Privacy policy Loveworkz

Last updated: 29 October 2026

This document is divided into three parts:

I. Overview - A brief summary of the most important points

II Detailed information - user-friendly organization by topic

III Legal precision (original text) - Complete and legally correct

I. Overview

One session per week is enough for us - and the same goes for data protection: we only collect what we need.
Your data belongs to you: You have the right to information, deletion and objection at any time.
GDPR-compliant: Our processes comply with EU regulations.
App & website thought of separately - regulated together: The website and the app are described separately below. What you share in the app is only processed to improve your experience.
No reselling, no spamming: We don't pass anything on without your consent.
Your location stays with you - unless you share it: we only use GPS data if you explicitly want us to.
Cookies? Only the necessary ones - the rest only with your OK.

II Detailed information

1. responsible body

Responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is

Thomas Busch
E-Mail: info@loveworkz.app
Website: www.loveworkz.app

2. definitions of terms

The terms correspond to the definitions in Art. 4 GDPR (e.g. "personal data", "processing", "controller").

3. data processing when using the website

When you visit our website, your browser automatically transmits data (e.g. IP address, date and time, browser used, referrer URL). This data is required to ensure secure operation. It is processed by Google as our hosting provider (Firebase Hosting); we do not keep our own server logs.

4. data processing when using the app

We process the following data when you use our app:

Device information (model, operating system, app version)
Usage behavior (session duration, functions used)
E-mail address (for registration)

Processing takes place via Google Firebase for authentication, error analysis and hosting. The data protection guidelines of Firebase apply. Data is transferred on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and the standard contractual clauses in accordance with Art. 46 GDPR.

5. cookies

Our website uses two categories of cookies: a necessary cookie (cookieConsentPreferences, 365 days) that stores your choice in the cookie banner, and – only with your consent – analytics cookies of Google Analytics 4 for reach measurement (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG). Analytics is switched off by default. You can change or withdraw your consent at any time via "Cookie settings" in the footer.

6. third-party providers & tracking tools

We use the following services:

Firebase Hosting (Google Ireland Ltd.): hosting of the website
Google Cloud Firestore: delivery of website content
Google Analytics 4: reach measurement – only with your consent
Firebase (Google): app – authentication, crash analysis; website – hosting, content database, analytics (with consent)

Data is transferred on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and the EU Commission's standard contractual clauses.

7. communication via messenger services

If you communicate with us via platforms such as WhatsApp, Instagram, Facebook, TikTok or Telegram, the respective privacy policies of the providers apply. We only store the information required for the respective communication purpose there.

8. your rights

You have the right to at any time:

Information (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR)
Revocation of consents granted (Art. 7 para. 3 GDPR)

9. storage period

Personal data will be deleted as soon as the purpose of storage no longer applies, there is no longer a legal obligation to retain it or you revoke your consent.

Examples:

Server log data: no own server logs (processed by Google as hosting provider)
Consent cookie: 365 days
Website analytics data: 14 months

10. transfer to third parties & third countries

We do not pass on data to third parties, except:

there is a legal obligation to do so (Art. 6 para. 1 lit. c GDPR)
You have given your explicit consent (Art. 6 para. 1 lit. a GDPR)
it is necessary for the performance of the contract (Art. 6 para. 1 lit. b GDPR)

For transfers outside the EEA, we ensure that an adequacy decision (e.g. the EU-U.S. Data Privacy Framework, Art. 45 GDPR) or suitable guarantees in accordance with Art. 46 GDPR (e.g. standard contractual clauses) are in place.

III Legal precision

→ This section contains the complete, legally precise version from the original sources of the app and website privacy policies. It is inserted separately.

A. Data protection for the Loveworkz app

A. Introduction

Thommy B. AGC (hereinafter jointly referred to as "the company", "we" or "us") takes the protection of your personal data seriously and would like to inform you about data protection in the company. With the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: "GDPR"), additional obligations have been imposed on us to ensure the protection of personal data of the person affected by processing (we also refer to you as the data subject hereinafter as "user", "you", "you", "customer" or "data subject").

