‍

Privacy Policy for the Website "Ally"

Version: 03.03.2026
Scope: Website "Ally" (ally.aumio.com)

‍

‍

1. Controller

Aumio GmbH
Mühlenstraße 8a
14167 Berlin
Germany

‍

2. Data Protection Officer

‍

External Data Protection Officer (DPO): Graham Reilly (Workstreet)
E-Mail: graham.reilly@workstreet.com

Internal Data Protection Coordinator: Steffen Scherf (Aumio GmbH)
E-Mail: datenschutz@aumio.de

‍

3. General Information on Data Processing

‍

We process personal data to provide and optimize the website "Ally". Processing is based on the following legal bases, depending on the function:

• Art. 6(1)(f) GDPR (legitimate interest; e.g. operation, security, stability)
• Art. 6(1)(a) GDPR (consent; e.g. analytics/tracking/communication)
• Art. 6(1)(b) GDPR (contract/pre-contractual measures; e.g. signing up for information/updates)

‍

4. Consent

We use a consent management tool (Cookiebot) to obtain and document consent for the use of non-essential cookies and services (e.g. analytics/tracking/communication services).

Services (analytics/tracking/third-party) are only started after consent has been given.

Consent can be withdrawn at any time with effect for the future (via the cookie settings on the website).

‍

5. Target Audience / Age Restriction

The website "Ally" is aimed at adults. Content and offers are targeted at persons aged 18 and over.

‍

6. What Data We Process

6.1 Access Data / Server Logs (Hosting)

‍

Each time the website is accessed, the following data is technically processed:

• IP address
• Date and time of the request
• Accessed content / URL
• Referrer URL
• Browser type/version, operating system
• Other technical log data (e.g. request ID)

Purposes: Operation of the website, security, error analysis, abuse prevention.

Legal basis: Art. 6(1)(f) GDPR.

‍

6.2 Consent Data (Cookiebot)

To store your cookie/consent settings, consent data is processed (e.g. status/preferences).

Purposes: Collection, documentation, management of consent.

Legal basis: Art. 6(1)(c) GDPR and/or Art. 6(1)(f) GDPR; for non-essential cookies additionally § 25(1) TTDSG.

‍

6.3 Usage and Analytics Data (Website Analytics)

‍

Depending on integration, we process events and usage data to evaluate website usage, e.g.:

• Page views / sessions
• Interactions (clicks, scrolls)
• Technical information (device, browser, language)
• Approximate location information (derived from IP)

Purposes: Product/website improvement, stability, bug fixing, usage evaluation.

Legal basis: Art. 6(1)(a) GDPR (consent), where tracking/analytics is used.

‍

6.4 Waitlist / Newsletter / Communication (CleverTap)

The waitlist and possible email sign-ups (e.g. newsletter/updates) are currently managed via CleverTap. We use CleverTap as a communication and engagement tool.

Depending on the specific flow, the following data may be processed:

• Contact and identification data (e.g. email address; name if applicable)
• Communication and interaction data (e.g. sign-up time, delivery/open/click events, opt-in/opt-out)
• Technical data/online IDs (e.g. device and browser information, cookie/SDK IDs), where required for assignment and delivery

Purposes: Waitlist management, sending information/updates, user communication, engagement.

Legal basis: 

• For newsletter/marketing communication: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TTDSG
• For purely transactional/offer-related communication: Art. 6(1)(b) GDPR

‍

7. Services Used (Hosting / Analytics / Communication)

7.1 Hosting (Webflow)

Hosting/website delivery is provided by Webflow.

Purposes: Delivery of the website, operation, security, stability.

Legal basis: Art. 6(1)(f) GDPR.

‍

7.2 Analytics / Tracking / Communication (only after consent)

The following services are currently integrated and only started after consent:

• Google Analytics
• Mixpanel
• CleverTap (communication/engagement; potentially also web tracking for segmentation)

Purposes: Reach measurement, usage analysis, optimization of website and content; communication/engagement.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TTDSG.

Note: Google Ads/Conversion tracking is not used on the website.

‍

7.3 Waitlist / Newsletter / Communication (CleverTap)

CleverTap may be used for managing waitlists and email communication (e.g. updates/newsletter).

Purposes: Communication, waitlist management, segmentation, delivery of information.

‍

8. Recipients / Data Processors

We use service providers as data processors. Relevant recipients (website):

• Webflow (hosting)
• Cookiebot (consent management)
• Google Analytics (website analytics)
• Mixpanel (website analytics)
• CleverTap (communication/engagement; waitlist/newsletter)

‍

9. Third Country Transfers

For transfers to third countries, appropriate safeguards pursuant to Art. 46 GDPR are used, in particular EU Standard Contractual Clauses (SCC).

Where providers are certified under the EU-US Data Privacy Framework, the transfer is based on this framework.

‍

10. Storage & Retention Periods

• Access data/server logs are only stored as long as required for operation, security and error analysis.
• Analytics/tracking data is stored according to the respective tool settings and retention policies.
• Communication/waitlist data (CleverTap) is stored as long as required for communication/management or until withdrawal of consent, unless legal retention obligations apply.

‍

11. CleverTap (Cookies "WZRK_*") – Consent & Technical Status

Cookies with the prefix WZRK_* have been identified in technical reviews (cookie reports). We attribute these cookies to CleverTap (communication/engagement and potentially segmentation/tracking).

‍

11.1 Purpose

• Communication and engagement (e.g. waitlist, updates/newsletter)
• Potentially segmentation and measurement of communication effectiveness

‍

11.2 Category in Cookiebot

CleverTap is classified as a marketing service in our consent management.

‍

11.3 Legal basis

Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TTDSG.

‍

11.4 Provider, Third Country Transfer / Retention

Provider: WizRocket Inc. (Delaware, USA), doing business as "CleverTap".

Third country transfer: When using CleverTap, processing/transfer to the USA may occur. We use appropriate safeguards pursuant to Art. 46 GDPR (in particular EU Standard Contractual Clauses).

Retention: We store CleverTap data as long as needed for the stated purposes, but for a maximum of 10 years. Data is then deleted or anonymized (unless legal retention obligations apply).

‍

12. Rights of Data Subjects

Data subjects have – where applicable – the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR) with effect for the future
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Requests can be directed to datenschutz@aumio.de.

‍

12a. Automated Decisions

No automated decision-making with legal or similarly significant effect within the meaning of Art. 22 GDPR takes place.

‍

13. Changes

The current version is always available on the website.

‍