Privacy policy for the “Unisu Sudoku” app

1. Data controller

The controller responsible for data processing is:

Stubbe + Finke PartG
Masen 52
22419 Hamburg
Germany
Email: hello@pola-studio.de
Telephone: 040 573 098 340

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2. Using the app and accepting this privacy policy

Using Unisu Sudoku requires you to accept this privacy policy or confirm that you have read it.

Accepting this privacy policy does not automatically mean that you consent to all data processing. Where consent is required for individual processing activities, we obtain it separately. You can withdraw consent at any time with effect for the future.

3. General information about the app

Unisu Sudoku is a Sudoku app for iOS and Android smartphones. The app generally runs locally on your device.

There are:

• no user accounts
• no adverts
• no in-app purchases
• no cloud synchronisation of saved games
• no transmission of your locally saved games to us, unless otherwise described in this privacy policy

Saved games, settings and other app data are stored locally on your device to the extent necessary to use the app. This local data remains on your device and is not transmitted to us.

4. Downloading through app stores

When you download the app through the Apple App Store or Google Play, Apple or Google may process personal data. This may include, in particular, account data, device information, payment or billing information, the time of download and technical diagnostic data.

We have no control over this data processing. The privacy policies of the respective app store provider apply.

5. Local storage on your device

Unisu Sudoku stores certain data locally on your device so that the app works properly. This may include, in particular:

• saved games
• settings
• progress
• app preferences
• information about locally scheduled notifications

This data is not transmitted to us. You can usually delete local app data by uninstalling the app or, where supported by the operating system, by removing the app data in your system settings.

Local storage is used to provide the app functions you request. The legal basis is Article 6(1)(b) GDPR, to the extent that processing is necessary to use the app, and Article 6(1)(f) GDPR, based on our legitimate interest in a functional and user-friendly app.

6. Local notifications

Unisu Sudoku may use local notifications if you allow them on your device. Notifications are scheduled and triggered directly on your device.

Local notifications do not require your data to be transmitted to us. Notification permissions are managed through your smartphone’s operating system.

You can disable or adjust notifications at any time in your device’s system settings.

7. Contact form

If you contact us through the contact form in the app, the information you enter is transmitted to our server and stored there to handle your enquiry.

The following data may be processed, in particular:

• name, if provided
• email address
• content of your message
• time of the enquiry
• technical transmission data

Processing is based on Article 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual steps. In all other cases, processing is based on our legitimate interest in handling your enquiry under Article 6(1)(f) GDPR, or on your consent under Article 6(1)(a) GDPR where this has been requested.

The data you submit remains with us until you ask us to delete it, withdraw your consent or the purpose of storage no longer applies, for example once your enquiry has been fully handled. Statutory retention obligations remain unaffected.

8. Contact by email

If you contact us by email, we process your enquiry, including all personal data it contains, to handle your request.

Processing is based on Article 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual steps. In all other cases, processing is based on our legitimate interest in handling your enquiry under Article 6(1)(f) GDPR, or on your consent under Article 6(1)(a) GDPR where this has been requested.

The data you submit remains with us until you ask us to delete it, withdraw your consent or the purpose of storage no longer applies. Statutory retention obligations remain unaffected.

9. Hosting and server operation

We use server services from an external provider to operate our technical infrastructure, process contact enquiries and run our self-hosted analytics with Umami.

We use the following hosting provider:

DigitalOcean, LLC
101 Avenue of the Americas, 10th Floor
New York, NY 10013
USA
Server location: Frankfurt am Main, Germany

The servers may process, in particular, contact enquiries, communications data, technical access data, server log data and pseudonymised or aggregated usage data.

Hosting serves to provide our app functions securely and efficiently, handle contact enquiries and operate our self-hosted analytics infrastructure. The legal basis is Article 6(1)(f) GDPR. Where processing is necessary to handle your enquiry or take pre-contractual steps, it is also based on Article 6(1)(b) GDPR.

We have entered into a data processing agreement with DigitalOcean under Article 28 GDPR. DigitalOcean processes personal data according to our instructions and only to the extent necessary to provide the services.

Although the servers are located in Germany, processing of or access to data in the USA cannot be completely ruled out. DigitalOcean is certified under the EU-U.S. Data Privacy Framework. Where its requirements are met, transfers take place on the basis of the European Commission’s adequacy decision under Article 45 GDPR. If this transfer mechanism does not apply, the contract with DigitalOcean provides for the EU Standard Contractual Clauses as appropriate safeguards under Article 46 GDPR.

