Privacy policy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States as well as other data protection provisions is:

GEOTRACE GmbH & Co. KG
Waldleite 21
97295 Waldbrunn, Germany
Phone: +49 (0) 93 06 / 53 42 388
E-mail: info@noa.life

Contact for data protection questions

For questions about data protection and to exercise your rights, you can reach us at datenschutz@noa.life or by post at the address given above, marked "Datenschutz" (data protection).

2. General information on data processing

2.1 Scope of the processing of personal data

As a matter of principle, we process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. The processing regularly takes place only with the user's consent or where permitted by law.

2.2 Legal bases

• Art. 6 (1) (a) GDPR — consent
• Art. 6 (1) (b) GDPR — contract performance / pre-contractual measures
• Art. 6 (1) (c) GDPR — legal obligation
• Art. 6 (1) (f) GDPR — legitimate interest

2.3 Data erasure and storage period

Personal data is erased or blocked as soon as the purpose of storage no longer applies. Storage beyond that may take place where provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject.

3. Hosting and server log files

The website is hosted by:

SISpro GmbH
Waldleite 21, 97295 Waldbrunn, Germany

A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider. The servers are located in a data centre in Germany. The legal basis for using the host is Art. 6 (1) (f) GDPR (legitimate interest in the secure and efficient provision of the website).

On every visit, the browser automatically transmits information to the server. This information is stored temporarily in a so-called log file:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file retrieved
• Volume of data transmitted
• Notification of whether the retrieval was successful
• Identification data of the browser and operating system used
• Referrer URL

Legal basis: Art. 6 (1) (f) GDPR. The data is stored to ensure the functionality of the website and to defend against attacks. Storage period: the server log files are deleted automatically after 7 days. Individual entries are stored longer only where this is necessary to investigate a specific security incident; in that case the affected log files are retained until the incident has been fully resolved.

4. Cookies

Our website uses cookies. Cookies are small text files that are stored in the browser or by the browser on the user's device.

4.1 Technically necessary cookies

These cookies are required for the website to function (e.g. shopping cart, login, language preference, locally stored account data). They also include short-lived session cookies that store a referral or partner promotion code you actively opened, for the duration of the current visit only; they are deleted automatically when you close your browser. Legal basis: Art. 6 (1) (f) GDPR and § 25 (2) TDDDG (German Telecommunications Digital Services Data Protection Act).

4.2 Managing cookies

This website and the NOA app use only technically necessary cookies. There is no user tracking, and no cookies are set for advertising, marketing or analytics purposes. Consent pursuant to § 25 (1) TDDDG is therefore not required, and no cookie consent banner is used. Most browsers also offer functions that let you view, manage and delete cookies at any time.

5. Contact forms & e-mail contact

You can contact us via the website by e-mail at info@noa.life. In this case, the user's personal data transmitted with the e-mail is stored.

The data is not passed on to third parties. The data is used exclusively to process the conversation.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual) or Art. 6 (1) (f) GDPR (legitimate interest in responding).

6. Account system & order processing

If you create a user account on noa.life or order a NOA device, we process the following data:

• Master data (name, e-mail, address and phone where applicable)
• Order data (product, quantity, price, order date)
• Payment and shipping data
• Stored trusted persons and device data, where applicable

Account and order data are processed and stored server-side in our database (orders, subscription/plan data, assigned devices and emergency contacts). Sign-in to the NOA app takes place via an encrypted access token.

Legal basis: Art. 6 (1) (b) GDPR (contract performance). Storage period: until termination of the contract plus statutory retention periods (in particular § 257 HGB (German Commercial Code), § 147 AO (German Fiscal Code)).

6.1 Device, location and emergency data (NOA service)

To provide its protective function, the NOA service processes the following data of the person equipped with a NOA device:

• Location data (GPS/position data of the device) for location display and – on the NOA Mini only – for safe zones (geofence) and for inactivity monitoring (no-movement),
• Alarm and event data (triggered alarms – via the SOS button and, on the NOA Mini, also through a detected fall event, a safe zone or prolonged immobility –, time, position, notification history),
• Emergency contacts (name, phone, e-mail of the stored trusted persons),
• Details for the 24/7 emergency call service (NOA Mini only), where the customer stores them for a device (note to the emergency call centre, key storage details including photo).

