We would like to give you an overview of how we process your personal data and what rights you have under data protection law. The specific data processed and its use depend on the services requested or agreed, so not all information may be relevant to you.

Definitions
In accordance with Art. 4 GDPR, this data protection notice is based on the following definitions:
- Personal data(Art. 4 No. 1 GDPR) is any information relating to an identified or identifiable natural person ('data subject'). A person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or information relating to their physical, physiological, genetic, mental, economic, cultural or social identity. Identifiability can also be achieved by linking such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photos, video or audio recordings can also contain personal data).
- Processing(Art. 4 No. 2 GDPR) means any operation which is performed on personal data, whether or not by automated means (i.e. by technical means). This includes, in particular, the collection (i.e. acquisition), recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data, or alteration of the purposes for which they were originally processed.
- The controller(Art. 4 No. 7 GDPR) is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
- Third party(Art. 4 No. 10 GDPR) means any natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data; this also includes other legal entities belonging to the group.
- Processor(Art. 4 No. 8 GDPR) is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller's instructions (e.g. IT service provider). In terms of data protection law, a processor is in particular not a third party.
- Consent(Art. 4 No. 11 GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Contact details of the person responsible
The controller within the meaning of the GDPR is:
Jourma GmbH
Taunustor 1
60310 Frankfurt am Main / Deutschland
Telefon:+49 69 5050604633
E-Mail:info(at)jourma.de
Website:https://jourma.de
Contact details for data protection issues
If you have any questions about data protection, please contact our data protection officer at datenschutz(at)jourma.de and using the contact details given above.
Scope of the processing of personal data
We collect personal data from you when you use our app. Personal data is all information that relates to you personally. This includes your surname, first name, location data, IP address, email address or additional optional information from you.
Generally, our app only processes users' personal data insofar as this is necessary for the proper functioning and provision of our services. Otherwise, personal data is only processed with the express consent of the user. An exception applies if prior consent cannot be obtained for practical reasons and the processing is permitted by law.
We may process the following categories of data:
- Account data(e.g. first name, surname, email address, password);
- App data(e.g. app settings, app version, app update delivery status, remote configuration parameters);
- Attribution data(e.g. deep links, user acquisition information, app install data, engagement data);
- Authentication data(e.g. user credentials, session information, social login data);
- AI data(e.g. chat information, conversion history, text-to-speech content, Journey data, language, attachments);
- Business page insight data(e.g. demographic information such as age, gender, region and country, interaction with the business page such as likes, subscriptions, sharing and viewing content, posts, interests);
- Communication data(e.g. email content, in-app feedback, social media post);
- Connection data(e.g. IP address, HTTP header, user agent);
- Contact data(e.g. email address, phone number);
- Core data(e.g. first name, surname);
- Data privacy requests(e.g. your specific request, our answer, our documentation of the fulfilment of the request);
- Device data(e.g. device type, screen resolution, operation system, language, technical specifications);
- Error data(e.g. crash reports, performance monitoring information, app version);
- Identifier(e.g. user ID, device ID, advertising ID, Firebase installation ID);
- Journey data(e.g. hotels, flights, car rent, entertainment and tours, start and end location and time, number and kind of travellers, uploaded documents), if applicable;
- Location data(e.g. country, region, city, GPS coordinates, map usage patterns);
- Notification data(e.g. push notifications delivery and targeting);
- Profile data(e.g. profile photo, language, currency, search filters, favourites, wish list, evaluations, in-app feedback, plans, menus, food preferences (diet, cuisine), interests, gender), if applicable;
- Usage data(e.g. user behaviour, app visited, date and time of visit, duration of visit, previously visited pages, scroll and touch activity, buttons clicked, links followed, files downloaded, interaction with media and forms, performance metrics, screen recordings, heatmaps, first app start).
4.1 App Functions
In our app, you have especially the following functions:
- Discover food and drink prices and locations on the map, including filters for categories, diet, cuisine, the display of Google reviews, and the possibility to create menus and to give singular feedback to locations (Prices);
- Create a journey with day planning, including hotels, flights, car rent, entertainment and tours, with start and end location and time, the number and kind of travellers, and the possibility to upload documents (Journey Master);
- Search for audio tours, places, sights (Insider);
- Share links and inviting persons to plans and menus;
- Receive notifications, e.g. about persons joining your plan or menu, after accepting the respective permission request of your device;
- Search, edit and delete your conversion history with our AI chatbot;
- Save, edit and delete favourites and locations for the wish list;
- Restaurant reservations.
