Privacy Policy

Updated: 11th of January 2024

Effective date: 11th of January 2024

Welcome, and thank you (“your”, “user,” or “data subject”) for your interest in Locatify (“Locatify”, “we,” or “us”), our web site at https://www.locatify.com or https://cms.locatify.com (the “Site”), and all related web sites, downloadable software, mobile applications (including tablet applications), and other services provided by us and on which a link to this Privacy Policy is displayed, and all other communications with individuals through written or oral means, such as email. (collectively, together with the Site, our “Service”).

This Privacy Policy (“Policy”) describes the information that we gather on or through the Service, how we use and disclose such information, and the steps we take to protect such information.

Data protection is a high priority for the management of Locatify services. If the processing of personal data is necessary, or there is no statutory basis for such processing, we generally obtain consent from the data subject.

The processing of personal data, such as the name, address or email address of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to Locatify. By means of this data protection declaration, our enterprise would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this data protection declaration, of the rights to which they are entitled.

As the controller, Locatify has implemented numerous technical and organisational measures to ensure the most complete protection of personal data processed through its services, e.g. Data Processing Agreement on our behalf. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.

By visiting the Site, or by purchasing or using the Service, you accept the privacy practices described in this Policy.

 

1. What personal information do we collect from the people that access, use our Service?

When accessing our Service, the website of Locatify collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.

When using these general data and information, Locatify does not draw any conclusions about the data subject.

The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

When ordering or registering on our site, as appropriate, you may be asked to enter your name, email address or other details to help you with your experience.

The apps collect submitted information such as player name, email address (optional) and uploaded answers to challenges, including text and photo content (optional).

Further information Locatify App Usage Privacy Policy

1.1 When do we collect information?

We collect information from you when you visit, register on our site, place an order, subscribe to a newsletter, fill out a form or enter information on our site. We also collect information when signing up and using the apps.

Information collected when using the website:

Tracking website traffic: We use industry standard Google Analytics cookie tracking to analyse the site traffic and behaviour of site guests. All data is collected anonymously.

Tracking app downloads and usage: We count the number of times apps and tour content is downloaded so we can analyse the performance of our products. All data is collected anonymously.

Anonymous analytics of location: Users location using the apps is not shared with others. We collect anonymous analytics how the user traverses outdoors. We collect anonymous analytics on how the user traverses through the indoor environment which is used to create heat-maps of usage for the publisher to evaluate how to best use their space.

Bluetooth and WiFi/mobile network access: The app requires Bluetooth Low Energy (BLE) when locating the user indoors using the iBeacon technology. WiFi/mobile network is used to download content to enjoy offline, make purchases and communicate with other players in a multiplayer treasure hunt game.

2. How do we use your information?

We may use the information we collect from you when you visit, register for Locatify®Builder (former Creator CMS®), make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf our site, or use certain other site features in the following ways:

• To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
• To improve our website in order to better serve you.
• To allow us to better service you in responding to your customer service requests.
• To administer a contest, promotion, survey or other site feature.
• To quickly process your transactions.
• To send periodic emails regarding your order or other products and services.
• To follow up with them after correspondence (live chat, email or phone inquiries)
• Generate anonymous location heat-maps of usage.

3. How do we protect your information?

Our website is scanned and updated on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible.

Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.

We implement a variety of security measures when a user places an order, enters, submits, or accesses their information to maintain the safety of your personal information.

All transactions are processed through a gateway provider and are not stored or processed on our servers. 

Locatify uses Amazon’s AWS hosting services and you can read their Privacy Policy here.

Locatify may, at any time, provide information upon request to each data subject as to what personal data are stored about the data subject. In addition, Locatify shall correct or erase personal data at the request or indication of the data subject, insofar as there are no statutory storage obligations. The entirety of Locatify’s staff is available to the data subject in this respect as contact persons.

Locatify may request transfer to one or more processors (e.g. a payment processing service, currently using the service of Paddle, their Privacy Policy here) that also uses personal data for an internal purpose which is attributable to Locatify. A Data Processing Agreement with the processor covers the contractual terms to protect the user personal information. A list of our third parties processors can be delivered to our data subjects upon request or on our site.

Locatify shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which Locatify is subject to. If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

4. Do we use ‘cookies’?

Yes. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the site’s or service provider’s systems to recognize your browser and capture and remember certain information. They are also used to help us understand your preferences based on previous or current site activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

We use cookies to:

• Help remember and process the items in the Locatify®Builder
• Understand and save user’s preferences for future visits
• Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services such as Google Analytics that track this information on our behalf.

You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since every browser is a little different, look at your browser’s Help Menu to learn the correct way to modify your cookies.

If you turn cookies off, some features will be disabled. Some of the features make your site experience more efficient and may not function properly including access to Locatify®Builder.

5. Third-party disclosure

We do not sell, trade, or otherwise transfer to outside parties your Personally Identifiable Information unless we provide users with advance notice. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential. We may also release information when it’s release is appropriate to comply with the law, enforce our site policies, or protect ours or others’ rights, property or safety. 