In the event of an alarm, the recipients are the emergency contacts stored by the customer – via SMS or e-mail and, on the NOA Mini, also via a call from the device (call chain) and, with the voice announcement add-on booked, via an automated call with an announcement – as well as the customer (NOA app, push notification). Section 7.4 explains how these notifications are delivered. If the 24/7 emergency call service is switched on for a NOA Mini, the 24/7 emergency call centre is an additional recipient: it receives every alarm from this device immediately, together with the location and the notes stored for this device.

Consent of the person wearing the device: The customer ensures that the person equipped with a NOA device has consented to the processing of their location data or that a corresponding authorisation exists.

Legal basis: Art. 6 (1) (a) GDPR (consent) and Art. 6 (1) (b) GDPR (contract performance); for any health/vital-sign data additionally Art. 9 (2) (a) GDPR; furthermore, to protect vital interests in the event of an alarm, Art. 6 (1) (d) GDPR. Storage period: location, alarm and notification data remain stored for as long as the customer account exists, even if a device is removed from the NOA app. If you delete your customer account, we delete this data in our database. We currently do not delete it after a fixed period while the contract is running; your right to erasure under Art. 17 GDPR (section 8) remains unaffected. The positions and alarm rules stored by the GEOTRACE gateway (section 7.4) are currently not deleted automatically when the customer account is deleted; you can request their erasure at any time at datenschutz@noa.life.

24/7 emergency call centre (emergency call service). The emergency call service is only available for the NOA Mini; the customer switches it on and off per device in the NOA app. While it is switched on, we transmit to the emergency call centre, for every alarm from this device, the alarm type, time, location and the status of the notification of the emergency contacts immediately. So that the emergency call centre can also handle a call from the device when no alarm has reached it, it can additionally view the following details for this device – even without an alarm: name and, where stored, photo of the person wearing the device; device identifier, phone number and card number (ICCID) of the SIM card; name and phone number of the customer; the emergency contacts; the note to the emergency call centre and the key storage details including photo. The purpose is to enable the emergency call centre to help immediately and in a targeted manner when the device calls it. If the emergency call service is switched off, the emergency call centre receives no new alarms from this device.

If the emergency call centre takes on a call-out, it documents it: time of taking on and of completion, handling person, content of the conversation and measures taken. Entries are not changed; corrections are appended as a new entry. Legal basis: Art. 6 (1) (b) GDPR (contract performance), to protect vital interests Art. 6 (1) (d) GDPR and, where health data is concerned, Art. 9 (2) (a) or (c) GDPR; for the call-out documentation additionally Art. 6 (1) (f) GDPR (legitimate interest in evidencing the course of the call-out). Storage period: the call-out documentation is stored until the customer account is deleted and is deleted together with it. The details of a call-out required for billing (order number, time, device, customer name, included or charged) are additionally retained separately from the customer account until the statutory retention periods expire (Art. 6 (1) (c) GDPR in conjunction with § 257 HGB (German Commercial Code), § 147 AO (German Fiscal Code)).

6.2 Minors

If a minor – for example a child – wears a NOA device, the persons with parental responsibility decide on setting up the device and on the consents this requires. Section 6.1 applies to the minor's data.

Safety notice: If children wear NOA on a lanyard, there is a risk of strangulation – in that case, use a lanyard with a breakaway safety clasp. The persons with parental responsibility must carry out the set-up and give consent.

6.3 Use by employers

If an employer uses NOA for employees, the employer is the controller; we process the data on the employer's behalf (Art. 28 GDPR). Employees should therefore first contact their employer with questions about the processing of their data; they can also reach us at datenschutz@noa.life.

Note: For lone working at the workplace, NOA is not a substitute for a personal emergency signalling system in accordance with the requirements of the German Social Accident Insurance (DGUV).

7. Embedded services & tools

7.1 Fonts (self-hosted)

All fonts used on the website and in the NOA app — the "Manrope" typeface and the "Material Symbols" icon font (each under the SIL Open Font License) — are stored on our own server and loaded exclusively from there. No connection to Google or other third parties is established for this purpose when the website is accessed; your IP address is not transmitted to third parties in this respect (data minimisation, Art. 5 (1) (c) GDPR).

