Privacy Policy

xLog Boating · Version 0.3 · Last updated 24 September 2026

1. Who is responsible

xLogical Apps GmbH
Kopernikusstraße 15
63500 Seligenstadt
Germany
Email: geschaeftsfuehrung@xlogical.de

This policy explains what personal data we process when you use xLog Boating, why we do it, on what legal basis, who receives it and how long we keep it.

Which document governs what. This policy informs you about how we handle your data; it is not part of your contract. Your contract with us is governed by the Terms of Service (subscription, payment, cancellation, liability) and the EULA with its Annex (licence to the software and the nautical chart data). We use two terms as defined in section 2 of the EULA: the "Application" is the xLog Boating software on your Device (the mobile apps for iOS and Android and the web application in your browser), and the "Service" is the Application together with everything we provide through it, such as chart data, your account, synchronisation and position sharing.

Language versions. This policy exists in a German and an English version. Where we address you in German, the German version applies; otherwise this version.

The short version. Your recorded trips and tracks, your planned routes and logbook entries, the documents and photos in your on-board library, your boat details and tasks (together: your content) are stored in our cloud infrastructure in the European Union, so that they are available on all your devices and survive the loss of a device. A live position you share is shown to the recipients only for as long as section 3.3 describes; the positions of a recorded trip are part of that trip and are kept with it (section 2). We are technically able to read this content. Section 3 explains what that means: how the content is protected, who may access it and in which cases, and what we deliberately do not store. We do not analyse your content, we do not build profiles from it, and we do not use it for advertising.

2. Overview

Do you have to provide personal data? You are never legally required to provide personal data to us. To create an account and use the Service you must provide an email address and the name of the account holder. Without them we cannot perform the contract; section 4 explains what we need the name for and on which legal basis.

The location permission is needed for trip recording, live position sharing, the position display in live navigation, and the mooring watch and anchor alarm; if you do not grant it, those features will not work, and the rest of the Application remains available.

3. Your content and location data

xLog Boating is a navigation application and processes position data. Two things need to be separated: what happens on your device, and what reaches us.

What stays on your device. Live navigation (your current position, speed and course on the chart) runs locally on your Device. This live navigation position is not transmitted to us and is not stored unless a trip recording is active. Accessing your Device's location for this display is strictly necessary for the navigation function you started (§ 25(2) no. 2 TDDDG). In the mobile apps the chart display runs locally as well. In the web application the chart is delivered from our map server as you use it: your Device requests the map sections it needs, so the server receives your IP address and the section requested, and if the map follows your position, that section approximates where you are. Every request for chart data, in the web application and in the mobile apps, also carries a device key tied to your account; with it we check that a licence exists for the chart data requested and how many devices use it. The map server keeps no access log of these requests, and the device key is written to no log; only error entries can record an IP address together with the section concerned, and they are deleted or anonymised after 14 days (in backup copies for up to 30 days, section 3.4).

What reaches us. When you record a trip, plan a route, write a logbook entry, add a document or photo to the on-board library, store boat details or tasks, or share your live position, that content is stored in our cloud infrastructure in readable form (section 3.5). In addition, we process the technical information described in the "Operating the Service" row of section 2, which we need in order to store and deliver your content at all.

3.1 Trip recording (logbook)

When you start a trip recording, the Application records your position, together with time, speed and course. Position data is collected in the background only while a recording is active; this is necessary so that the recording continues while the screen is locked or you are using another app. The recording is stored in your account.

What the Application derives from a recording. For each trip the Application automatically stores, alongside the recorded track: a simplified preview of the track (up to 100 points, accurate to roughly one metre) together with the rectangle enclosing it, the names of the start and destination places (determined on your Device from offline data), an automatically generated title such as "Place A → Place B", distance, speed and time values, and, if you were following a planned route, the name of that route. The simplified preview shows your course in the same way as the track itself.

