1. Partner Companies

The data collected in the app will not be passed on to third parties. An exception applies if you have accessed our app via a partner, e.g., via insurance, telecommunications companies, banks, or statutory health insurance funds. In this case, we will obtain your explicit consent in the app to electronically transmit your data to the partner. The partner will only receive personal data to the minimal extent legally or functionally required.

For age verification, we regularly only transmit the information on whether you have reached a certain age limit, for example:

• Person is over 18 years old.

However, it is regularly necessary to transmit the following data, for example, if the identity verification is used to prevent a breach of secrecy within the meaning of § 203 of the German Criminal Code:

• Last name,
• First name,
• Address,
• Information on whether an address sticker is present,
• Date and place of birth
• Verification (partial) result

This ensures that, for example, your biometric video data or copies of the identification document are not transmitted to statutory health insurance funds.

Legislative requirements may necessitate that we transmit further data to the partner. If the result of our identity verification service is needed, for example, to comply with the requirements of the Money Laundering Act or the Telecommunications Act, the following additional data will be transmitted:

• Copy of the identification document in compliance with data protection and national ID card law requirements
• Copy of the selfie recording

The purpose of processing your personal data is to confirm your identity to our partner company, such as a health insurance fund. The legal basis is your declaration of consent (Art. 9 para. 2 lit. a) GDPR, Art. 6 para. 1 lit. a) GDPR) and the user agreement (Art. 6 para. 1 lit. b) GDPR).

For the fulfillment of purposes, especially the operation of our IT infrastructure, we also engage service providers who ensure smooth operation (e.g., hosting, managed services). However, these are exclusively used as processors according to Art. 28 GDPR and are contractually obliged accordingly. No processing of personal data in third countries takes place.

If we receive your data from your contractual partner for the purpose of fulfilling the order within the scope of a digital signature (e.g., electronic signing of a contract document according to the eIDAS Regulation), we are exceptionally acting as a processor within the meaning of Art. 28 GDPR in this regard. This means that we carry out all data processing exclusively on behalf of and according to the strict instructions of your responsible contractual partner. In this regard, we would also like to refer to sections 5 and 6 of our General Terms and Conditions (Nect Sign procedure).

In the event of a successful signature process, the document will be stored in your Nect Wallet, with the consequence that your contractual partner (e.g., an insurance company) is no longer responsible for this data processing. Rather, in the course of data storage in your Nect Wallet, we become the controller (again) according to Art. 4 No. 7 GDPR, as you had confirmed your previous personal identification (Nect Ident) with your previously granted declaration of consent (see IV. 1 of these privacy notices) and agreement to our General Terms and Conditions (see section 3 of our General Terms and Conditions). Nevertheless, the signed document will be transmitted to all parties involved and remains there under the responsibility of the respective recipient.

Nect is also obliged, due to or for the fulfillment of the Trust Services Act (VDG), to transmit the data mentioned under section V. to the cooperating companies (trust service providers) known to the customer if the identification purpose is a qualified electronic signature.

2. Integration Partners

Another possibility for the third-party transmission of your personal data mentioned above under section V. 1. is, exceptionally, that the verification of your identity is forwarded via an integration partner (e.g., distributor) by us or the partner (e.g., insurer) or the partner’s customer (e.g., IT service provider). In this process, only a success message regarding the verification status is transmitted to the integration partner. The partner will process the transmitted data to fulfill its legal and/or regulatory requirements (e.g., Money Laundering Act) as well as its rights and obligations arising from the contractual relationship between the partner and you.

The processing of your personal data takes place on the following legal bases:

• based on your consent to data processing according to Art. 6 para. 1 lit. a) GDPR;
• for the fulfillment of a contract according to Art. 6 para. 1 lit. b) GDPR;
• for the fulfillment of a legal obligation to which the partner is subject according to Art. 6 para. 1 lit. c) GDPR;
• within the scope of the respective contractual relationship with our respective partner service provider, Art. 28 GDPR.

3. Processors

As Nect, we also use processors for individual personal data processing operations. This includes, for example, the sending of automatic email messages within the Nect Sign procedure by service providers. Corresponding data processing agreements are concluded with the service providers in accordance with Art. 28 GDPR. These service providers process personal data only according to explicit instructions and are contractually obliged to ensure appropriate technical and organizational measures for data protection.

4. Third-Party Content

We use links to share information (e.g., needs-based advertising) from your contractual partners and/or our partner companies (e.g., from an insurance company). No plug-ins are used for this purpose, nor are content and/or information from these partner companies integrated into websites operated by us. As long as you do not click on the partner company’s link to share content there, no data will be sent to the respective partner companies. As soon as you click on a link, you will be redirected to a website of the respective partner company.

We process only and exclusively the following data for analysis purposes:

• IP address
• Internal User ID (if available)
• Browser Information
• User actions (e.g., which link they clicked)
• Timestamp

If you have given us your consent, the legal basis is Art. 6 para. 1 lit. a GDPR. In the case of consent, you are granted the right – also visually in a highlighted form – to revoke your consent at any time. The revocation of consent does not affect the lawfulness of processing carried out based on the consent until its revocation.

Furthermore, data processing is carried out to protect our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR. The legitimate interest of both us and our partner companies is the economic interest and thus the freedom of action and trade in the preparation, optimization, and/or implementation of needs-based advertising measures and/or target-group-oriented advertising to continuously improve the quality of products and/or services. The processing of the IP address will therefore not lead to conclusions about sensitive information about your person or references to your private and/or intimate sphere. The processing of the IP address will at most affect the social sphere, whereby identification of your person will not be possible directly, i.e., without further information. In no case will negative profiles or similar be created through the processing of the IP address.

Further information and data protection notices can be found in the respective data protection declarations of these partner companies.