7.2 Maps and map links

The location map in the NOA service uses the Leaflet map software (self-hosted) and obtains map tiles via our own server proxy. In the process, no user IP or location is transmitted to an external map provider (data minimisation, Art. 5 (1) (c) GDPR).

If you tap the displayed location of a device in the NOA app, the website openstreetmap.org of the OpenStreetMap Foundation (United Kingdom) opens with the coordinates in the address. Your browser transmits your IP address and the coordinates to the OpenStreetMap Foundation. An adequacy decision of the EU Commission exists for the United Kingdom.

Alarm SMS and alarm e-mails to the emergency contacts contain a link with the location of the device. In the messages sent by the gateway (section 7.4), this link leads to Google Maps: anyone who opens it transmits the coordinates and their IP address to Google (Google Ireland Limited; transfer to Google LLC, USA, on the basis of the EU-US Data Privacy Framework). If our server sends an alarm e-mail itself, the link leads to openstreetmap.org.

7.3 Payment processing

For payment processing we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Card payments – also via Apple Pay or Google Pay where the payment window offers this – and SEPA direct debits are processed via Stripe. Only the data required for the respective payment is transmitted (e.g. name, e-mail address, invoice amount, payment/account details).

Stripe processes this data as an independent controller on the basis of its own privacy policy, including for fraud prevention. In the process, data may be transferred to Stripe, Inc. in the USA; the basis for this is the EU Commission's adequacy decision on the EU-US Data Privacy Framework. If you use Apple Pay or Google Pay, the privacy policies of Apple or Google also apply. Legal basis: Art. 6 (1) (b) GDPR (contract performance) and Art. 6 (1) (f) GDPR (secure and smooth payment processing).

7.4 Notifications in the event of an alarm

In the event of an alarm, the NOA Mini calls the phone numbers in its call chain via its own SIM card. In addition, the NOA service notifies the emergency contacts and you. We use the following services for this:

• GEOTRACE gateway: it receives the messages from the devices and stores, for each device, the alarm rules with the names, phone numbers and e-mail addresses of the assigned emergency contacts as well as the positions reported by the device. In the event of an alarm, it sends SMS and e-mails to these contacts, each with the map link described in section 7.2. The SMS are delivered by a telecommunications service provider.
• Voice announcement (add-on, NOA Mini only): if the add-on is booked for a NOA Mini, the gateway calls the emergency contacts selected for it via the telephony service of sipgate GmbH (Düsseldorf) in the event of an alarm and plays an automated announcement. The announcement states the name stored for the device and the type of alarm, for example a possible fall; it is made in the language of your customer account. For this purpose, the phone numbers of the selected contacts and the announcement text are transmitted.
• E-mail dispatch: our server sends order, account and alarm e-mails as well as the e-mails relating to the newsletter and the registration of interest via an e-mail dispatch service.
• Push notifications to you: if you have allowed push notifications in the NOA app, you receive a notification with the type of alarm and the name stored for the device in the event of an alarm. In the browser, it is delivered by the push service of your browser provider (e.g. Google, Mozilla or Apple), in the installed app for Android or iOS by Google Firebase Cloud Messaging (Google Ireland Limited), on iPhone and iPad additionally by Apple's Apple Push Notification service. In the process, data may be transferred to Google LLC or Apple Inc. in the USA; the basis for this is the EU Commission's adequacy decision on the EU-US Data Privacy Framework.
• where the 24/7 emergency call service is switched on for a NOA Mini, the transmission of every alarm from this device, together with the location and stored notes, to the connected 24/7 emergency call centre (details in section 6.1).

Only the data required for the respective notification is transmitted. Legal basis: Art. 6 (1) (b) GDPR (contract performance), Art. 6 (1) (a) GDPR (consent), vis-à-vis the emergency contacts Art. 6 (1) (f) GDPR (legitimate interest in getting help in an emergency) and, to protect vital interests, Art. 6 (1) (d) GDPR.

7.5 Shipping

To deliver the devices, we pass the required shipping data (name, delivery address and, for shipment notification, e-mail/phone where applicable) on to the commissioned shipping company — usually DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn). Legal basis: Art. 6 (1) (b) GDPR.