Insofar as we decide either alone or jointly with others on the purpose and means of data processing, this includes above all the obligation to inform you about the type, scope, purpose, duration and legal basis of the processing, see Art. 13 & Art. 14 GDPR. With this privacy policy, we inform you about how your personal data is processed by us.

B. Fundamentals

1. definitions

In accordance with Art. 4 GDPR, this privacy policy is based on the following definitions:

- "Personal data" according to Art. 4 No. 1 GDPR means any information relating to an identified or identifiable natural person ("data subject"). A person is identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or information relating to their physical, physiological, genetic, mental, economic, cultural or social identity. The identifiability can also be provided by linking such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photos, video or audio recordings can also contain personal data).

- "Controller" according to Art. 4 No. 7 GDPR is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

- "Processing" according to Art. 4 No. 2 GDPR means any operation which is performed on personal data, whether or not by automated means. This includes, in particular, the collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment or combination, restriction, erasure or destruction of personal data, or alteration of the purposes for which they were originally processed.

- "Processor" according to Art. 4 No. 8 GDPR is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller's instructions. In terms of data protection law, a processor is not a third party.

- "Consent" according to Art. 4 No. 11 GDPR of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

- "Third party" according to Art. 4 No. 10 GDPR is any natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data; this also includes other legal entities belonging to the group.

2. amendment of the privacy policy

As part of the further development of data protection law and technological or organizational changes, our data protection information is regularly reviewed to determine whether it needs to be adapted or supplemented. You will be informed of any changes.

3. no obligation to provide personal data

The conclusion of a contract is not made dependent on the provision of personal data. In principle, you are under no legal or contractual obligation to provide us with your personal data. However, it is possible that certain services can only be provided to a limited extent or not at all if you do not provide the necessary data. If this is the case, you will be informed of this separately.

C. Information about the processing of your data

1. the collection of personal data concerning you

(1) Personal data about you is collected when you use our app.

(2) Personal data is all data that relates to you personally. This includes your name, your location data, your IP address, the device ID, the SIM card number, your address and e-mail address, images, but also your user behavior.

2. legal bases of data processing

(1) Processing of personal data is legal if the data processing falls under one of the following justifications:

- Art. 6 para. 1 sentence 1 lit. a GDPR ("consent"): Where the data subject has voluntarily, in an informed and unambiguous manner, indicated by a statement or other unambiguous affirmative act that he or she consents to the processing of personal data relating to him or her for one or more specific purposes;

- Art. 6 para. 1 sentence 1 lit. b GDPR: If the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

- Art. 6 para. 1 sentence 1 lit. c GDPR: If processing is necessary for compliance with a legal obligation to which the controller is subject

- Art. 6 para. 1 sentence 1 lit. d GDPR: If processing is necessary in order to protect the vital interests of the data subject or another natural person;

- Art. 6 para. 1 sentence 1 lit. e GDPR: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or

- Art. 6 para. 1 sentence 1 lit. f GDPR ("Legitimate interests"): If the processing is necessary for the purposes of the legitimate (in particular legal or economic) interests pursued by the controller or by a third party, except where such interests are overridden by the interests or rights of the data subject (in particular where the data subject is a minor).

(2) Processing may also be based on several legal bases. Any applicable legal basis is expressly stated below.

3. data collected during the download

(1) When you download this app, the necessary personal data will be transmitted to the relevant app store. In particular, the e-mail address, the user name, the customer number of the downloading account, the individual device identification number, payment information and the time of the download are transmitted to the App Store.

(2) We have no influence on the collection and processing of this data; it is carried out exclusively by the store. Responsibility for the processing and collection of your data lies solely with the app store you have selected. Any responsibility on our part is excluded.