GPX import and export. You can import tracks and routes from GPX files created by other applications; imported content is stored in your account like recorded content, together with the name of the imported file. Reading the GPX file you select is strictly necessary for the import you started (§ 25(2) no. 2 TDDDG). You can also export a trip as a GPX file and pass it to an application or recipient you choose; the export is created on your Device, and we do not learn who receives it.

Legal basis: performance of the contract, Art. 6(1)(b) GDPR.

Mooring watch and anchor alarm. While a trip is moored (and, when you use the anchor alarm, while it is active), the Application keeps checking your position in the background so that it can notify you when your vessel moves. This monitoring runs on your Device: the position is compared locally against the stored mooring or anchor position, nothing is recorded, and the watch itself transmits no position to us; if you share your position, the shared page keeps receiving it while you are moored (section 3.3). The mooring watch is switched on by default and runs without a time limit; you can switch it off at any time in the Application. It is a convenience feature of trip recording: it belongs to the trip that you yourself started and moored, and notifies you without your having to switch it on each time. While monitoring runs, a visible notification is shown: on Android as a foreground service, on iOS with the system's location indicator.

Legal basis: performance of the contract, Art. 6(1)(b) GDPR; the position comparison itself takes place only on your Device. Access to your Device's location is strictly necessary for the trip function you started, of which the mooring watch and the anchor alarm are part (§ 25(2) no. 2 TDDDG).

Before we ask for the location permission, we explain what the permission is used for and obtain your affirmative acknowledgement.

3.2 Synchronisation and backup

Your trips are stored in our cloud infrastructure so that they are available on your other devices and are not lost if you lose a device. Your position data therefore leaves your device. Synchronisation is a core part of the Service and cannot be switched off.

Legal basis: performance of the contract, Art. 6(1)(b) GDPR. Without storage in our cloud we cannot provide the synchronisation and backup described above; the web application in particular keeps no copy of its own.

3.3 Sharing your live position

You can share the position of an active trip with other people. The Application generates a link, which you send yourself using the sharing function of your device: by message, email or any other channel you choose.

• Legal basis: your consent for the respective trip, Art. 6(1)(a) GDPR. Accessing your Device's location for this function is strictly necessary for the sharing you started (§ 25(2) no. 2 TDDDG); passing the position, the track, your name and the trip details on to the recipients rests on your consent. You can withdraw it at any time by ending the sharing, also during the 24 hours after the trip ends; withdrawal does not affect the lawfulness of processing carried out before it.
• The shared position and the track pass through our servers, and section 3.5 applies to them. Sharing ends when the trip ends (a trip continues while you are moored until you end it). When the trip ends, the page stops updating and shows the last position and the track, with the name and trip details you have not hidden, for 24 hours, marked as ended. You can end the sharing at any time; if you do, if you delete your account or we close it, or if we disable the link in one of the cases set out in section 10 of the Terms of Service, the page is taken down at once.
• Everyone who receives the link can see your position and the track of the trip, including anyone the link is forwarded to. The shared page also shows them the name of the account holder and the details of the trip (such as its name, start and destination), so that they can tell whose position they are seeing and where the trip is heading; you can hide your name and the destination when you start sharing, and if you hide your home port, the start place and the automatic title are not shown either. Please consider carefully who you share it with and which channel you use.
• Saved recipients (mobile apps). You can save recipients (name and mobile number) in your account; they are synchronised between your Devices and stored until you remove them or delete your account. Whenever you create a new sharing link, the Application prepares a text message with the link and opens the messaging app of your Device with those recipients filled in; you decide whether to send it, and the message is sent by your Device, not by us. We do not learn whether you sent it or passed the link on in another way, and we store no other contact data of recipients. Towards you, this processing is performance of the contract (Art. 6(1)(b) GDPR).
• When a recipient opens the shared page, their IP address is processed in our server logs for the purpose of delivering the page and for security (our legitimate interest, Art. 6(1)(f) GDPR). Log data is deleted or anonymised after 14 days (in backup copies for up to 30 days, section 3.4). Before the recipient's browser loads the position data, it obtains a token from Google's reCAPTCHA Enterprise as described in section 8; this protects the shared position against automated retrieval (your legitimate interest and ours, Art. 6(1)(f) GDPR; § 25(2) no. 2 TDDDG for the page the recipient has requested), and the technical characteristics of the recipient's browser and their IP address reach Google as well. The page links to this Privacy Policy, also after the sharing has ended.

