Garmingo Privacy Policy

Version: 2.4
Last Updated: October 22, 2026

Table of Contents

1. Controller and Contact Information
2. Overview
3. Data We Collect and How We Collect It
4. Purposes and Legal Bases for Processing
5. Third-Party Service Providers and Data Recipients
6. International Data Transfers
7. Data Retention
8. Cookies and Similar Technologies
9. Social Login (OAuth)
10. Marketing and Newsletter Communications
11. Security
12. Children's Privacy
13. Your Rights Under the GDPR
14. Right to Lodge a Complaint
15. Changes to This Privacy Policy
16. Contact and Requests

1. Controller and Contact Information

The controller responsible for the processing of your personal data within the meaning of Art. 4(7) GDPR is:

Garmingo Unternehmergesellschaft (haftungsbeschränkt)
Trading name: Garmingo
Hörder Straße 324
58454 Witten
Germany

Email: support@garmingo.com
Management: management@garmingo.com

(hereinafter "Garmingo", "we", "us", "our")

Appointment of a Data Protection Officer (DPO): Garmingo is not currently subject to the obligation to appoint a Data Protection Officer under Art. 37 GDPR. If you have data protection-related questions or requests, please contact us directly at support@garmingo.com.

2. Overview

This Privacy Policy describes how Garmingo collects, processes, stores, and shares personal data when you use our services, including:

• The Garmingo website at https://garmingo.com and associated subdomains (the "Website");
• Garmingo Status — our SaaS-based uptime monitoring service;
• Garmingo Voice — our AI-powered desktop application for speech enhancement, dictation, and meeting transcription;
• Any other products or services offered by Garmingo that link to this Privacy Policy.

We process personal data only to the extent necessary and only where a valid legal basis under Art. 6 GDPR (and, where applicable, Art. 9 GDPR) exists. We do not sell your personal data to third parties.

This Privacy Policy applies alongside our General Terms of Service and any applicable product-specific terms.

3. Data We Collect and How We Collect It

3.1 Data You Provide Directly

When you create an Account, purchase a subscription, or contact us, you may provide us with the following personal data:

You are not required to provide all of the above data, but certain data is necessary for us to provide the Services. We will indicate which fields are mandatory at the point of collection.

3.2 Data Collected Automatically

When you access and use our Services, we and our service providers may automatically collect certain technical data:

3.3 Analytics Data

We use analytics tooling to understand how our Services are used and to improve them. We currently operate the following analytics solutions:

• Self-hosted analytics (cookie-free): We operate a self-hosted, privacy-preserving analytics solution for the Website. This solution does not use cookies, does not track users across websites, and does not process data in a way that allows us to identify individual users. Data is processed exclusively on infrastructure under our control within the European Union. No personal data is transferred to third parties in connection with this analytics solution.

• PostHog (potentially): We may use PostHog for product analytics to understand how users interact with the Services. Where used, PostHog may be deployed in a self-hosted or EU-hosted configuration. PostHog analytics may involve the processing of pseudonymous usage data (such as session identifiers and interaction events). We will update this Privacy Policy prior to any deployment of PostHog. For more information, see https://posthog.com/privacy.

3.4 Data Processed in Connection with Garmingo Voice (Desktop App)

Garmingo Voice processes audio and speech data locally on your device and/or via cloud-based AI infrastructure, depending on the features you use and the settings you configure. The following applies:

• Local processing: Where you use local AI models within Garmingo Voice, your audio and transcription data is processed exclusively on your own device. This data is not transmitted to Garmingo or to any third party.
• Cloud processing: Where you use cloud-based AI features (e.g., speech enhancement or transcription powered by cloud AI models), your audio data is transmitted to our AI infrastructure provider (Mistral AI) for processing. This processing occurs under GDPR-compliant terms (see Section 5). We transmit only the minimum data necessary for the requested feature.

For billing, we record how many credits each cloud request uses and pass this usage record to our billing provider Metronome (see Section 5.1). Usage records do not contain your audio or text.

We recommend that you review the settings within Garmingo Voice to understand and control which features involve cloud processing.

3.5 Data from Third-Party Authentication Providers (Social Login)

If you register or log in using a third-party OAuth provider (currently GitHub and Google), we receive a limited set of data from those providers necessary to create and authenticate your Account. See Section 9 for details.