4. data collected during use

(1) In order to be able to provide all the benefits of our app, it is necessary to collect the personal data determined by us and required for the operation of the app when you use it. We only collect this data if this is necessary for the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR). Furthermore, we collect data if this is necessary for the functionality of the app and your interest in the protection of your personal data does not outweigh this (Art. 6 para. 1 lit. f GDPR).

(2) We collect and process the following data from you:

- Data that you make available to us: To use the app, you need to create a user account. To do this, enter at least your login name.

- Device information: The access data includes the IP address, device ID, device type, device-specific settings and app settings as well as app properties, the date and time of the retrieval, time zone the amount of data transferred and the message as to whether the data exchange was complete, app crash, browser type and operating system. This access data is processed to enable the technical operation of the app.

- Information with your consent: We process other information, including GPS location data, if you allow us to do so.

- Contact form data: When contact forms are used, the data transmitted through them is processed, including gender, name, address, company, e-mail address and the time of transmission.

5. cookies

(1) We use cookies when operating our app. Cookies are small text files that are stored on the device memory of your mobile device and assigned to the mobile app you are using and through which certain information flows to the location that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They are used to make an app more user-friendly and effective.

(2) Cookies contain data that enable the device used to be recognized. In some cases, cookies only contain information on settings that are not personally identifiable. Cookies cannot directly identify a user.

(3) A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored beyond the individual session. In terms of their function, a distinction is made between cookies:

- Technical cookies: These are absolutely necessary to move within the app, use basic functions and ensure the security of the app; they do not collect information about you for marketing purposes, nor do they store which websites you have visited;

- Performance cookies: These collect information about how you use our app, which pages you visit and, for example, whether errors occur when using the app; they do not collect any information that could identify you - all information collected is anonymous and is only used to improve our app and find out what interests our users;

- Advertising cookies, targeting cookies: These are used to offer the app user needs-based advertising within the app or offers from third parties and to measure the effectiveness of these offers; advertising and targeting cookies are stored for a maximum of 13 months;

- Sharing cookies: These are used to improve the interactivity of our app with other services (e.g. social networks); sharing cookies are stored for a maximum of 13 months.

(4) Any use of cookies that is not absolutely technically necessary constitutes data processing that is only permitted with your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. This applies in particular to the use of advertising, targeting or sharing cookies. In addition, we will only pass on your personal data processed by cookies to third parties if you have given your express consent to this in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

6. duration of data storage

(1) We delete your personal data as soon as it is no longer required for the purposes for which we collected or used it. We store your personal data for the duration of the usage or contractual relationship via the app. Your data will only be stored on our servers in Germany, subject to any disclosure.

(2) In the event of a pending legal dispute with you or other legal proceedings, the data may be stored beyond the specified period.

(3) Third parties engaged by us will store your data on their system for as long as is necessary for us in connection with the provision of the service in accordance with the respective order.

(4) Legal requirements for the storage and deletion of personal data remain unaffected by the above (e.g. § 257 HGB or § 147 AO). If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this.

7. data security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties, taking into account the state of the art, the implementation costs and the nature, scope, context and purpose of the processing as well as the existing risks of a data breach (including its probability and impact) for the data subject. Our security measures are continuously improved in line with technological developments.

//8. Automated decision making

There is no intention to use the personal data collected from you for an automated decision-making process (including profiling).

9. change of purpose

(1) Your personal data will only be processed for purposes other than those described if this is permitted by law or if you have consented to the changed purpose of the data processing.

(2) In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of the purposes prior to further processing and provide you with all other relevant information.

D. Responsibility for your data and contacts

1. person responsible and contact details

(1) We are the controller responsible for the processing of your personal data within the meaning of Art. 4 No. 7 GDPR

Thomas Busch - Thommy B. AGC
Cottastrasse 35, 70180 Stuttgart, Germany
Phone: 015253900587
E-Mail:

Thomas Busch - Thommy B. AGC
Cottastrasse 35, 70180 Stuttgart, Germany
Phone: 015253900587
E-mail: info@loveworkz.io (2) Please contact this contact point if you wish to assert your rights against us or if you have any questions or comments regarding the collection and processing of your personal data.