If a user has saved you as a recipient, we hold only your name and mobile number, obtained from that user, to prepare the messages the user asks for (legitimate interest of the user and ours, Art. 6(1)(f) GDPR), for as long as the user keeps you saved or, where we close the user's account, for 90 days after the closure (section 3.4), and, after removal, for up to 30 days in our backup copies; we use them for nothing else. You can object at any time at geschaeftsfuehrung@xlogical.de (section 12).

Please note that this function is not an emergency service. See section 6 of the EULA.

3.4 Deleting your data

You can delete individual trips at any time. When you delete your account, all of your data is removed from our servers, except the data that section 11 says we keep. Deleted data can remain in our backup copies for up to 30 days; we use them only to restore the Service after a failure, and if we restore a backup, we delete the previously deleted data again (section 11). On the device you are using, the Application deletes the locally stored data as part of the account deletion. On other devices on which you are signed in, the local offline copy remains until you sign out there (signing out deletes this copy) or remove the Application. Device backups that you create with your operating system's backup feature can contain your content. You create them with your own provider and you control them; they are covered neither by our deletion nor by our access controls (section 3.5), and they are not transfers by us (section 10).

If you have not used your account for twelve months (no sign-in and no use of the Service with the account) and no subscription was active during that time, we notify you by email at least 30 days in advance and, if you do not use your account before the date we state, delete the account and the data stored in it. This applies to free accounts in the same way as to accounts whose subscription has ended.

When your subscription ends and your account continues on the free plan, content above the free plan's limits remains readable and exportable for 90 days and is then deleted: the 50 most recent logbook entries and the most recent documents up to 100 MB remain. We notify you by email before this deletion; a new subscription within the 90 days prevents it (section 9 of the EULA). The same applies to content above the new limits where the limits of the free plan are lowered (section 13 of the Terms of Service).

Closed accounts. Where we close your account (section 13 of the Terms of Service), you can no longer sign in. We keep your content and account data for 90 days after the closure so that we can provide your content to you on request (section 9 of the EULA), and delete them earlier if you ask us to; section 11 applies to the data we keep beyond that.

3.5 How your content is protected, and who can access it

Your content is transmitted to us over encrypted connections and stored in our cloud infrastructure in the European Union, where it is encrypted at rest. The keys for this storage encryption are managed by our infrastructure provider (section 9); this protects the stored data against outsiders, and it does not prevent us from reading your content through the Service. We are therefore technically able to access your trips, tracks, routes and logbook entries, and the other content you store, such as documents, photos, boat details and tasks.

On each device you use, the Application also keeps a local offline copy of your content so that it is available on board without a connection (sections 3.2 and 8). Your own device backups are outside our control (section 3.4).

We access your content only where there is a specific reason to, in particular:

• at your request, to help you with a support issue or to restore your data;
• to investigate a concrete technical fault, where the fault cannot be analysed without looking at the affected data;
• where we are legally obliged to, for example by an enforceable order of a court or an authority; we review every such request and disclose no more than the law requires (section 12 applies);
• to keep the Service secure, to enforce our terms or to establish, exercise or defend legal claims, as far as necessary in the individual case (section 2).

We do not browse your content, we do not evaluate it, we do not build movement profiles from it, and we do not use it for advertising or pass it on for such purposes.