The name of invited or joined persons is visible at a plan or menu.
In your profile, you have especially the following options:
- See and edit personal information, such as name, email address and profile photo;
- See evaluations and comments regarding your experiences (Prices and Insider);
- See and edit your language and currency;
- Configure your app notification;
- Change your password;
- Give feedback regarding the app by selecting a topic and writing your feedback in detail.
4.2 AI Usage
When using AI-based app features within the chatbot and for the provision of information, additional user inputs (such as texts or voice data) and automatically collected information (such as the GPS location, language, device data) may be processed and transmitted to AI providers (in particular OpenAI). As our AI API works server-based, the user’s device IP address is not shared with the AI provider. Processing is carried out exclusively for the purpose of providing the requested functionality. Your data will not be processed to train OpenAI’s algorithms.
Outputs generated by AI systems are for informational purposes only. Jourma GmbH does not review or guarantee the accuracy, completeness, or suitability of this content.
4.3 Contact form
If you contact us using the contact form provided in the Jourma app, this is done on the basis of our legitimate interest in processing and answering your contact request (Art. 6 para. 1 letter f GDPR). We only use the data transmitted via the contact form to respond to your enquiry. This data will not be used for any other purpose at any time.
4.4 Restaurant reservations
If you use restaurant reservations, your contact data might be transferred to the respective restaurant. It processes the data in its own responsibility. The reservation functionality is completely optional. Legal ground for using and transferring your data to the respective restaurant is our legitimate interests in establishing contact with the restaurant and realising the reservation for you (Art. 6 para. 1 letter f GDPR). In this case, the transfer to the restaurant in the third country is governed by Art. 49 para. 1 letter b or c GDPR, the necessity for the transfer because of the performance of a contract or precontractual measures.
Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data (e.g. for app tracking), Art. 6 para. 1 letter a GDPR serves as the legal basis. If we process your data in order to take steps at your request prior to entering into a contract or for the performance of a contract with you (e.g. by using the features of our app), our legal basis is Art. 6 para. 1 letter b GDPR. Otherwise, we process personal data in accordance with Art. 6 para. 1 letter f GDPR on the basis of legitimate interest, which we describe more detailed in the privacy policy’s section about the purposes of data processing.
Purpose of data processing
Personal data is processed for various purposes:
- Service Provision:Enabling the usability of our service, ensuring the permanent functionality and security of our information technology systems, maintaining our service in general for administrative purposes (Art. 6 para. 1 letter b, f GDPR). This includes the provision of our online offering with all its content and functions, maps and places services, transferring of configurations and backend functionality as well as the provision of contractual services, including service and customer support, as described in the section about the scope of the data processing.
- Contact:Respond to contact enquiries, communicate with users, and provide a contact form (Art. 6 para. 1 letter f GDPR);
- Registration and login:Creation and maintaining of customer accounts, including registration, authentication, authorisation, session management, and usage of third-party login services (Art. 6 para. 1 letter b, f GDPR);
- Reservations:Making reservations at restaurants on behalf of our users (Art. 6 para. 1 lit. f GDPR).
- Analytics:Providing analytical tools which recognise users of our service by identifiers, measure app visits, analyse the usage behaviour, perform A/B tests, segment users, record sessions, create heatmaps, and use the data to optimize the app (Art. 6 para. 1 letter f GDPR). The purpose of using analytics technologies is to improve the quality of our app and its content. The data is not analysed for marketing purposes in this context;
- Deep Linking:Redirecting users to a specific area in our app and analysing the efficiency of our campaigns and the user acquisition (Art. 6 para. 1 letter f GDPR).
- Updating:Performing (over-the-air) updates or changing the behaviour and appearance of our app without download an update (Art. 6 para. 1 letter b, f GDPR).
- Error Monitoring:Detecting and solving errors and ensure app’s functionality, performance and security (Art. 6 para. 1 letter f GDPR).
- Push Notifications:Delivering and targeting of push notifications for a specific app (Art. 6 para. 1 letter f GDPR).
- Social Network Business Pages:Providing and managing a social network business page, including communication with interested parties and clients, and processing of aggregated business page insight data for the optimization of the business page’s structure and design (Art. 6 para. 1 letter f GDPR);
- Data Privacy Requests:Processing and answering your data privacy requests, and storage of your requests for documentation obligations (Art. 6 para. 1 letter f GDPR);
- Compliance:Enforcement of our own legal claims and compliance with other legal provisions (Art. 6 para. 1 letter c, f GDPR).