2. data collection when contact is made

If you contact us, we will store your e-mail address, your name and all other personal data that you have provided in the course of contacting us so that we can contact you to answer your question. This data will be deleted as soon as it is no longer required. If there are statutory retention periods, the data will remain stored, but processing will be restricted.

F. Data processing by third parties

1. order data processing

(1) If contracted service providers are used for individual functions of our app, they will only act in accordance with our instructions. In accordance with Art. 28 GDPR, they are contractually obliged to comply with data protection regulations.

(2) The following categories of recipients, which are usually processors, may have access to your personal data:

- service providers for the operation of our app and the processing of the data stored or transmitted by the systems. The legal basis for the transfer is then Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR, insofar as these are not processors;

- State authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the transfer is Art. 6 para. 1 sentence 1 lit. c GDPR;

- Persons employed to carry out our business operations. The legal basis for the transfer is Art. 6 para. 1 sentence 1 lit. b or lit. f GDPR.

(3) We will only pass on your personal data to third parties if you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

(4) If we pass on your personal data to our subsidiaries, this is done on the basis of existing order processing relationships.

2. requirements for the transfer of personal data to third countries

(1) As part of our business relationships, your personal data may be passed on or disclosed to third-party companies. These may also be located outside the European Economic Area (EEA). Such processing takes place exclusively to fulfill contractual and business obligations and to maintain your business relationship. We will inform you about the respective details of the transfer at the relevant points below.

(2) The European Commission certifies that some third countries have a level of data protection comparable to the EEA standard by means of so-called adequacy decisions. However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible through binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data, certificates or recognized codes of conduct. Please contact our data protection officer if you would like more information on this.

3. legal obligation to transmit data

In individual cases, we are subject to a legal obligation to provide lawfully collected personal data to third parties, in particular to public authorities, pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR).

G. Your rights

1. right to information

You have the right under Art. 15 GDPR to obtain information about the personal data concerning you. This requires a request from you, which must be sent either by e-mail or by post to the addresses given above.

2. objection to data processing and withdrawal of consent

(1) In accordance with Art. 21 GDPR, you have the right to object at any time to the processing of personal data concerning you. We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing serves the establishment, exercise or defense of legal claims.

(2) In accordance with Art. 7 (3) GDPR, you have the right to withdraw your consent once given - i.e. your voluntary, informed and unequivocal consent to the processing of the personal data concerned for one or more specific purposes by means of a declaration or other unambiguous confirmatory act - at any time. The consequence of this is that we may no longer continue the data processing that was based on this consent.

(3) For notification, please contact the above-mentioned contact point.

3. right to rectification and erasure

(1) Insofar as personal data concerning you is incorrect, you have the right under Art. 16 GDPR to demand that we correct it immediately. Under the conditions specified in Art. 17 GDPR, you also have the right to request the erasure of personal data concerning you. In particular, you have the right to erasure if the data in question is no longer necessary for the purposes of collection or processing, if the data storage period has expired, if there is an objection or if the processing is unlawful. If you wish to make a request in this regard, please contact the contact point indicated above.

(2) To assert these rights, please contact the contact point specified above.

4. right to restriction of processing

(1) In accordance with Art. 18 GDPR, you have the right to demand that we restrict the processing of your personal data.

(2) If you wish to make a request in this regard, please contact the contact point indicated above.

(3) You have the right to restriction of processing in particular if the accuracy of the personal data is disputed between you and us; in this case, you have this right for the period of time required to verify the accuracy. The same applies if the successful exercise of a right to object is still disputed between you and us. You also have this right in particular if you have a right to erasure and you request restricted processing instead of erasure.

5. right to data portability

(1) In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format.

(2) If you wish to make a request in this regard, please contact the contact point indicated above.

