Privacy notice

The controller is Hechenbichler Christoph, KTW Straße 39, 6322 Kirchbichl, Austria; email kinovo@kinovo.at; telephone +43 664 75477100, operating as a sole trader under the Kinovo brand. If the business later changes to a limited company or another legal form, the company name, registration details, representation, invoicing and legal notice details and data protection roles must be updated promptly and consistently across the website, app, back office, terms, privacy information and invoicing documents.

Kinovo processes personal data to provide accounts, manage roles and permissions, represent club memberships, display content and messages, support club organisation, provide optional challenge and premium functions, offer support, implement security mechanisms and develop the platform technically.

Later development may add health-related modules, scientific evaluations, AI-assisted plausibility checks, partner connections, statistics or sponsorship services. Such extensions may only enter production once their legal basis, role model, security arrangements and user information have been established.

Depending on the current functionality, data may include first and last names, display names, dates of birth, club memberships and roles, as well as email addresses, telephone numbers and optional postal addresses.

Communication and content data may include messages, comments, uploaded images, short videos and evidence of challenge completion. Technical usage data may include logs, timestamps, device information, sessions, login data and security records.

Later modules may add activity, progress or evaluation data, or health data if introduced separately. The data actually processed depends on the implemented functionality, the user’s role and activated modules.

Processing supports account creation and administration; assignment to clubs, teams, groups and roles; communication between parents, clubs, coaches and other authorised people; content and organisational tools; and running and documenting challenges.

It also supports digital rewards, abuse prevention, IT security, support requests and the platform’s technical and organisational development. Processing for marketing, research, analytics or health purposes takes place only where a separate legal basis exists.

For core platform operation, Article 6(1)(b) GDPR is primarily relevant where processing is necessary for steps before entering into a contract or performing the user agreement. Article 6(1)(c) may apply to legal obligations.

Article 6(1)(f) may apply to security, abuse prevention and organisational interests where the balancing of interests favours the operator and the individuals’ interests do not override those interests.

Article 6(1)(a) may apply to optional processing that is not necessary. For future health data or other special categories, explicit consent under Article 9(2)(a) will generally be relevant.

Protecting minors is especially important because Kinovo is aimed at children, parents and clubs. Processing children’s profiles, birth dates, images, videos or challenge evidence must be embedded technically and organisationally in a parent or club model.

The platform should not assume that a child’s self-declaration is sufficient legal assurance. Instead, age-related logic, parent links, role approval, documented consent and a traceable approval process are to be implemented.

Where information society services are offered directly to minors and processing relies on consent, national age thresholds and specific rules must be observed. Irrespective of those thresholds, the source notice recommends a strict parent model with verified adult assignment for evidence and risk-management reasons.

Hosting is currently provided by Hetzner Online GmbH on servers in the European Union. Data processing agreements under Article 28 GDPR must be concluded with technical providers where legally required.

Recipients may include hosting and IT providers, support and maintenance providers, payment providers, app store operators and cooperation partners where a user actively uses a particular third-party service. Selling personal data is not planned.

Alongside portal hosting in Germany, Kinovo uses external services for individual functions: Resend for email; Expo, Apple APNs and Google FCM for push notifications; Cloudflare R2 for files; and Anthropic for enabled AI features. Depending on the service and configuration, personal data may be processed outside the EU. EU hosting of the portal therefore does not mean that all processing takes place exclusively within the EU.

The recipients, processing locations and contractual safeguards applicable to a particular use must be documented for each service. This overview is not a blanket confirmation that processing agreements have been concluded or transfer arrangements verified. Clubs may request the current supporting documentation at kinovo@kinovo.at.

Personal data is generally stored only as long as required for its purpose. Account data is normally retained for the duration of the user relationship.

Following termination, deletion, blocking or restriction must take account of statutory retention duties, legitimate evidentiary interests and security requirements. Separate retention periods for logs, support data, communications, challenge evidence, payment documents and consent records are to be defined in a documented deletion policy.

Kinovo takes appropriate technical and organisational measures against loss, unauthorised access, manipulation and other security risks. These include roles and permissions, secure authentication, transport encryption, security logging, backups, recovery arrangements, update management and restrictive back-office permissions.

Particularly restrictive visibility, download and approval arrangements are recommended for children’s data and images. Back-office users are to have role-based minimum access, logging and periodic permission reviews.

The current concept allows technical checks of uploads or challenge evidence for plausibility, repeated submissions, duplicates and manipulation. These systems are primarily intended to support internal review.

Solely automated decisions producing legal or similarly significant effects must not be used without legally required safeguards. Purpose, logic, data basis, error tolerances and human review arrangements must be documented before use.

If scientific evaluation is introduced, personal-data analyses should preferably be anonymous or at least strongly pseudonymised. Future health modules or studies require a separate privacy and study design covering legal basis, participant information, consent, purpose limitation, retention and responsibilities.

The combination of children’s data, possible health information, image and video uploads and planned AI checks indicates that a data protection impact assessment should be prepared in practice before sensitive modules are introduced and updated regularly.

Whether cookies, SDKs, pixels, analytics or marketing tools are used depends on the actual technical implementation. Non-essential tracking and analytics must observe the applicable consent and information requirements.

Website consent management and any app-specific consent flows must be checked before launch. Contractually necessary processing and voluntary marketing or analytics consent must remain strictly separate.

Information supplied when contacting Kinovo is processed to answer the enquiry, clarify questions, provide support and document the case. Depending on the context, the legal basis is Article 6(1)(b), (c) or (f) GDPR.

The notice may be updated when legal requirements, features, providers, data categories or purposes change. Users must be informed transparently where required. New voluntary or high-risk processing may require renewed active consent.

Under Article 15 GDPR, individuals may obtain information on whether and which personal data is processed, for which purposes, recipients, retention, sources, international transfers and relevant decision-making logic.

Article 16 provides for correction and completion. Subject to Article 17, deletion may be requested; statutory retention, legitimate evidentiary interests or overriding legal grounds may prevent immediate deletion. Article 18 permits restriction in certain circumstances. Subject to Article 20, supplied data may be requested in a structured, commonly used, machine-readable format. Where processing relies on Article 6(1)(f), individuals may object for reasons relating to their particular situation.

Voluntary consent may be withdrawn at any time for the future. Withdrawal does not affect the lawfulness of processing before withdrawal.

Individuals may complain to a supervisory authority. The source notice identifies Austria’s Datenschutzbehörde; the relevant German state authorities or Federal Commissioner for Data Protection and Freedom of Information; Italy’s Garante per la protezione dei dati personali; and Switzerland’s Federal Data Protection and Information Commissioner.

Send privacy requests to kinovo@kinovo.at. We respond within statutory time limits and verify identity before disclosing personal data.