3.6 Data We Do Not Collect

We do not intentionally collect or process:

• Special categories of personal data (Art. 9 GDPR), such as health data, racial or ethnic origin, political opinions, religious beliefs, biometric or genetic data;
• Personal data of children under 18 years of age (see Section 12);
• Full payment card numbers or CVV codes (these are handled exclusively by our payment provider Stripe).

4. Purposes and Legal Bases for Processing

We process your personal data only where we have a valid legal basis under Art. 6 GDPR. The following table sets out our main processing activities and their corresponding purposes and legal bases.

Legitimate interests balancing test: Where we rely on Art. 6(1)(f) GDPR (legitimate interests), we have assessed that our interests are not overridden by your interests or fundamental rights. You have the right to object to processing based on legitimate interests at any time (see Section 13.7).

4.1 Opt-In: AI Training Data Contribution

We may offer you the option to voluntarily contribute pseudonymised usage data (such as interaction patterns, feature usage, or similar telemetry) to help improve AI models used within our Services. This programme is entirely opt-in: we will only process your data for this purpose if you have given your express, freely given, and specific consent by actively enabling the relevant option in your account or application settings.

Key characteristics of this processing:

• Participation is always voluntary. You will not be penalised or disadvantaged for declining or for withdrawing your participation at any time.
• Data is pseudonymised before use. Direct identifiers (such as your name or email address) are removed or replaced with non-identifying references prior to any use for training purposes.
• You may withdraw your consent at any time via your account settings or by contacting us at support@garmingo.com, with effect for future processing. Withdrawal does not affect data already incorporated into a trained model where technical reversal is not reasonably feasible.
• The specific data types contributed, and any third-party processors involved, will be clearly disclosed at the point of opt-in.

5. Third-Party Service Providers and Data Recipients

We engage the following categories of third-party processors and recipients that may receive or process your personal data on our behalf. Where a third party acts as a data processor, we have entered into a Data Processing Agreement (DPA) with them as required by Art. 28 GDPR.

5.1 Billing and Payment Processing — Metronome and Stripe

Our billing runs on two providers that work together. Metronome calculates charges, manages your plan, included credits and usage, and creates invoices. Stripe collects payment for those invoices, calculates VAT (Stripe Tax), and stores your payment method. Garmingo does not store or process full payment card data: you enter your card details directly on Stripe's payment pages, and we never see your full card number or security code (CVV).

We create a customer record with both providers when you buy a plan, start a free trial, or activate a license purchased through AppSumo. If our team grants you access free of charge, we only use Metronome. Free plans that you activate yourself involve neither provider.

Metronome (Metronome Technologies, Inc., USA)

• Purpose: Rating usage, managing plans, contracts and credit balances, and creating invoices.
• Data transferred: The name of the billed account (your name or email address, or your organization's name), an internal account identifier, your plan and contract details, and, for Garmingo Voice, a usage record for each cloud request (credits used, type of operation, AI model, audio duration or token count, and internal identifiers of the device, user and license). Usage records do not contain your audio, transcripts, or any other content.
• Privacy Policy: https://metronome.com/privacy-policy

Stripe (Stripe Payments Europe, Ltd., Ireland)

• Purpose: Collecting payments, storing your payment method, calculating VAT (Stripe Tax), and providing the billing portal in which you can update your billing details.
• Data transferred: Name, email address (for organizations: the email address of the admin who sets up billing), billing address, VAT ID (if you provide one), payment card details (entered directly with Stripe), invoice amounts and line items, and payment status.
• Data we receive from Stripe: Payment status, card brand, the last four digits and expiry date of your card (so we can show you which payment method is on file), and a card fingerprint. A card fingerprint is a code that Stripe generates for a card number; it lets us recognize the same card again without seeing the number. We use it only to make sure that each free trial is used once per card (legitimate interest in preventing abuse; see Section 4).
• Privacy Policy: https://stripe.com/privacy

As described in its privacy policy, Stripe also uses some of this data for its own purposes, for example fraud prevention and meeting its legal obligations as a payment provider.