This describes how things stand today. Section 9 of the EULA and section 10 of the Terms of Service reserve two things for the future: aggregated, anonymous analyses drawn from the content of all users, and an automatic check of uploaded files for malware. Before we start either, we describe it here.

3.6 Routes and logbook entries

Your planned routes and your logbook entries are synchronised to our cloud infrastructure like your trips, and section 3.5 applies to them in the same way. A logbook entry contains what you write in it; it can contain position details and free text. For a logbook entry that is not linked to a trip, the Application does not store where the entry was created: no creation location is attached to such an entry. An entry that belongs to a trip contains that trip's data, including its start and destination places and the recorded track (section 3.1). A planned route describes where you intend to go. Please keep this in mind when you decide what you write in your logbook.

Data about other people. A logbook entry, a note or a document can contain information about other people, for example the names of crew or guests. You decide what you record; the Terms of Service require you to include other people's data only where you are entitled to do so, and sensitive information such as health data only with their consent, except for records required by law and the documentation of accidents, emergencies or damage. Where entries contain personal data of people other than you, we store it as part of your logbook on the basis of our legitimate interest in providing the Service to you (Art. 6(1)(f) GDPR); the persons concerned have the rights described in section 12. Corrections and deletions cover an entry in all its stored forms, including its formatted version. This notice also serves to inform those persons under Art. 14 GDPR; we cannot notify them individually because we do not know who they are (Art. 14(5)(b) GDPR).

Legal basis: performance of the contract, Art. 6(1)(b) GDPR; for personal data of other people contained in your entries, legitimate interest, Art. 6(1)(f) GDPR. Retention: until you delete the route or entry, or your account, subject to section 3.4.

3.7 On-board library, boat details and tasks

The on-board library stores documents and photos you add (from the file picker, your photo library or the camera), for example manuals or insurance papers. Files are stored as you provide them, including the original file name and any metadata embedded in the file, such as the place and time a photo was taken. The Application asks for access to your camera or photo library only when you add a photo or document, and uses that access for nothing else. Reading the file you select is strictly necessary for the upload you started (§ 25(2) no. 2 TDDDG).

For your boat you can store master data (name, dimensions, MMSI, call sign and ATIS code) together with freely named detail fields, notes, tasks with due dates, expenses, tags and entry templates. All of this content synchronises to our cloud infrastructure like your trips; section 3.5 applies to it in the same way, and section 3.6 applies where it contains data about other people.

On the free plan the on-board library is limited to 100 MB and the logbook to 50 entries; a Premium subscription raises these limits to 10 GB and unlimited entries. Section 3.4 describes what happens to content above these limits when a subscription ends.

Legal basis: performance of the contract, Art. 6(1)(b) GDPR. Retention: until you delete the item or your account, subject to section 3.4.

4. Account and licence data

We process your account data to provide the Service and to enforce the licence terms.

Name of the account holder. We store the name of the person holding the account. We use it to identify you as our contracting party and to address you in the Application, in emails and in support (performance of the contract, Art. 6(1)(b) GDPR). It is shown on the page of a shared live position only on the basis of your consent for that trip (section 3.3), and, once you obtain nautical charts, it is part of the billing records for our licensor IC-ENC on the basis of our legitimate interest described in section 9.

Device list and session count. The licence permits use by one person on up to five devices, and simultaneous use by more than one person is not permitted. To enforce this, we keep a list of the devices registered to your account and count active sessions.

Sign-in with Apple or Google. You can create your account with Sign in with Apple or Google. We then store no password but the link to your provider account; the provider transmits your email address to us when you first sign in, and your name, with Apple only if you choose to share it. With Apple you can use Hide My Email; we then store the relay address Apple assigns. With Google, the sign-in also transmits the link to your Google profile picture and whether your email address is verified; Firebase Authentication stores both by default. Beyond that, we receive no data from your Apple or Google account. When you delete your account, we also revoke the link between your account and your sign-in provider.