Data recipients
The data collected by us will only be forwarded on if there is a legal basis for this under data protection law in the specific case.
We use external service providers for certain functions of our app. As is common practice in many companies, we use both national and international partners for various business processes, including IT, logistics, telecommunications, sales and marketing. These service providers act exclusively in accordance with our instructions and are contractually obliged to comply with data protection regulations on the basis of a so-called order data processing agreement (DPA) in accordance with Art. 28 GDPR.
The following categories of recipients – usually acting as processors – may have access to your personal data under certain circumstances:
- Technical service providerswho ensure the operation of our app and the processing of the stored or transmitted data (e.g. data centres, payment processors, IT security service providers). The transfer takes place on the basis of Art. 6 para. 1 letter b or letter f GDPR, unless they are processors;
- Public authorities and government agencies, if we are legally obliged to disclose your data, in particular if this is necessary due to binding requirements, official enquiries, court orders and legal proceedings for legal prosecution or enforcement (Art. 6 para. 1 letter c GDPR);
- External partners in business operations, such as auditors, banks, insurance companies, legal advisors or supervisory authorities. This may be the case, if the disclosure is necessary to protect our interests or for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data. The data transfer takes place on the basis of Art. 6 para. 1 letter b or letter f GDPR;
- In addition, we only pass on personal data to third parties if this is legally permissible and necessary for the performance of a contract or for the implementation of pre-contractual measures that are carried out at your request (Art. 6 para. 1 letter b GDPR), or you have given us your express consent to do so in accordance with Art. 6 para. 1 letter a GDPR.
Your data will be forwarded especially to the following recipients:
- Google(Google Maps SDK, Google Places API, Google Signin, Google Firebase Analytics, Google Firebase Cloud Messaging, Google Firebase Core, Google Firebase Remote Config): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – privacy notice:https://business.safety.google/privacy/– privacy settings:https://safety.google/privacy/privacy-controls/– transfer to third country: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (adequacy decision, certified for the EU-US Data Privacy Framework);
- LinkedIn(LinkedIn Business Page): LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland – privacy notice:https://www.linkedin.com/legal/privacy-policy– privacy settings:https://www.linkedin.com/psettings/enhanced-advertising– transfer to third country: LinkedIn Corporation, 2029 Stierlin Ct. Ste. 200 Mountain View, California 94043, USA (adequacy decision, certified for the EU-US Data Privacy Framework);
- Meta(Facebook Fanpage, Instagram Business Profile): Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland – privacy notice:https://www.facebook.com/privacy/policy/– privacy settings:https://www.facebook.com/settings/?tab=ads– transfer to third country: Meta Platforms Inc., 1601 Willow Road, Menlo Park, California 94025, USA (adequacy decision, certified for the EU-US Data Privacy Framework);
- OpenAI(OpenAI API): Open AI Ireland Ltd., The Liffey Trust Centre, Dublin 1, 117-126 Sheriff Street Upper, D01 YC43 Dublin, Ireland – privacy notice:https://openai.com/policies/privacy-policy– transfer to third country: OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, USA (Standard Contractual Clauses);
- Apple(Apple Login): Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland – privacy notice:https://www.apple.com/legal/privacy/– transfer to third country: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (Standard Contractual Clauses; derogations for specific situations);
- AWS(Amplify for Authentication, Amplify Flutter, AWS Location): Amazon Web Services EMEA SARL, 38 avenue John F. Kenedy, L-1855, Luxembourg – privacy notice:https://aws.amazon.com/de/privacy/– transfer to third country: Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA (adequacy decision, certified for the EU-US Data Privacy Framework);
- Amplitude(Amplitude): Amplitude, Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA – privacy notice:https://amplitude.com/privacy– transfer to third country: adequacy decision, certified for the EU-US Data Privacy Framework;
- Microsoft(Microsoft Clarity): Microsoft Ireland Operations Limited, South County Business Park, Leopardstown, Dublin 18, Ireland – privacy notice:https://www.microsoft.com/en-us/privacy/privacystatement– transfer to third country: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (adequacy decision, certified for the EU-US Data Privacy Framework);
- Branch(Branch): Branch Metrics, Inc., 1975 W El Camino Real, Ste. 102, Mountain View, CA 94040, USA – privacy notice:https://legal.branch.io/#branchio-privacypolicy– privacy setting:https://legal.branch.io/#branchio-privacyoptout– transfer to third country: adequacy decision, certified for the EU-US Data Privacy Framework;
- Sentry(Sentry): Functional Software, Inc., 32 Hawthorne St San Francisco, CA, 94107-1308, USA – privacy notice:https://sentry.io/privacy/– transfer to third country: adequacy decision, certified for the EU-US Data Privacy Framework;
- Shorebird(Shorebird): Code Town, Inc. d/b/a Shorebird, 2261 Market Street #5112 San Francisco, CA 94114-1612, USA – privacy notice:https://shorebird.dev/privacy/– transfer to third country: Standard Contractual Clauses, Module 2.