TODO (owner) — remove before publishing: (1) Confirm where Metronome stores and processes customer data (region) and which transfer mechanism applies to Metronome (EU-U.S. Data Privacy Framework or Standard Contractual Clauses). (2) Confirm that a DPA with Metronome is signed. (3) Confirm that Stripe Payments Europe, Ltd. is the contracting Stripe entity in our Stripe account.

5.2 Authentication — Better Auth (Self-Hosted)

Account authentication is handled via Better Auth, deployed on our own self-hosted infrastructure within the European Union. Credential data (hashed passwords, session tokens) does not leave our infrastructure.

5.3 Cloud AI Processing — Garmingo Voice

When you use cloud AI features within Garmingo Voice, your audio and/or transcription data is processed by Mistral AI (Mistral AI SAS) — GDPR compliance confirmed under applicable terms.
Privacy Policy: https://mistral.ai/terms/#privacy-policy

Data is transmitted to Mistral AI only when you actively use features that require cloud AI processing. We transmit only the minimum data necessary for the requested feature. We recommend reviewing Mistral AI's privacy policy for full details on how submitted data is processed.

5.4 Social Login Providers

If you use social login, the following providers may share data with us (see Section 9):

• GitHub (GitHub, Inc. / Microsoft Corporation)
• Google (Google LLC / Alphabet Inc.)

5.5 Marketing Email — Listmonk (Self-Hosted)

Marketing and newsletter communications are sent via Listmonk, a self-hosted, open-source email platform deployed on our own infrastructure within the European Union. Your email address and subscription preferences are stored on our own servers and are not shared with any third-party email marketing platform.

Transactional emails (e.g., account confirmation, password reset, invoices) may be delivered via a transactional email relay service. We will update this section if and when a specific relay provider is used.

5.6 Hosting and Infrastructure

Our Services and data are hosted on infrastructure located within the European Union. We will update this section if hosting arrangements change.

5.7 Error and Performance Monitoring — Sentry

We use Sentry to detect, analyse, and fix errors and performance problems on our Website, including the web dashboard, and on the servers behind it, which also handle requests from our apps (for example the cloud features of Garmingo Voice). Sentry's software development kit (SDK) runs in your browser and on our servers. When an error occurs, it sends an error report to Sentry. It also sends performance data for a random sample of about 10% of page loads, page navigations, and server requests.

Sentry (Functional Software, Inc. d/b/a Sentry, USA)

• Purpose: Detecting, diagnosing, and fixing errors and performance problems so that the Services run stably and securely.
• Error reports: The error message and stack trace, the page and route where the error occurred (including the URL), the time, your browser and operating system, your language and time zone setting, the previous page (referrer), and a record of the events shortly before the error ("breadcrumbs": pages opened, elements clicked, network requests with their URL and status, and console messages).
• Request data (from our servers, for error reports and sampled performance data): The URL including its query parameters, and the request and response headers (for example browser, language, and the host name of our Website). Before sending, the SDK replaces the values of headers and URL parameters whose names indicate credentials (for example authorization headers, tokens, and passwords) with "[Filtered]".
• Performance data: How long page loads, navigations, and server requests take, and the steps involved (for example loading resources, database queries, and requests to other services), together with the URL, browser, and operating system.
• Session data: For each page view, a record of whether it ended with an error, which Sentry uses to calculate error rates.
• Not collected: We have configured the SDK not to send your IP address, cookies, request or response bodies (such as form entries and passwords), AI inputs and outputs (such as Garmingo Voice transcripts), database query data, or the values of variables in our code. When Sentry receives a report, it may still derive an approximate location (country, region, and city) from the IP address of the incoming connection and store it with the report. The IP address itself is not stored with the report.
• What we do not use: We do not use Sentry's session replay (recordings of your screen), its user feedback widget, or its log collection. We do not attach your name, email address, or account ID to reports, although URLs or error messages can occasionally contain such data. Sentry's browser SDK sets no cookies and stores no data in your browser.
• Transmission: Your browser sends reports to an address on our own domain, and our servers forward them to Sentry.
• Storage location: We use Sentry's EU data region. Error reports and performance data are stored in Frankfurt, Germany (see Section 6).
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the stable, secure, and error-free operation of our Services. You can object at any time (see Section 13.7).
• Privacy Policy: https://sentry.io/privacy/