6. right to lodge a complaint with the supervisory authority

(1) In accordance with Art. 77 GDPR, you have the right to complain to the competent supervisory authority about the collection and processing of your personal data.

(2) You can contact any supervisory authority, in particular the one in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

We use Google Firebase for user authentication, to provide backend services and, if necessary, for crash analysis (Crashlytics). Data processing is carried out on the basis of the standard contractual clauses of the EU Commission in accordance with Art. 46 GDPR.

We also communicate with users via third-party platforms such as WhatsApp, Instagram, Facebook, TikTok and, where applicable, Telegram. Please note that communication via these services is subject to the respective privacy policies of the providers.

B. Data protection for the website (loveworkz.app)

This section applies to the website loveworkz.app. Data processing in the Loveworkz app is described in section A.

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4 No. 7 GDPR is:
Thomas Busch – Thommy B. AGC
Cottastraße 35, 70180 Stuttgart, Germany
E-mail: info@loveworkz.app

2. Hosting

(1) Our website is hosted by Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR.

(2) When you visit the website, your browser automatically transmits technical data, which Google processes in order to deliver and secure the website: IP address, date and time of the request, requested URL, referrer URL, browser type and version, and operating system. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the secure and reliable provision of the website.

(3) We do not keep our own server log files. Log data is processed by Google as our hosting provider.

(4) Fonts, images and videos are delivered from our own hosting (self-hosted). Google Fonts or other external font services are not used.

3. Content database (Google Cloud Firestore)

(1) Your browser loads public page texts, blog posts and expert profiles from Google Cloud Firestore (firestore.googleapis.com), a database service of Google Ireland Limited (address above). In the process, your IP address and technical browser data (e.g. browser type, language, time of the request) are transmitted to Google. No other personal data is processed in this context.

(2) Loading this content is necessary to display the website and therefore takes place without consent. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the technically functional provision of the content) and, insofar as information on your device is accessed, § 25 para. 2 no. 2 TDDDG.

4. Cookies and consent

(1) On your first visit, we ask for your consent via a cookie banner. We distinguish between two categories:

- Necessary: The cookie “cookieConsentPreferences” stores your choice in the cookie banner for 365 days. It is strictly necessary in order to respect your decision. The legal basis is § 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR.

- Analytics: Google Analytics 4 (see section 5). This category is switched off by default and is only activated after you have given your consent. The legal basis is § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.

(2) You can change or withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of the website. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

5. Google Analytics 4

(1) If you have consented to “Analytics”, we use Google Analytics 4, a web analytics service of Google Ireland Limited (address above), which is integrated via the Firebase SDK. Without your consent, Google Analytics is not loaded.

(2) The following data is processed in particular: pages viewed, device and browser information (e.g. device type, operating system, browser, screen resolution, language), your shortened IP address, and clicks on the App Store and Google Play buttons, including the campaign parameters (UTM parameters) contained in them.

(3) Google Analytics sets the cookies “_ga” and “_ga_*”, which are stored for up to 24 months. The analytics data is retained for 14 months and then deleted automatically.

(4) The purpose is to measure the reach of our website and to improve it. The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, which you can withdraw at any time (see section 4).

6. Transfer to third countries

In connection with the services mentioned above (Firebase Hosting, Cloud Firestore, Google Analytics 4), personal data may also be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is therefore based on the adequacy decision of the European Commission (Art. 45 GDPR). In addition, Google has agreed to the European Commission’s Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

7. Links to app stores and Instagram

Our website contains plain links to the Apple App Store, Google Play and our Instagram profile. These are not embedded plug-ins; no data is transmitted to these providers when you load our pages. Only when you click on a link are you forwarded to the respective provider, which then receives data such as your IP address and, for the store links, the campaign parameters contained in the link. Apple, Google and Meta are responsible for any further processing; their respective privacy policies apply.

8. Your rights

Your rights as a data subject, including the right to lodge a complaint with a supervisory authority, are described in section A (G. Your rights) and apply equally to the website.