In exceptional cases, we are jointly responsible for specific data processing with those recipients, as following: We and social network providers process business page insight data on our social network business pages as joint controllers, whereby the respective social network provider is contractually responsible to fulfil the data subject rights and we will forward your requests. More information can be found in this privacy notice. You can find the relevant contracts with our joint controllers at: LinkedIn (LinkedIn Ireland Unlimited Company):https://legal.linkedin.com/pages-joint-controller-addendum; Facebook, Instagram (Meta Platforms Ireland Ltd.):https://www.facebook.com/legal/terms/page_controller_addendum.
Transfer to third countries
We may use services whose providers are partly located in so-called third countries (outside the European Union (EU) or the European Economic Area (EEA), particularly the USA) or transfer personal data there, i.e. countries whose level of data protection does not correspond to that of the European Union.
If an adequacy decision of the European Commission (Art. 45 GDPR) exists for these countries, we base the data transfer on this. This applies, for example, to transfers to Argentina, Israel, Japan, Canada, the Republic of Korea, New Zealand, Switzerland, Uruguay or the United Kingdom. In the case of the USA, this only applies if the US recipient has certified itself for the EU-US Data Privacy Framework.
If no adequacy decision has been issued for the country in question, we have taken appropriate contractual safeguards to ensure an adequate level of data protection for any data transfers. These include the EU Standard Contractual Clauses or Binding Corporate Rules (Art. 46 GDPR).
Where this is not possible, we base the transfer of data on exceptions under Art. 49 GDPR, in particular your explicit consent or the necessity of the transfer for the performance of the contract or for the implementation of pre-contractual measures.
If a transfer to a third country is planned and there is no adequacy decision or appropriate safeguards, it is possible and there is a risk that authorities in the respective third country (e.g. intelligence services) may gain access to the transferred data in order to collect and analyse it, and that the enforceability of your data subject rights cannot be guaranteed. If your explicit consent is obtained, you will also be informed of this.
Your data may be forwarded especially to the recipients in third countries mentioned in the section about data recipients, including the adequacy decision or appropriate safeguard for the data transfer.
Duration of data storage
We only store your personal data for as long as it is required for the respective purposes for which it was collected. As a rule, data is stored for the duration of use or the contractual relationship within the app. Your data is stored exclusively on our servers in Germany, provided that it is not passed on to other service providers, third parties or forwarded to one of our partner apps. Service providers commissioned by us will only store your data on their systems for as long as is necessary to provide the commissioned service. Your contact requests will be stored for a maximum of 6 months.
In certain cases, storage beyond this period may be necessary, for example in the event of an impending or ongoing legal dispute with you or in the context of other legal proceedings.
Statutory retention periods and deletion requirements remain unaffected by this, for example according to the German § 257 HGB or § 147 AO. After expiry of the statutory retention period, the data will be deleted unless further storage is necessary and covered by a legal basis.
Access and storage of information on the device
Our Jourma app only access or store information on your device if this is strictly necessary to provide your requested digital service, i.e. for the main functions of our service, or if you have given your prior consent, i.e. for optional services, according to implementation laws of the ePrivacy Directive of the EU member states, in Germany in accordance with § 25 TDDDG.
We use technologies such scripts, software development Kits (SDK) and other programming code, which access information on your device, like identifiers such as device ID or advertising ID. Usually, such technologies are not blocked by your device. But you can adapt your device settings on mobile devices to block the access to your advertising ID.
The use of technologies that are not technically necessary constitutes data processing that is only permitted with your express and active consent in accordance with Art. 6 para. 1 letter a GDPR. This applies in particular to analytics, advertising, targeting and sharing technologies. The legal basis for the processing of personal data using technically necessary technologies is Art. 6 para. 1 letter b or letter f GDPR. In addition, personal data collected by such technologies will only be passed on to third parties if you give us your express consent in accordance with Art. 6 para. 1 letter a GDPR.