TODO (owner) — remove before publishing: (1) Accept Sentry's Data Processing Addendum for the garmingo organization (https://sentry.io/legal/dpa/). Sentry applies it only once it has been accepted electronically, and Section 5 states that we have a DPA with every processor. (2) In the Sentry organization and project settings (Security & Privacy), confirm that the server-side Data Scrubber with the default scrubbers is on, as a second layer of protection against credentials in headers, URLs, and error messages. Also turn on "Prevent Storing of IP Addresses", check whether it stops the approximate location that Sentry derives from the connection, and if it does, remove the location sentence in the "Not collected" item above.

5.8 Disclosure to Authorities

We may disclose personal data to competent authorities (including law enforcement, courts, or regulatory bodies) if and to the extent we are required to do so by applicable law, a binding court order, or in order to protect the legal rights and interests of Garmingo or third parties.

6. International Data Transfers

Garmingo's primary data storage and processing infrastructure is located within the European Union. We endeavour to keep personal data within the EEA wherever possible.

Certain third-party service providers (in particular, billing provider Metronome, payment provider Stripe, error monitoring provider Sentry, AI processing provider Mistral AI, and social login providers GitHub and Google) may be based outside the European Economic Area, including in the United States, or may process data there. Metronome is based in the United States; Stripe may transfer data to its affiliate Stripe, Inc. in the United States.

Sentry (Functional Software, Inc.) is based in the United States. We use Sentry's EU data region, so error reports and performance data are stored in Frankfurt, Germany. The region only determines where the data is stored, so access from or processing in the United States, for example for support and operations, cannot be ruled out. Functional Software, Inc. participates in the EU-U.S. Data Privacy Framework; Sentry's DPA provides Standard Contractual Clauses as a fallback.

Where personal data is transferred to a third country, we ensure that one or more of the following transfer mechanisms applies:

• The recipient country has been recognised by the European Commission as providing an adequate level of data protection (adequacy decision pursuant to Art. 45 GDPR);
• The transfer is subject to Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Art. 46(2)(c) GDPR;
• The recipient has provided appropriate safeguards under Art. 46 GDPR and the transfer is necessary for performance of the contract.

You may request further information about the specific transfer mechanisms in place for any particular provider by contacting us at support@garmingo.com.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.

After the applicable retention period expires, personal data is securely deleted or anonymised.

TODO (owner) — remove before publishing: (1) Set a retention period for free-trial records (account and card fingerprint, see Section 5.1) and add a row above; the code does not delete them today. (2) Confirm that Metronome and Stripe delete or return billing data in line with the 10-year period above once our contract with them ends or an account is deleted. (3) Confirm the Sentry plan of the garmingo organization and adjust the Sentry row: the Developer (free) plan keeps error reports for 30 days, Team and Business keep them for 90 days, and all plans keep performance data for 30 days. On Business and Enterprise plans with span-based billing, Sentry also keeps downsampled performance data for 13 months. Sentry's retention table does not list session data.

8. Cookies and Similar Technologies

8.1 Our Approach

We aim to operate our Website and Services with minimal use of cookies. Our self-hosted analytics solution (see Section 3.3) does not use cookies or local storage tracking mechanisms. Our error monitoring (Sentry, see Section 5.7) also sets no cookies and stores no data in your browser.

8.2 Technically Necessary Cookies

We use a limited number of session cookies that are strictly necessary for the operation of the Services — for example, to maintain your authenticated session after login. These cookies are set by our own infrastructure, are not used for tracking or advertising purposes, and do not require your consent pursuant to § 25(2) No. 2 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz).

8.3 Optional / Analytics Cookies

If we introduce analytics tools that use cookies (such as PostHog where deployed in a cookie-based configuration), we will request your prior consent in accordance with § 25(1) TDDDG before setting any non-essential cookies. You may withdraw such consent at any time via your cookie preferences.

8.4 Managing Cookies

You can control and delete cookies through your browser settings at any time. Please note that disabling technically necessary cookies may affect the functionality of the Services.

