We, Screen Island GmbH, Falkenstrasse 8, 35576 Wetzlar, Germany (hereinafter “we/our”), take the protection of your personal data very seriously and strictly adhere to all applicable laws and regulations on data protection, in particular the General Data Protection Regulation (GDPR), the German Data Protection Act (Bundesdatenschutzgesetz - BDSG) and the German Telemedia Act (Telemediengesetz - TMG). The following explanations will give you an overview of how we ensure this protection and which data we process for which purpose.

1. Name and address of the Controller

The Controller within the meaning of Art. 4 No. 7 of the GDPR is:

Screen Island GmbH, Falkenstrasse 8, 35576 Wetzlar, Germany

Email: hello@sunnybox.io

2. Name and address of the data protection officer

The data protection officer of the person responsible is: Bijan Rahnema

3. Your rights as the data subject

You have the following rights towards us regarding your personal data:

• Right to information
• Right to correction or deletion
• Right to restrict processing
• Right to object to the processing
• Right to data transferability

Please send an email to hello@sunnybox.io in order to exercise one or more of the aforementioned rights. If you believe that the processing of personal data concerning you violates the GDPR, you have the right of appeal to a supervisory authority, without prejudice to any other remedies.

4. General information regarding the data processing

When using the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which are technically necessary for us to display our website to you and to provide stability and security (legal basis is Art. 6 para. 1 s. 1 lit. f GDPR):

• IP address
• date and time of the request
• time zone difference to Greenwich Mean Time (GMT)
• content of the request (specific page)
• access status/HTTP status code
• the amount of data transferred in each case
• website from which the request comes
• Browser
• operating system and its surface
• language and version of the browser software.

In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard disk in the browser you use. Through these cookies we receive certain information from you. Cookies cannot run programs or transmit viruses to your computer. They serve to make the website more user-friendly and effective overall.

We process and store your personal data only for the period necessary to achieve the storage purpose or insofar as required pursuant to applicable laws. If the storage purposes ceases to apply or if a storage period stipulated by applicable laws expires, the personal data is routinely blocked or deleted in accordance with the statutory provisions.

The criterion for the duration of the storage of your personal data is the respective legal retention period. After expiry of this period, the corresponding data will be routinely deleted, provided that they are no longer required for contract fulfilment or contract initiation or other legitimate interests.

Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.

5. Data Protection and Security Measures at Sunnybox

At Sunnybox, we prioritize the security and confidentiality of your data. We employ bcrypt encryption to secure all passwords and credentials. Our platform is designed to process data only as needed per API request, without storing content data, ensuring minimal data retention. All user data is hosted in Germany, in compliance with the strictest data protection laws, including the GDPR. We are committed to maintaining high security standards by implementing regular software updates for security patches. Users have full control over their data, with the ability to revoke access and request account deletion at any time. Internal data access is rigorously controlled and monitored to prevent unauthorized access and ensure data integrity.

6. Use of cookies

a. This website uses the following types of cookies, the scope and functioning of which are explained below:

• Transient cookies (see b),
• Persistent cookies (see c).

b. Transient cookies are automatically deleted when you close your browser. This includes in particular the session cookies. These store a so-called session ID, with which different requests of your browser can be assigned to the common session. This will allow your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close your browser.

c. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time in the security settings of your browser.

d. You can configure your browser settings according to your wishes and, for example, refuse the acceptance of third party cookies or all cookies. Please note that you may not be able to use all functions of this website.

e. We use cookies to identify you for follow-up visits if you have an account with us. Otherwise you will have to log in again for each visit.

f. The purpose of using technically required cookies is to simplify the use of our website for your benefit. Several functionalities of our website cannot be offered without the use of cookies. For these functionalities it is required to re-identify the browser. The use of analytical cookies serves the purpose of improving the quality of our website and its contents. These cookies show the use of the website, enabling us to optimize our offering.

g. The legal basis for the use of cookies is Art. 6 Par. 1 S. 1 lit. f GDPR. Our legitimate interest is covered in lit. g above.

7. Use of Google Analytics

This website uses Google Analytics, a web analysis service of Google Inc. “(“Google”). Google Analytics uses cookies to help the website analyze how users use the site. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, Google will reduce your IP address within Member States of the European Union or in other states party to the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with further services associated with website and Internet use.

The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data.

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

This website uses Google Analytics with the extension “_anonymizeIp()”. As a result, IP addresses are further processed in abbreviated form, so that an identification can be ruled out. As a result, insofar as the data collected about you enable an identification, such possibility will be excluded immediately.

We use Google Analytics to analyze and regularly improve the use of our website. We can improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the use of Google Analytics is Art. 6 Par. 1 S. 1 lit. f GDPR.

Third party information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

Terms of Use: https://www.google.com/analytics/terms/de.html, Privacy overview: https://www.google.com/intl/de/analytics/learn/privacy.html, and Privacy policy: https://www.google.de/intl/de/policies/privacy.

8. Use of our service “Sunnybox”

If you want to use our service “Sunnybox”, you have to sign up with your email-address, a password and your name. We use the so-called double opt-in procedure for sign up, i.e. your registration is not complete until you have previously confirmed your registration via a confirmation e-mail sent to you for this purpose by clicking on the link contained therein. If your confirmation is not received, your registration will be automatically deleted from our database.

Providing the above data is mandatory. Any further personal data you provide us with is voluntary and you consent into its processing in accordance with this privacy policy by providing it.

We process the personal data only for and in connection with the provision of Sunnybox.

We use your email address to provide you with information about updates of Sunnybox via our regular newsletter. You can revoke your consent to receive our newsletter at any time by using the respective link in the newsletter or sending an email to hello@sunnybox.io.

The legal basis for the processing of mandatory personal data in relation to the use of Sunnybox is Art. 6 para. 1 s. 1 lit. b GDPR; the legal basis for voluntary personal data is Art. 6 para. 1 s. 1 lit. a GDPR.

We use services and storage systems of external service providers for the provision of Sunnybox. These service providers have access to the personal data you upload to Sunnybox. The processing of your personal data by the respective service provider is based on an agreement on data protection and data security that complies with legal requirements.

These service providers are categorized as follows:

• Hosting service providers,
• Subscription management and invoicing tool providers,
• Payment processing tool providers,
• Authentification tool providers,
• Communication tool providers,
• Error analysis tool providers.

Last updated: 08.05.2024