10.1 Google Maps and Places
Our app uses the map service Google Maps (Maps SDK for Flutter). To integrate and display the map in our app, it must establish a connection to a Google server, which may be located in the USA. By integrating the map material, Google receives the information that the map material has been accessed within the app. In addition, events (interactions and events) are used for Maps functionality, such as clicking on the map, changing the camera settings and clicking and dragging markers. If you have enabled your GPS location in the settings of your mobile device, Google Maps will also use your location data and AWS Location will be used to find the relevant city/district of your location. Furthermore, we use the Places API of Google Maps in particular to search for places and to display contact details, opening hours, pictures, reviews and prices for locations. In this case, your search queries will be processed. Legal ground for the implementation of Google Maps is Art. 6 para. 1 letter b and f GDPR, as the display of the map and of location details is a core element of our app especially for the Prices and Insider functionality.
10.2 Google Signin and Apple Login
Our app offers you the option of login and authentication with an existing account from Google or Apple. Once you have logged in with one of your existing accounts, no additional registration is required. If you wish to use the function, you will first be redirected to the relevant login provider. There you will be asked to log in with your usual credentials. We do not take note of this login information. The server to which a connection is established may be located in the USA.
By confirming the corresponding login button in our app, the relevant login provider will be informed that you have logged in to our app with your account and will link your login provider’s account to your account in our app. In addition, the login provider will transfer information, which we will use to create your profile, at least: email address and full name. Besides, the login provider processes the following information when using the login, authorisation and authentication process: connection data including IP address, device data, login timestamp, Google or Apple account information and identifier.
Legal ground is our legitimate interest according to Art. 6 para. 1 letter f GDPR to offer you a further option for login and authentication with Google or Apple. It is completely optional to use this possibility.
You can find more information about the privacy of the login providers under:
Google Signin:https://support.google.com/accounts/answer/12921417?hl=en.
Apple Login:https://www.apple.com/legal/privacy/data/en/sign-in-with-apple/.
10.3 Analytics
We use technologies such as Amplitude, Google Firebase Analytics and Microsoft Clarity to understand user behaviour and engagement in our app. For this, we collect connection data, device data, identifier and usage data to analyse it for statistics, performance monitoring, user segmentation and product insights. This includes the creation of heatmaps for the visualisation of user behaviour, session recordings, and the performance of A/B tests for the comparison of different app designs and functions to improve and optimise our app.
As the usage of our app is completely free and still in development, the collection and analysis of such usage and device information is needed for the optimisation and development of our app. Without such information, we would not understand the most used functions and areas our app and possible issues in our design. Therefore, legal ground is our legitimate interest according to Art. 6 para. 1 letter f GDPR to realise the ongoing development and improvement of our app.
10.4 Deep Linking
We use Branch as our deep linking services, which makes it possible to redirect users with a link to a specific area in our app, even if those users have to install our app first, and to analyse the efficiency of our campaigns and the user acquisition. For this, we process identifier, attribution data, connection data, device data and usage data. Legal ground is our legitimate interest according to Art. 6 para. 1 letter f GDPR to understand if our links are effective and where our users are coming from. The usage of Branch can be prevented by a setting of your mobile device regarding the usage of the device identifier as described here:https://legal.branch.io/#branchio-privacyoptout.
10.5 Google Firebase Cloud Messaging
We use Google Firebase Cloud Messaging for the delivery and targeting of push notifications. Such notifications are only displayed if you have given your permission. Google Firebase Cloud Messaging uses the Firebase installation ID and an authentication token to address the notification specifically to your device. Thereby, the Firebase installation ID is different from app to app and is not directly related to your person. The authentication token is used to ensure the secure sending and receiving of the notification and is changed every time. Furthermore, an aggregated usage analysis happens regarding the delivery of notifications. Both data at rest and in transit are encrypted. Legal ground is our legitimate interest according to Art. 6 para. 1 letter f GDPR to provide you with relevant app-related information.
10.6 Google Firebase Remote Config
We use Firebase Remote Config to change the behaviour and appearance of our app without users having to download an app update. Remote Config also allows us to make new features available to specific users. To do this, we add a new condition and select a random percentage of our users. We also use Firebase Remote Config to perform A/B testing for optimisation purposes. A/B testing allows us to use statistical analysis to measure whether users like new features or whether they prefer the app in its current form. For these purposes, identifier like the Firebase installation ID, app data, device data and usage data will be processed. Legal ground is Art. 6 para. 1 lit. b GDPR or our legitimate interest according to Art. 6 para. 1 letter f GDPR to realise the provision and the ongoing development and improvement of our app.