9. Social Login (OAuth)

If you choose to register or log in to the Services using your GitHub or Google account, those providers will authenticate your identity and share a limited set of data with us. The data we receive typically includes:

• Your name or display name as registered with the provider;
• Your email address registered with the provider;
• A provider-specific user identifier (used for authentication purposes only).

We do not receive your password from these providers and do not have access to your full social account profile, contacts, or other data beyond what is necessary for authentication.

Your use of GitHub and Google OAuth is also governed by the respective providers' privacy policies:

• GitHub: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
• Google: https://policies.google.com/privacy

You may disconnect social login from your Account at any time via your account settings.

10. Marketing and Newsletter Communications

10.1 Subscription and Consent

We send marketing and newsletter emails using our self-hosted Listmonk platform. We will only send you marketing communications if you have provided your express, freely given, and informed consent in accordance with Art. 6(1)(a) GDPR and § 7 UWG (Gesetz gegen den unlauteren Wettbewerb).

We use a confirmed opt-in (double opt-in) procedure: after you sign up for our newsletter, we will send you a confirmation email with a verification link that you must click to activate your subscription. We retain evidence of your consent.

10.2 Right to Withdraw Consent (Unsubscribe)

You may withdraw your consent and unsubscribe from marketing communications at any time, free of charge, by:

• Clicking the unsubscribe link included in every marketing email; or
• Contacting us at support@garmingo.com.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. After unsubscribing, we will cease sending you marketing emails within a reasonable time.

10.3 Transactional Emails

We may send you transactional emails that are necessary for the performance of our contract with you (such as account confirmations, password resets, subscription confirmations, license activation confirmations, and invoices). These are not marketing communications and are not subject to the opt-in requirement. You may not opt out of transactional communications while your Account is active.

10.4 AppSumo Activation and Review Requests

When you activate a Garmingo Voice license purchased through AppSumo, we send you a confirmation email (transactional, see Section 10.3). That email, and the reminders described below, also invite you to share your honest opinion on AppSumo, on our feedback portal, or directly with us at feedback@garmingo.com or on our Discord. Any review or feedback is voluntary. We do not ask for positive reviews only.

If you do not opt out, we may send you reminder emails after activation. We stop earlier if your license is deactivated.

• Legal basis: Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG. We use the email address you gave us when creating your Garmingo account to promote our own similar service and to ask for customer feedback. You can object at any time (see Section 13.7).
• Opt-out: Every reminder contains a "Stop these reminders" link (and mail clients that support it show an "Unsubscribe" button). Opting out is free of charge and takes effect immediately. You can also write to support@garmingo.com. Opting out does not affect your license or any transactional email.
• Data stored: your email address, the reminder schedule, delivery status, and, if you opt out, the time of your opt-out. To honor your opt-out, we keep your email address on a suppression list so that you are not asked again.
• Third-party sites: AppSumo is an independent controller. We do not transmit your data to AppSumo when sending these emails; your data is processed by AppSumo only if you follow the link and write a review there, under its privacy policy.
• Email delivery: These emails are sent by our own mail server (not via Listmonk) and are not part of the newsletter described in Section 10.1.

10.5 AppSumo Review Reward

As a thank-you for a review on AppSumo, customers with an active AppSumo license can receive a one-time bonus of 5,000 Voice AI credits. The reward does not depend on your rating: positive and critical reviews receive the same credits. Each account can receive the reward once.

• How it works: You upload a screenshot of your AppSumo review in your dashboard, optionally with a link to the review. A member of our team checks it manually and then adds the credits to the account your AppSumo license is attached to (your personal account or your organization). We email you the result.
• Data processed: the screenshot (re-encoded on upload, which removes embedded metadata such as location data), the optional review link, the time of submission, our decision, the reason if we could not confirm your review, and the credit booking in our billing system.
• Legal basis: Art. 6(1)(b) GDPR, as the processing is necessary to provide the reward you asked for.
• Storage: Screenshots are stored in a private storage bucket and are only visible to you and our team. We delete them 90 days after our decision. The record that you received the reward is kept for as long as your account exists, so that each account receives it only once.
• Effect on emails: Once we have confirmed your review, we stop sending you review reminders.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures include, where applicable:

• Encrypted storage of passwords (bcrypt or equivalent);
• Encrypted data transmission (TLS/HTTPS);
• Access controls and least-privilege principles for internal systems;
• Regular review of our security practices.