Records of your declarations. When you register and before you subscribe, we record which confirmations you gave: the description of the Service under section 5 of the EULA, the consent of your legal guardians if you are a minor, and, before a subscription, your declarations on early supply under section 8 of the Terms of Service. The record holds your account ID, the time, the version of the text shown to you and the state of the field you ticked. We keep it to prove what was agreed (Art. 6(1)(c) GDPR in conjunction with § 312f(3) BGB for your declarations on early supply, otherwise Art. 6(1)(f) GDPR, legitimate interest: proving what was agreed); retention: section 11.

Legal basis for the rest of this section: performance of the contract, Art. 6(1)(b) GDPR. We process only what is needed for this purpose.

5. Payment data

In all three sales channels a third party is the merchant of record:

We do not receive your payment card details. From Apple and Google we receive transaction and subscription metadata only (which product was purchased, when, and whether the subscription is active) through the respective channel and through RevenueCat (section 9); neither store shares your name, email address or billing address with us. In the web channel the sale runs through our Stripe account: there we can see the purchase data Stripe holds about you (your name, email address, billing address and invoices), but never your full payment card details.

Deletion at Stripe. If you ask Stripe to delete your data, Stripe deletes it from the affected objects, including objects in our Stripe account, and cancels subscriptions sold through Managed Payments; section 7 of the Terms of Service says what that means for your contract. We keep our own record of licences and deliveries independently of Stripe, in pseudonymous form (except the IC-ENC billing records, which contain the name of the account holder, section 11), in order to meet our contractual reporting and record-keeping obligations (section 9).

6. Usage, diagnostics and crash data

We do not analyse how you use the Application. There is no product analytics, no usage profiling, and no advertising or attribution SDK in xLog Boating. We do not analyse which features you use or how often you open the Application.

Crash reports. When the Application stops unexpectedly, it can send us a crash report through Firebase Crashlytics, a Google service. A report describes the state of the program at the moment of the crash: the type of error and where it occurred in the program code, the model and operating system of your Device, the version of the Application, the time, and an identifier that Crashlytics assigns to your installation. It does not contain your position data.

• Crash reporting is switched on by default, because a crash in a navigation application can be relevant to your safety and we need to find and fix its cause quickly. You can switch it off at any time in the settings; we then send no further reports.
• Legal basis: our legitimate interest in finding and fixing faults, Art. 6(1)(f) GDPR, and § 25(2) no. 2 TDDDG for the identifier stored on your Device. Switching crash reporting off is your objection under Art. 21 GDPR; it takes effect at once.
• Retention: 90 days.
• Crashlytics processes this data on Google's global infrastructure, which offers no choice of data region (see sections 9 and 10).

Push notifications. If you allow notifications, we send you service messages, for example that your subscription is about to expire or renew, or that there is a safety-relevant problem with the Service. Delivery uses Firebase Cloud Messaging, a Google service, which requires a notification token to be stored on your Device and registered with us; on iOS devices the notification is delivered through Apple's push service (section 9).

• Legal basis: performance of the contract, Art. 6(1)(b) GDPR, and § 25(2) no. 2 TDDDG for the token, which is needed to deliver the notifications you have switched on.
• You can withdraw the notification permission at any time in your device settings.

7. Email communication

We distinguish two kinds of email:

Transactional email: purchase confirmations, expiry and renewal notices, notices before a deletion (section 3.4), security and service notifications. We send them to the email address of your account and address you by the name of the account holder. Legal basis: performance of the contract, Art. 6(1)(b) GDPR. You cannot unsubscribe from these emails for as long as your account exists.