10.7 Sentry
We use Sentry as our app error monitoring and performance service. It processes identifier, connection data, device data and error data to detect and debug errors and problems that may endanger our app functionality and security. Legal ground is our legitimate interest according to Art. 6 para. 1 letter f GDPR to ensure the functionality and stability of our app.
10.8 Shorebird
We use Shorebird to perform over-the-air app updates and maintain the update delivery. For this, identifier, device data and app data like the app version and update delivery status will be processed. Legal ground is Art. 6 para. 1 lit. b GDPR or our legitimate interest according to Art. 6 para. 1 letter f GDPR in keeping our app up to date.
10.9 Use of Font Awesome Pro icons
Our app incorporates icon graphics from Font Awesome Pro (Fonticons, Inc.), which are included locally in the application. These icons are bundled within the app's assets and are used purely for visual display. No personal or device data (e.g. IP address, usage metrics) is sent to Font Awesome or any external servers when icons are displayed, since the assets are stored on your device. The use of these icons has no impact on your privacy and does not involve any tracking or external requests.
Your rights as a data subject
- 11.1 Right to information
  In accordance with Art. 15 GDPR, you have the right to obtain information from us about the personal data concerning you. This requires a request from you, which must be sent either by e-mail or by post to the addresses given above.
- 11.2 Right to object to data processing and to withdraw consent
  In accordance with Art. 21 GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you. We will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims. If we process your data for direct marketing purposes, we fulfil your objection without reasoning.
  In accordance with Art. 7 para. 3 GDPR, you have the right to withdraw your consent at any time. The consequence of this is that we may no longer continue the data processing based on this consent in the future.
  In this regard, please contact the contact point indicated above.
- 11.3 Right to rectification and erasure
  Insofar as personal data concerning you is incorrect, you have the right under Art. 16 GDPR to demand that we correct it immediately. If you wish to make such a request, please contact the contact point specified above.
  Under the conditions set out in Art. 17 GDPR, you have the right to request the erasure of personal data concerning you. To make a request in this regard, please contact the contact point specified above. In particular, you have the right to erasure if the data in question is no longer necessary for the purposes for which it was collected or processed, if the data retention period has expired, if there is an objection or if the processing is unlawful.
- 11.4 Right to restriction of processing
  In accordance with Art. 18 GDPR, you have the right to request that we restrict the processing of your personal data. To make a request in this regard, please contact the contact point specified above.
  In particular, you have the right to restrict processing if the accuracy of the personal data is disputed between you and us; in this case, you have this right for the period of time required to verify the accuracy. The same applies if the successful exercise of a right to object is still disputed between you and us. You also have this right in particular if you have a right to erasure and you request restricted processing instead of erasure.
- 11.5 Right to data portability
  In accordance with Art. 20 GDPR, you have the right to receive from us the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the requirements. To make a request in this regard, please contact the contact point specified above.
Right to appeal
If you are of the opinion that our app violates data protection regulations, you have the right to contact a data protection supervisory authority in accordance with Art. 77 GDPR. You can assert this right, for example, with a supervisory authority in the member state of your habitual residence, place of work or place of the alleged infringement.
The contact details of the competent supervisory authority at our location are as follows:
The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden / Germany
Phone: 0611-1408 0
E-Mail:poststelle(at)datenschutz.hessen.de
Requirement for the provision of data
For the use of all functions of our app, you must register for an account, which at least contains your first name, your surname, your email address and your password. Without these data, you cannot register an account in our app. Alternatively, you can optionally choose Google or Apple as login provider, as described in this privacy policy.
For better suggestions and recommendations, you can provide your GPS location after accepting the respective permission request of your device. Without this information, the usage of our app is less innovative and advantageous.
Further information, such as a profile photo, favourites and plans, are voluntary and not necessarily needed for the use of our app.
Automated decision-making
Automated decision-making including profiling in accordance with Art. 22 GDPR which produces legal effects or similarly significantly affects you does not take place.
Update of the privacy policy
The ongoing technical development in the area of IT technology/security and the internet also requires an adaptation of the existing data protection declaration. We therefore reserve the right to make additions or changes to this privacy policy without prior notice.

News from Jourma

On February 17, 2025

Upcoming Jourma Features Transform Travel Experiences in Türkiye

On February 17, 2025

The conscious decisions that shape our identity