10. Server log data

When the app communicates with our servers, server log data may be processed for technical reasons. This may include, in particular:

• IP address
• time of access
• server address or interface accessed
• volume of data transmitted
• general device and operating system information
• technical error and status messages

This data is processed to ensure the security, stability and functionality of our servers and app functions. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing the app securely and reliably.

11. Analytics with self-hosted Umami

We use Umami, an open-source analytics tool, to analyse app usage statistically and improve the app. We operate Umami ourselves and host it on our server infrastructure at DigitalOcean. Analytics data is not shared with an additional analytics provider.

Umami works without cookies and does not create personal user profiles. To distinguish sessions, technical information such as the IP address, user agent and website ID is used to generate a hashed identifier that cannot be directly attributed to an individual. The IP address is not stored permanently.

The following information may be processed, in particular:

• app sections or screens accessed
• time of access
• operating system used, for example iOS or Android
• general device type
• technical information about app usage
• pseudonymised or aggregated usage events, such as completed games or selected difficulty levels, where these are recorded

Analytics serves to improve the app and support its stability and further development. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in a user-friendly and technically optimised app.

Where consent is required for certain analytics activities, processing takes place exclusively on the basis of Article 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future.

12. No adverts, in-app purchases or user accounts

Unisu Sudoku contains no adverts or in-app purchases. The app does not require a user account.

We do not create personal profiles for advertising purposes or share personal data with third parties for advertising purposes.

13. No location data, camera or microphone access

Unisu Sudoku does not require location data, camera access or microphone access. The app does not collect or process such data.

14. Retention period

Unless a more specific retention period is stated in this privacy policy, we store personal data only for as long as necessary for the respective purpose.

If you request deletion or withdraw consent, we delete your data unless statutory retention obligations or other lawful grounds for continued storage apply. Statutory retention periods remain unaffected.

15. Legal bases for processing

Where you have consented to data processing, processing is based on Article 6(1)(a) GDPR.

Where processing is necessary to perform a contract or take pre-contractual steps, it is based on Article 6(1)(b) GDPR.

Where we are legally obliged to process data, processing is based on Article 6(1)(c) GDPR.

In all other cases, processing may be based on our legitimate interest under Article 6(1)(f) GDPR. We explain the relevant legal bases in the individual sections of this privacy policy.

16. Recipients of personal data

We share personal data with external parties only where this is necessary to handle your enquiry, where we are legally obliged to do so, where you have consented or where another legal basis permits disclosure.

When using service providers, we ensure that personal data is processed only to the extent necessary and that appropriate contractual agreements are in place where required by law.

17. Transfers to third countries

Processing of personal data outside the European Union or the European Economic Area cannot be completely ruled out, particularly where service providers or their affiliated companies are based in a third country or support services are provided from a third country.

Where personal data is transferred to third countries, this takes place only in accordance with legal requirements, in particular on the basis of an adequacy decision by the European Commission or appropriate safeguards within the meaning of Articles 44 et seq. GDPR. For DigitalOcean, the transfer mechanisms described in the “Hosting and server operation” section apply.

18. Withdrawing your consent

Many data processing activities are only possible with your consent. You can withdraw consent you have already given at any time with effect for the future.

Withdrawal does not affect the lawfulness of data processing carried out before withdrawal.

19. Right to object under Article 21 GDPR

Where data processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation.

If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for this purpose. Unisu Sudoku does not carry out direct marketing within the app.

20. Access, rectification and erasure

Within the scope of applicable law, you have the right at any time to obtain information free of charge about your stored personal data, its source, recipients and the purpose of processing.

You also have the right to have this data rectified or erased. You can contact us at any time about these rights or any other questions concerning personal data.

21. Right to restriction of processing

You have the right to request restriction of the processing of your personal data.

The right to restriction of processing applies in particular:

• if you contest the accuracy of the personal data we hold about you
• if processing is unlawful and you request restriction of processing instead of erasure
• if we no longer need your personal data but you need it to establish, exercise or defend legal claims
• if you have objected under Article 21(1) GDPR and it has not yet been determined whose interests prevail

22. Right to data portability

You have the right to have data that we process by automated means on the basis of your consent or in performance of a contract provided to you or a third party in a commonly used, machine-readable format.

If you request that data be transferred directly to another controller, this will only take place where technically feasible.

23. Right to lodge a complaint with a supervisory authority

In the event of GDPR infringements, you have the right to lodge a complaint with a data protection supervisory authority. In particular, you can contact a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

24. Data security

We treat your personal data confidentially and in accordance with statutory data protection rules and this privacy policy.

Data from the contact form is transmitted in encrypted form. Please note that data transmission over the internet, for example by email or mobile networks, may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

25. Changes to this privacy policy

We may amend this privacy policy if the app, our technical systems or legal requirements change. The current version applies in each case.