facility or an event, but is not saved. Vaccination certificates remain in the Nova App for as long as the user chooses; the user can delete this information from the Nova app at any time. COVID-19 rapid test results are automatically deleted after 7 days, COVID-19 PCR test results after 21 days; the user also has the option of deleting this information from the Nova app beforehand. All other health data will be deleted no later than one month after the end of the event in question.

• Possible use of a profile photo to register for events

Like the login data, the profile photo is stored for as long as the user is actively using the account. As soon as the consent is revoked or at the latest after a period of 180 days of inactivity in which no logins are recorded by the system, the user will be automatically notified by e-mail. If there is no login in the following 21 days either, the data will be automatically deleted after these 201 days .

e. Voluntary

The provision of your data in the course of registering with the Nova App is voluntary. Nevertheless, without this provision, we cannot contact you, send you information and fulfill the other purposes mentioned.

Insofar as we request this data from you on behalf of the respective operator of the facility that you wish to visit or of the event in which you wish to take part, the provision of your data is also voluntary. In this case, your legal relationship with the operator decides on the consequences of not providing the data you have requested.

f. Disclosure of Data to Third Parties

The under no. 8 a. (1) i. and ii. The data described will be passed on to the authorities responsible for health protection (e.g. the health authorities) in the event that COVID-19 contact tracing is necessary.

If the user checks in with operators who use the Nova App and the check-in procedure via RLE (by scanning the QR code of an operator by the user), the operator is given a temporary, one-time display of the Registration and contact data within the Nova app are given the possibility of control. This is necessary to enable the operators to comply with their legal control obligation to ensure the correctness of the data. Although the data is displayed to the operators via the Nova App, it is not stored by the operator.

In addition, we do not pass on user data to third parties without the prior express consent of the user. A transfer to a third country is also excluded, unless a user is located in a third country himself.

G. Use of the Robert Koch Institute’s Corona-Warn-App for test certificates

Users have the option of using the Corona Warn App (“ Corona-Warn-App ”) of the Robert Koch Institute (“ RKI ”) to call up their test results of an antigen test. In order for users to be able to call up their test result via the Corona-Warn-App, it is necessary for the test result to be transmitted from the test center to the server system of the RKI. In short, this is done by the test center storing the test result, linked to a machine-readable code, on a dedicated RKI server. The code is a pseudonym of the user; further information about the user is not required to display the test result in the Corona-Warn-App. However, users have the option of personalizing the display of the test result by entering their last name, first name and date of birth. The code is formed from the intended time of the test and a random number. The code is formed by offsetting the aforementioned data with one another in such a way that it is no longer possible to calculate the data back from the code. Users receive a copy of the code in the form of a QR code, which can be read into the Corona-Warn-App using the camera function of a smartphone. Alternatively, users can also receive the pseudonymous code as an Internet link, which can be opened and processed by the Corona-Warn-App. This is the only way to link the test result to the Corona-Warn-App. With their consent, users can then call up their test results using the Corona-Warn-App. The test result is automatically deleted from the RKI server after 21 days. If a user agrees to the transmission of his pseudonymous test result by means of the code to the Corona-Warn-App infrastructure for the purpose of retrieving the test, he can consent to this via the Nova App. Users can revoke their consent at any time with effect for the future. Due to the existing pseudonymization, however, an assignment to the person of the user cannot be made, so that the data is only automatically deleted after the 21-day storage period has expired. Details on this are also available in the data protection notices of the RKI’s Corona-Warn-App.

4. Data Security

RLE and all contract processors used maintain current technical and organizational measures (“TOM”) to ensure data security, in particular to protect your personal data from dangers during data transmission and from third parties gaining knowledge. These are adapted in accordance with the current state of the art.

5. Technical and Organizational Measures (“TOM”)

A detailed overview of the current technical and organizational measures used for the respective data processing can be provided at any time on request.

6. Hosting and Subcontractors

a. Overview of the processors