Privacy Policy – DropBeat

MLH Ventures GmbH
Stolberggasse 38/9, 1050 Vienna, Austria
FN 614753 z, ATU80019338

General contact: office@mlh-ventures.com
Data protection requests: privacy@mlh-ventures.com
Phone: +43 670 605 1854

A data protection officer is not legally required.

This Privacy Policy applies to the processing of personal data in connection with the use of the mobile app DropBeat for iOS and the associated online functions. An Android version is planned but not currently released.

A separate privacy policy applies to our website (mlh-ventures.com) and other products.

Note on planned future features: We plan to expand DropBeat with features such as paid premium modes, hint packages or a global leaderboard. As soon as such a feature is introduced, we will update this Privacy Policy before activation and inform you about the specific data processing pursuant to Section 16.

We use two separate categories of push messages:

Transactional pushes: Game events such as “it’s your move”, a new invitation, a game result. We send these on the basis of our contract with you (Art. 6(1)(b) GDPR). You can disable these pushes via your device’s system settings.

Marketing and update pushes: Information about new features, tips or product notices. We send these only if you have expressly consented (Art. 6(1)(a) GDPR in conjunction with §174 TKG 2021). Consent is given by actively enabling it in the app settings (“Receive marketing messages”). You can withdraw it at any time in the settings without this affecting the transactional notifications.

We send emails for the following purposes:

• Transactional: email verification, password reset, deletion and security confirmations, advance warning of imminent inactivity deletion. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
• Product updates and newsletter (future): Insofar as we offer such messages, they are sent exclusively after your express consent (Art. 6(1)(a) GDPR in conjunction with §174 TKG 2021). You can unsubscribe at any time via a link in each message.

DropBeat requests only the following permissions:

• Notifications / push — for sending game notifications and (if desired) product updates

We request no permissions for camera, location, microphone, contacts or photo library.

To provide our service we use the following providers. Contracts pursuant to Art. 28 GDPR exist with all processors. TelemetryDeck is excepted: as only anonymous data without any personal reference is processed there, no processor relationship within the meaning of Art. 28 GDPR exists in that respect (see Section 4.5).

We use no advertising or tracking services from other providers, create no personal usage profiles and set no cookies or comparable technologies for marketing purposes. TelemetryDeck product analytics work exclusively with anonymous data (see Section 4.5).

We store your data only as long as necessary for the stated purposes or as long as statutory retention obligations exist.

We implement technical and organizational measures to protect your data, in particular:

• TLS encryption of all data transfers between app and server
• encrypted storage of passwords using recognized hashing methods
• secure storage of login tokens on your device (iOS Keychain)
• multi-factor authentication for administrative access to our backend systems
• role-based access controls following the principle of least privilege
• logging of administrative access
• regular encrypted backups
• automated security updates of the platforms used
• separation between development, test and production environments
• regular review and updating of these measures in line with the state of the art

You have the following rights regarding your personal data:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR); can be carried out directly in the App via “Settings → Delete account”
• Restriction of processing (Art. 18 GDPR)
• Data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of granted consent with effect for the future (Art. 7(3) GDPR)

Please address requests to privacy@mlh-ventures.com. We generally respond within 30 days.

You have the right to lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna
dsb@dsb.gv.at, dsb.gv.at

You may also contact the supervisory authority of your habitual residence or place of work.