Marketing email: product news and offers, addressed to you by name. Legal basis: your consent, Art. 6(1)(a) GDPR, obtained by double opt-in. You can withdraw it at any time using the unsubscribe link in every marketing email. We keep the record of your consent (the double opt-in confirmation and its timestamp) to be able to demonstrate that consent was given, as Art. 7(1) GDPR requires. Once you withdraw your consent it can no longer carry that record; we then keep it for up to three years on the basis of Art. 6(1)(f) GDPR: our legitimate interest in being able to defend claims within the regular limitation period of § 195 BGB. The withdrawal itself takes effect at once and stops any further marketing email.

Both are sent using ActiveCampaign (section 9), which therefore receives your email address and your name.

8. Cookies, device storage and similar technologies

We use no tracking cookies, and you will not see a cookie banner, because we do not need one. Everything we store on your device is needed to deliver the service you asked for, and that does not require consent (§ 25(2) no. 2 TDDDG).

This also applies to the device registration described in sections 3 and 4. The hydrographic offices allow us to make their nautical chart data available to you only for one person and a limited number of devices, and the one-person, five-device limit applies to the free plan as well (section 3 of the EULA). Without registering your device we would therefore not be permitted to deliver the charts to you. It is part of your sign-in, and we use it for nothing else.

Protection against misuse (App Check). Our licence agreements oblige us to make the nautical chart data available only through our genuine Application and only to legitimate users. To check this, the Application obtains a short-lived token from Google's Firebase App Check before it requests chart data or your content. Google issues the token once your Device or browser has been verified: in the iOS app by Apple (App Attest), in the Android app by Google Play (Play Integrity), and in the web application by Google's reCAPTCHA Enterprise. reCAPTCHA Enterprise scores from browser and interaction signals whether a request comes from a person using a browser rather than from an automated program. The page of a shared live position obtains such a token in the same way. For this, a key or an identifier is stored on your Device or in your browser for as long as the Application is installed or until you clear your browser data. If a check fails, the Application shows you a message and repeats the check on the next attempt; if it keeps failing, our support looks into it with you (section 12). Storing and reading the identifier is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG); the processing rests on our legitimate interest in the security of the Service and the protection of the chart data (Art. 6(1)(f) GDPR).

In the mobile apps (iOS and Android) we store on your device:

• your login token and the device registration used to enforce the licence (section 4);
• the chart data you have downloaded;
• an offline copy of your content, so the Application also works without an internet connection (section 3.2);
• your settings;
• caches that speed up loading, such as map tiles and recently used application data;
• a technical diagnostic log for resolving faults, which contains no position data and none of your content and whose entries are overwritten after seven days at the latest;
• the Firebase installation ID that the Application uses for feature control (Remote Config, section 9). It carries no profile of you and controls only which functions are switched on, which is why it is necessary for the service you asked for (§ 25(2) no. 2 TDDDG).

How long this data stays on your device is set out in section 11; device backups that you create yourself are covered in section 3.4.

If you send us the diagnostic log with a support request, it reaches us by email; we then delete it when the request is closed, at the latest after 90 days (section 2).

In the web application we store your login session in your browser, and your settings only once you change them.

On the website we store your language and display settings, and, while you are paying, what the payment provider needs to complete and secure the transaction. The payment provider sets its own cookies for fraud prevention during checkout; it acts as merchant of record and as its own controller for that, and its own privacy notice applies (section 5).

Crash reporting stores an identifier on your Device as well; it is on by default, and you can switch it off at any time (section 6).

9. Recipients and processors

Where it is necessary for security, enforcement or legal claims (section 2), we disclose the data concerned to our legal advisers, to courts and, in individual cases, to the competent authorities.

RevenueCat processes device type, operating system, transaction metadata and the app user ID. The app user ID is the identifier from Firebase Authentication, a unique, non-speaking identifier. It is pseudonymous, not anonymous: the link between the identifier and your person exists in Firebase Authentication, which we control. No position data is sent to RevenueCat.