7.6 Newsletter

With the newsletter, we inform you about news on NOA and give safety tips. The newsletter and the registration of interest (section 7.7) are separate: signing up for the newsletter does not register your interest for the start of sales, and registering your interest does not sign you up for the newsletter.

We store your e-mail address, the language, where you signed up (e.g. website footer or customer account) and the times of sign-up, confirmation and, where applicable, unsubscription; for each mailing, we record which address it was sent to and when. If you sign up via the form on the website, we use the double opt-in procedure: you only receive the newsletter after you have clicked the link in our confirmation e-mail. If you switch on the newsletter in your customer account, we activate it for your account's e-mail address without a confirmation e-mail. We do not evaluate whether you open the newsletter or click on links in it. The newsletter is sent via our e-mail dispatch service (section 7.4).

When you sign up, confirm and unsubscribe, we also store the time, IP address, browser identifier and your e-mail address in our security log. This serves to prevent misuse, such as mass sign-ups of other people's addresses, and to evidence your consent (Art. 6 (1) (f) GDPR and Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR).

The legal basis for sending the newsletter is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future: via the unsubscribe link in every newsletter e-mail, in your customer account or by e-mail to datenschutz@noa.life.

Storage period: we store your details for as long as you receive the newsletter. After you unsubscribe, your e-mail address remains stored with a note of the unsubscription so that we no longer send you the newsletter and can evidence the unsubscription; at your request, we will delete it completely. If you do not confirm a sign-up, you will not receive a newsletter. When your customer account is deleted, we also delete a newsletter subscription with the same e-mail address.

7.7 Registration of interest for the start of sales

NOA is not yet available. On our website you can register your interest without obligation: we will notify you once by e-mail as soon as the device you have selected – NOA Mini, NOA Watch or both – can be ordered, once per device if you choose both. Registering your interest is without obligation: no order, no reservation, no priority, no costs. It is not a newsletter (section 7.6): apart from the confirmation e-mail and the notification, you will not receive any e-mails through it.

We store your e-mail address, the selected device, the language, the page on which you registered, the version of the consent text and the times of registration, confirmation and notification. We do not store a name or your IP address with the registration.

We use the double opt-in procedure: after you register, we send you an e-mail with a confirmation link. Your interest is only registered once you have confirmed. We delete unconfirmed registrations after 7 days.

To prevent misuse, we store the time, IP address and browser identifier in our security log for each registration – without your e-mail address and without any link to your registration. This allows us to limit the number of registrations (Art. 6 (1) (f) GDPR).

Legal basis: your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future: via the link in every e-mail relating to your registration, which deletes your registration immediately, or by e-mail to datenschutz@noa.life.

Storage period: as soon as we have notified you for all the devices you selected, we delete your registration including the proof of consent. When your customer account is deleted, we also delete a registration with the same e-mail address. The e-mails are sent via our e-mail dispatch service (section 7.4).

7.8 Referral programme

Customers can recommend NOA with their personal referral link. Emergency contacts also find their own referral link on their personal contact page. The terms of participation apply; they also set out the amount of the reward (€50 for customers, €20 for emergency contacts) and when it becomes due. The invited person receives no reward.

If you access the website via such a link, we store the referral code in a session cookie for the duration of your visit (section 4). If the invited person registers with the code, we store who referred them, the status of the reward (open, due, paid out) and the details required for the payout, such as the bank details of the referring person.

Legal basis: Art. 6 (1) (b) GDPR (participation in the referral programme). The details of a referral remain stored for as long as the customer accounts involved exist; if one of them is deleted, we delete the details or remove the link to that account.

We send customers information about the referral programme by e-mail on the basis of our legitimate interest in recommendations (Art. 6 (1) (f) GDPR, § 7 (3) UWG (German Act against Unfair Competition)). You can object to this at any time, for example by replying to such an e-mail or by writing to datenschutz@noa.life; this only incurs transmission costs at the basic rates.

8. Rights of data subjects

You have the following rights vis-à-vis us regarding the personal data concerning you:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7 (3) GDPR) with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Competent for the controller's registered seat (Bavaria):

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach
www.lda.bayern.de

9. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements, or to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.