6. California Online Privacy Protection Act

CalOPPA is the law in to require commercial websites and online services to post a privacy policy. According to CalOPPA, we agree to the following:

• Users can visit our site anonymously.
• We will have a link to our privacy policy on our home page, on the first significant page after entering our website.
• Our Privacy Policy link includes the word ‘Privacy’ and can easily be found on the page specified above.

7. You will be notified of any Privacy Policy changes:

On our Privacy Policy Page

8. Changing or deleting your personal information:

• The Locatify®Builder user can change his/her personal information and delete their account within the Locatify®Builder
  • All content associated with the account will be deleted.

9. Does our site allow third-party behavioural tracking?

It’s also important to note that we allow third-party behavioural tracking.

10. COPPA (Children Online Privacy Protection Act)

When it comes to the collection of personal information from children under the age of 13 years old, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, United States’ consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online.

We do not specifically market to children under the age of 13 years old.

11. In order to be in line with GDPR and Fair Information Practices we will take the following responsive action, should a data breach occur:

We will notify the users via in-site notification within 7 business days.

We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.

11.1 Right of confirmation

Each data subject shall have the right granted by the European legislator to obtain from Locatify the confirmation as to whether or not personal data concerning him or her are being processed. If a data subject wishes to avail himself of this right of confirmation, he or she may, at any time, contact any employee of the controller or delete the account from Locatify®Builder.

11.2 Right of access

Each data subject shall have the right granted by the European legislator to obtain from Locatify free information about his or her personal data stored at any time and a copy of this information. Furthermore, the European directives and regulations grant the data subject access to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing;
• the existence of the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from the data subject, any available information as to their source;
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to avail himself of this right of access, he or she may, at any time, contact any employee of the controller.

 11.3 Right of rectification

Each data subject shall have the right granted by the European legislator to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If a data subject wishes to exercise this right to rectification, he or she may, at any time, contact any employee of the controller or delete his/her information from the Locatify®Builder.

 11.4 Right to erasure (Right to be forgotten)

Each data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies, as long as the processing is not necessary:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
• The data subject withdraws consent to which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing,
• The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR,
• The personal data have been unlawfully processed,
• The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject,
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by the controller, he or she may, at any time, contact any employee of the controller to delete it or delete it directly from the Locatify®Builder. 

 11.5 Right of restriction of processing

Each data subject shall have the right granted by the European legislator to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use instead,
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,
• The data subject has objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by the controller, he or she may at any time contact any employee of the controller or delete their own data from the Locatify®Builder.  

11.6 Right of data portability

Each data subject shall have the right granted by the European legislator, to receive the personal data concerning him or her, which was provided to a controller, in a structured, commonly used and machine-readable format. He or she shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means, as long as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.‍

In order to assert the right to data portability, the data subject may at any time contact any employee of the controller or delete it directly from the Locatify®Builder.

 11.7 Right to object

Each data subject shall have the right granted by the European legislator to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on these provisions.

The controller shall no longer process the personal data in the event of the objection, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If the controller processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to the controller to the processing for direct marketing purposes, the controller will no longer process the personal data for these purposes.

In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by the controller for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

In order to exercise the right to object, the data subject may contact any employee of the controller or delete it directly from the Locatify®Builder. In addition, the data subject is free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use his or her right to object by automated means using technical specifications.

 11.8 Automated individual decision-making, including profiling

Each data subject shall have the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, as long as the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is not based on the data subject’s explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) it is based on the data subject’s explicit consent, the controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and contest the decision.

If the data subject wishes to exercise the rights concerning automated individual decision-making, he or she may, at any time, contact any employee of the employer or delete all data directly from the Locatify®Builder.

15.9 Right to withdraw data protection consent

Each data subject shall have the right granted by the European legislator to withdraw his or her consent to processing of his or her personal data at any time.

If the data subject wishes to exercise the right to withdraw the consent, he or she may, at any time, contact any employee of the controller or delete all data directly from the Locatify®Builder.

16. CAN SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to:

• Send information, respond to inquiries, and/or other requests or questions
• Process orders and to send information and updates pertaining to orders
• Send you additional information related to your product and/or service
• Market to our mailing list or continue to send emails to our clients after the original transaction has occurred.

To be in accordance with CANSPAM, we agree to the following:

• Not use false or misleading subjects or email addresses
• Identify the message as an advertisement in some reasonable way
• Include the physical address of our business or site headquarters
• Monitor third-party email marketing services for compliance, if one is used
• Honor opt-out/unsubscribe requests quickly
• Allow users to unsubscribe by using the link at the bottom of each email.

17. If at any time you would like to unsubscribe from receiving future emails:

Follow the instructions at the bottom of each email and we will promptly remove you from ALL or SELECTED correspondence.

18. Contacting Us

Please contact us with any questions or comments about this Policy, your Personal Data, our use and disclosure practices, or your consent choices by email at info@locatify.com. If you have any concerns or complaints about this Policy or your Personal Data, you may contact Locatify’ by email at info@locatify.com.