Reporting to our licensors. Our licence agreements with the hydrographic offices provide for reporting and audit rights; under the audit rights, a licensor's auditors, advisers or other persons it appoints may inspect our records. The legal basis is our legitimate interest in meeting these contractual reporting and audit obligations, Art. 6(1)(f) GDPR; without them we could not licence the chart data at all. We generate the reports from our own reporting system. For the BSH and PRIMAR/NHS they contain quantities, products, chart cells and periods and no data relating to individual users. For the UKHO they additionally contain a pseudonymous end user ID, which its licence agreement requires; they contain no names. For billing with IC-ENC the report also contains the name of the account holder.

Reports about breaches. Where the agreement with the licensor concerned requires it, we also report to that licensor:

• when we establish a breach of the EULA that concerns the chart data, the licence to it or the intellectual property of the licensor and its data providers (sections 3, 4, 7, 8 and 11 of the EULA);
• when we find that someone else has used your account or the chart data without authority;
• when you complain about the chart data itself or raise a claim in connection with it.

Such a report contains a pseudonymous identifier, the nature of the matter and the period concerned, not your name. The licensor may also decide with us how to proceed.

IC-ENC and UKHO are located in the United Kingdom, PRIMAR/NHS in Norway and the BSH in Germany; section 10 gives the basis for transfers outside the European Union.

10. International transfers

Our core infrastructure is located in the European Union. Section 9 says which recipient processes which data and where. Where data leaves the European Union, these are the bases:

• RevenueCat (USA): the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

• ActiveCampaign (USA): the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).

• Apple (Apple Push Notification service and App Attest, USA): the EU-US Data Privacy Framework (Art. 45 GDPR).

• Google (Firebase Authentication, Crashlytics, Cloud Messaging, Remote Config, App Check with Play Integrity and reCAPTCHA Enterprise, and access to stored data): the same three-way rule applies to every Google company and sub-processor involved. Transfers to Google LLC and the other Google companies in the United States that are certified under the EU-US Data Privacy Framework rest on that certification (adequacy decision, Art. 45 GDPR). Transfers to recipients in a country for which the European Commission has adopted an adequacy decision (for example the United Kingdom, Switzerland, Japan, Israel or Canada) rest on that decision (Art. 45 GDPR). All other transfers — sub-processors in the United States that are not certified, and Google companies and sub-processors elsewhere — rest on the standard contractual clauses included in Google's data processing terms for the Google service concerned (Art. 46(2)(c) GDPR).

• Reports to our licensors (section 9): reports transmitted to IC-ENC and UKHO in the United Kingdom, and the records that they or the auditors, advisers or other persons they appoint in the United Kingdom inspect or copy under our licence agreements, are covered by the European Commission's adequacy decisions for the United Kingdom (Art. 45 GDPR); reports to PRIMAR/NHS in Norway remain within the EEA. Where a licensor appoints such a person outside the European Economic Area and the United Kingdom, we make records accessible to that person only where an adequacy decision covers that person (in the United States, its listing under the EU-US Data Privacy Framework) or on the basis of the standard contractual clauses (Art. 46(2)(c) GDPR), of which you can obtain a copy as described below.

• Strato (sub-processors in Switzerland supporting the server virtualisation): Strato's data processing agreement puts these transfers on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR); Switzerland is additionally covered by an adequacy decision of the Commission (Art. 45 GDPR).

• Remote access to your content. Your content is stored in the European Union and is not sent to any of the recipients above. Google's terms allow Google group companies and sub-processors to access stored data from outside the European Union in order to operate and support Google's services, from around forty countries; the three-way rule above applies to that access. We ourselves access this data only from within the European Union.

Whichever instrument applies, it is supplemented by technical and organisational measures: transport encryption, data minimisation, and a documented procedure for handling requests from public authorities. Device backups that you create yourself are not transfers by us (section 3.4). You can obtain a copy of the standard contractual clauses we have concluded ourselves from us at geschaeftsfuehrung@xlogical.de. We are not a party to the clauses that Google and Strato have concluded with their own sub-processors; Google publishes its clauses in its data processing terms, and on request we tell you where to find them and ask the processor concerned for a copy on your behalf.