Please be aware that no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required by Art. 34 GDPR, notify you directly without undue delay.

12. Children's Privacy

Our Services are not directed at, and we do not knowingly collect personal data from, persons under the age of 18 years. If you are under 18, you must not use our Services or provide us with any personal data.

If we become aware that we have inadvertently collected personal data from a person under the age of 18, we will delete that data promptly. If you believe we may have collected personal data from or about a person under 18, please contact us at support@garmingo.com.

13. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights regarding your personal data. We respond to all valid requests within one month of receipt, which may be extended by up to two further months in complex cases (with notification to you).

13.1 Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether we are processing personal data about you, and if so, to receive a copy of that data along with information about the processing (purposes, categories of data, recipients, retention periods, etc.).

13.2 Right to Rectification (Art. 16 GDPR)

You have the right to request correction of inaccurate personal data or completion of incomplete personal data we hold about you.

13.3 Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR)

You have the right to request deletion of your personal data where:

• The data is no longer necessary for the purposes for which it was collected;
• You have withdrawn consent and there is no other legal basis for processing;
• You have objected to processing and there are no overriding legitimate grounds;
• The data has been unlawfully processed;
• Deletion is required by applicable law.

This right does not apply where processing is necessary for compliance with a legal obligation, or for the establishment, exercise, or defence of legal claims.

13.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request restriction of processing in certain circumstances, including where you contest the accuracy of the data, where processing is unlawful but you prefer restriction to erasure, or where you have objected to processing pending verification of our legitimate grounds.

13.5 Right to Data Portability (Art. 20 GDPR)

Where we process your personal data on the basis of your consent or for the performance of a contract, and processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

13.6 Right to Withdraw Consent (Art. 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You may withdraw consent by contacting us at support@garmingo.com or, for newsletter communications, by using the unsubscribe link in any marketing email.

13.7 Right to Object (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data where we rely on Art. 6(1)(f) GDPR (legitimate interests) as our legal basis. Upon your objection, we will cease processing unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have an unconditional right to object at any time, and we will cease processing for that purpose immediately without the need to demonstrate compelling grounds.

13.8 Right Not to be Subject to Automated Decision-Making (Art. 22 GDPR)

We do not currently make decisions that produce legal or similarly significant effects on you based solely on automated processing, including profiling.

13.9 How to Exercise Your Rights

To exercise any of the rights set out above, please contact us at:

Email: support@garmingo.com
Post: Garmingo UG (haftungsbeschränkt), Hörder Straße 324, 58454 Witten, Germany

We may request additional information to verify your identity before processing your request. We will not charge a fee for responding to a legitimate request, unless requests are manifestly unfounded or excessive.

14. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a competent supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority competent for Garmingo is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Website: https://www.ldi.nrw.de
Email: poststelle@ldi.nrw.de

You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, your place of work, or the place where the alleged infringement occurred.

We would nevertheless appreciate the opportunity to address your concerns directly before you contact the supervisory authority — please reach out to us at support@garmingo.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, or the structure of our Services. We will notify you of material changes by:

• Sending an email to the address registered with your Account; and/or
• Publishing a prominent notice on our Website.

The updated Privacy Policy will indicate the revised "Last Updated" date at the top of this document. For significant changes, we will provide reasonable advance notice before the changes take effect. Your continued use of the Services after the effective date of any update constitutes acknowledgment of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically.

16. Contact and Requests

For any questions, requests, or concerns regarding this Privacy Policy or our data processing practices, please contact us at:

Garmingo Unternehmergesellschaft (haftungsbeschränkt)
Hörder Straße 324
58454 Witten
Germany

We endeavour to respond to all data protection requests within one month in accordance with Art. 12(3) GDPR.

_This Privacy Policy constitutes the Datenschutzerklärung of Garmingo Unternehmergesellschaft (haftungsbeschränkt) and has been drafted with the aim of complying with applicable European and German data protection law, including the General Data Protection Regulation (GDPR / DSGVO), the Bundesdatenschutzgesetz (BDSG), and the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG)._

_This document does not constitute legal advice. Garmingo recommends that this Privacy Policy be reviewed by a qualified attorney prior to publication._