Privacy Policy — Germany

Privacy Addendum for Germany

This addendum supplements the ZhiYin global privacy policy with requirements specific to Germany. Where this addendum conflicts with the global policy, this addendum takes precedence for users located in Germany.

Regulatory Authority

Federal Commissioner for Data Protection and Freedom of Information (BfDI), State Data Protection Authorities

Applicable legislation: EU GDPR, Bundesdatenschutzgesetz (BDSG)

Data Residency

GDPR governs. Adequate protection required for transfers outside EEA. Standard contractual clauses commonly used.

Breach Notification

GDPR requires notifying the competent supervisory authority within 72 hours of becoming aware of a reportable breach, and affected individuals without undue delay where the breach is likely to result in a high risk to them.

ZhiYin aligns its incident-response process with these requirements and will notify the relevant regulatory authority and affected individuals within the timeframe required by applicable law.

Data Retention

Strict purpose limitation. Employee data subject to additional protections under BDSG. Works council involvement may be required.

Your Rights in Germany

In addition to the rights outlined in our global privacy policy, users in Germany have the following specific rights under local law:

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure / right to be forgotten (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Rights related to automated decision-making and profiling (Art. 22 GDPR)