11. Retention

We keep your account data and your content until you delete it or delete your account, or, where we close your account, for 90 days after the closure (section 3.4). Accounts that have not been used for twelve months without a subscription being active in that time are deleted after a notice of at least 30 days; content above the free plan's limits 90 days after your subscription ends (section 3.4). Recipients you have saved for position sharing are kept until you remove them or delete your account or, where we close your account, for 90 days after the closure (section 3.3). Where we need data for security, enforcement or legal claims (section 2), we keep it until the matter is closed and, for claims, until the limitation period ends. The records of your contractual declarations (section 4) are kept for the term of the contract and until the end of the third calendar year after it ends. The record of your consent to marketing email is kept for up to three years after you withdraw it (section 7); crash reports are deleted after 90 days (section 6), and diagnostic files you send us when the request is closed, at the latest after 90 days (section 8).

Data the Application stores on your device remains there until you sign out, delete your account or remove the Application; the Firebase installation ID and the App Check identifier remain until you remove the Application or clear your browser data (section 8); the technical diagnostic log is overwritten after seven days at the latest. Server logs of our website, of the shared-position page and of the map server are deleted or anonymised after 14 days (section 2); technical logs of our cloud infrastructure are kept for at most 30 days. Deleted data and these server logs can remain for up to 30 days in our backup copies of the database, the file storage and the web and map server (section 3.4).

Records required for accounting are kept to meet statutory retention duties under commercial and tax law: the invoices and payment vouchers for your purchases are accounting vouchers, and we keep them for eight years (Art. 6(1)(c) GDPR in conjunction with § 257 HGB and § 147 AO), counted from the end of the calendar year in which the document was created. Correspondence about your contract — such as our confirmations and notices, cancellations, withdrawals, refund requests and our replies — is commercial correspondence that we keep for six years on the same basis, counted in the same way; other support correspondence is kept for 24 months (section 2). Records required for reporting to our licensors are kept on the basis of Art. 6(1)(f) GDPR, separately, for the periods required by those agreements: for the term of the respective licence agreement and, after it ends, a further four years (BSH), five years (PRIMAR/NHS) and seven years (UKHO); the IC-ENC billing records are kept for as long as our agreement with IC-ENC requires them to be kept for billing and audit purposes. These records are pseudonymous, except that the IC-ENC billing records contain the name of the account holder (section 9).

12. Your rights

You have the right to request access to your personal data, rectification, erasure, restriction of processing, and data portability. Where processing is based on consent, you may withdraw it at any time with effect for the future.

Right to object (Art. 21 GDPR). Where we process your personal data on the basis of our legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). The automated check described in section 8 (App Check) does not have that effect: it decides only whether a single request reaches the chart data or your content (on the shared-position page: the shared position), it is repeated on the next attempt, and if it keeps failing, a person looks into it with you when you contact support@xlog-boating.com.

These rights apply to all of your content: we can provide copies, correct and delete them on request, and while you have access to the Service you can export your content yourself in the Application, trips as GPX files, for example; in every case we provide it to you on request (section 9 of the EULA). Section 3.4 explains what account deletion covers on our servers and on your devices.

To exercise these rights, contact geschaeftsfuehrung@xlogical.de.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

The supervisory authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany https://datenschutz.hessen.de

13. Children

The Service is not directed at children. You may create an account and use the Service only if you are at least 16 years old.

14. Changes to this policy

We will update this policy when our processing changes. The current version is always available in the Application and at https://xlog-boating.com/de/datenschutz.

If we want to process your data for a purpose other than the one we collected it for, we will inform you of that purpose and of the further information under Art. 13(2) GDPR beforehand, separately, and not merely by publishing a new version here. Where the new purpose requires your consent, we obtain it in advance.

All four documents can be retrieved and saved there at any time: