PRIVACY POLICY

1. DATA PROTECTION AT A GLANCE

General notes: The following provides an overview of how your personal data is collected and processed when you visit our website. Personal data is any data with which you can be personally identified.

Data collection: Data is collected when you provide it to us (e.g., in a contact form or during checkout) or automatically through our IT systems (technical data like browser type, IP address).

---

2. GENERAL INFORMATION AND MANDATORY INFORMATION

Responsible Body:
NGM App GmbH
Marvin Krumpe, Darian Krumpe
Pettenkoferstrasse 12
83052 Bruckmühl
Germany
Email: support@ngmapp.com

Your Rights: You have the right to free information about your stored data, its origin, and recipients. You also have the right to request correction, deletion, restriction of processing, and data portability (Art. 15-20 GDPR). Where processing is based on our legitimate interests, you have the right to object to that processing (Art. 21 GDPR). You may also lodge a complaint with the competent supervisory authority.

Withdrawal of Consent: Many processing operations are only possible with your express consent. You can withdraw consent at any time with future effect via our Cookie Settings or by contacting us.

Storage Duration: Unless a more specific storage period is stated in this policy, your personal data remains with us until the purpose for processing no longer applies. If you assert a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in such cases, deletion takes place once these reasons cease to apply.

---

3. HOSTING AND SHOP SYSTEM (SHOPIFY)

We use the shop system Shopify, provided by Shopify International Limited (Ireland/Canada). Shopify processes your data (e.g., IP address, order details) to provide the shop functions and process your purchase. Data may be transferred to Shopify Inc. in Canada and the USA. This is done on the basis of Standard Contractual Clauses, the EU-US Data Privacy Framework, and a Data Processing Agreement (AVV) to ensure a level of data protection that complies with the GDPR. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment).

---

4. CONSENT MANAGEMENT (PANDECTES)

To manage cookies and technical tools that require consent, we use the Pandectes GDPR Compliance banner. This tool allows you to give or refuse consent for specific categories (e.g., Analytics, Marketing). A cookie is set to store your preferences. No personal data is shared with the provider of Pandectes except for the technical information required to save your choice. Tools that require consent (e.g. Analytics and advertising tools) are only loaded after you have given the corresponding consent via this banner.

---

5. DATA COLLECTION AND ANALYTICS

Server Log Files: Shopify automatically collects and stores information in server log files (Browser type, OS, IP address). Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Google Analytics: We use Google Analytics for user analysis, provided by Google Ireland Limited. This is only active if you give consent via the Pandectes banner. IP addresses are shortened (IP anonymization) before any further processing, so that a direct personal reference is excluded. Data may be transferred to Google LLC in the USA; such transfers are safeguarded by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the Cookie Settings.

Contacting us: If you contact us via email, we store your details to process the inquiry and for follow-up questions. Legal basis: Art. 6(1)(b) GDPR.

---

6. ADVERTISING AND MARKETING

The following tools are only activated after you give your consent for the "Marketing" category via the Pandectes banner. You can withdraw your consent at any time with future effect via the Cookie Settings.

Google Ads & Conversion Tracking: We use Google Ads, a service of Google Ireland Limited, to promote our offers through advertisements on external websites and to measure how successful these advertising measures are. Google Ads stores a cookie on your device that allows us to measure conversions (e.g. whether a visit led to a purchase) and to display interest-based advertising (remarketing). Data may be transferred to Google LLC in the USA, safeguarded by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: your consent (Art. 6(1)(a) GDPR).

Meta Pixel (Facebook & Instagram): We use the Meta Pixel, a service of Meta Platforms Ireland Limited, for conversion tracking and remarketing in connection with our advertising on Facebook and Instagram. The pixel enables Meta to recognize visitors to our website as a target audience for the display of ads ("Custom Audiences") and to measure the effectiveness of our ads. With regard to the data collection through the pixel, we and Meta are jointly responsible (Art. 26 GDPR). Data may be transferred to Meta Platforms, Inc. in the USA, safeguarded by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: your consent (Art. 6(1)(a) GDPR).

---

7. PAYMENT PROVIDERS

Payment Processing: Depending on the payment method selected (e.g., PayPal, Credit Card via Shopify Payments), transaction data is passed to the respective provider. This is strictly for the purpose of payment processing (Art. 6(1)(b) GDPR).

---

8. LICENSE ACTIVATION (VIN BINDING)

During the purchase or activation of our Application, we process the Vehicle Identification Number (VIN) of your car. This processing is mandatory to link the digital license to your specific vehicle and to fulfill our contractual obligations. Legal basis: Art. 6(1)(b) GDPR.

Last updated: June 2026