Last updated: 12 October 2026
The controller within the meaning of the GDPR is:
Fastic GmbH
Pappelallee 78/79
10437 Berlin
Germany
Email: datenschutz@fastic.com
Postal address for data protection matters: Fastic GmbH, Data Protection Officer, Pappelallee 78/79, 10437 Berlin
The mandatory information pursuant to Section 5 DDG (legal notice) is permanently available in the Fastic App in the menu "Settings → Legal" and on www.fastic.com at /impressum.
Data Protection Officer
You can contact our Data Protection Officer directly, for example regarding particularly sensitive matters, as follows:
External Data Protection Officer
ePrivacy GmbH
represented by Prof. Dr. Christoph Bauer
Bei den Mühren 5, 20457 Hamburg
If you have any questions about the processing of personal data, requests for access, rectification or erasure, or wish to withdraw your consent, you can contact us at any time by email at datenschutz@fastic.com or by post at the address above.
This privacy policy applies to the following services of Fastic GmbH:
Where a particular processing operation takes place exclusively for one of these services, this is indicated in the relevant section.
A separate privacy policy applies to the course platform of the online prevention course at kurs.fastic.com, which can be viewed there. Booking, payment, dunning and health insurance reimbursement for the course are described in sections VI and VII of this privacy policy. Separate privacy notices apply to the Movina app.
When you visit our websites www.fastic.com and web.fastic.com or use the Fastic App, the following access data is collected automatically:
On web.fastic.com, we derive your country, region and city from your IP address in order to display the appropriate language, prices and currency. We store these values in cookies (fastic_country, fastic_region, fastic_city) for 30 days.
Purpose: ensuring operation, error analysis, defence against attacks, country-specific display.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service); Section 25(2) no. 2 TDDDG. In the event of security-related incidents, the data may be analysed in a personally identifiable form.
Retention period: log files are generally deleted automatically within up to 30 days, unless security-related events require longer storage.
Creator enquiries (www.fastic.com/de/creator): name, email, creator platform, username, reach, message. The data is transmitted to our own backend (Firebase Cloud Functions, region europe-west1) and used to process your enquiry. Legal basis: Art. 6(1)(f) GDPR.
Email enquiries: data needed to answer your enquiry, linked to your customer account where applicable. Legal basis: Art. 6(1)(f) GDPR; for contract-related enquiries Art. 6(1)(b) GDPR. To handle enquiries, we use the services of Google Workspace and Freshdesk (customer support system of Freshworks Inc., USA, Standard Contractual Clauses). To pre-sort and answer support requests, we use an AI model of OpenAI, L.L.C. (USA, Standard Contractual Clauses).
Termination and withdrawal form (www.fastic.com/contract-revocation): user ID (optional), first and last name, address, email address, feedback, language. The data is transmitted to our own backend (Firebase Cloud Functions, region europe-west1). Legal basis: Art. 6(1)(b) and (c) GDPR (contract handling, Section 312k BGB).
The Fastic App and our websites are operated predominantly on cloud infrastructure in the European Union. We use:
Where data is transferred to the USA, this is based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses and, where necessary, supplementary technical measures (encryption). Legal basis: Art. 6(1)(f) GDPR and, for contractual services, Art. 6(1)(b) GDPR.
We operate profiles on social networks (Instagram, Facebook, TikTok and YouTube). When you visit our profiles or interact with our posts (e.g. like, comment, send messages), we process the content and your username in order to communicate with you and operate our profiles.
The following applies to Instagram and Facebook (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland): Meta provides us with statistical analyses of the use of our profiles ("Insights"). We are joint controllers with Meta for the processing related to these statistics (Art. 26 GDPR). In an agreement, Meta has undertaken to assume primary responsibility for this processing and to fulfil your data subject rights; the agreement is available at https://www.facebook.com/legal/terms/page\_controller\_addendum. We have no influence on any other data processing by the operators of the networks; further information can be found in the privacy notices of the respective network. Data may also be transferred to the USA in this context (EU-U.S. Data Privacy Framework or Standard Contractual Clauses).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with prospective customers and users and in presenting our services).
When you first start the Fastic App, you complete an onboarding questionnaire. Its purpose is
The data collected includes, among other things:
Legal basis:
After you complete the questionnaire, a pseudonymous customer profile is created so that you can use the free basic features immediately. This profile contains only the information you provided during onboarding and a technical device identifier, but neither your name nor your contact details. You can discard the profile at any time by uninstalling the app.
You can permanently register the automatically created profile in the following ways. In all cases, we process the data to provide the user agreement (Art. 6(1)(b) GDPR).
a) Registration by email
You receive a confirmation email with a sign-in link (magic link); no password is requested. Data processed: email address, token metadata, timestamp.
b) Registration via Google login
You sign in with your existing Google account. Google transmits to us: Google account ID, email address, display name, profile picture URL. Provider: Google Ireland Ltd. (EU); for users outside the EU, Google LLC (USA). We do not receive any Google login credentials.
c) Registration via Apple Sign In
You sign in with your Apple ID. Apple transmits to us: anonymised Apple user ID, optionally your email address (also possible via Apple's "Hide My Email" relay address), name (only at first login). Provider: Apple Distribution International Ltd. (Ireland).
d) Registration via Facebook login
You sign in with your Facebook account. Meta transmits to us: Facebook ID, email address, public profile information (name, profile picture), username. If the connection is removed in Facebook, the access token becomes invalid. Provider: Meta Platforms Ireland Ltd. (EU), Meta Platforms Inc. (USA).
e) Registration via telephone number
You enter your telephone number and receive a one-time PIN (OTP) by SMS via Firebase Authentication. Data processed: telephone number, SMS delivery metadata, time of verification.
For all sign-in methods, the data is stored in the EU Firebase Authentication instance.
While you use the app, we store:
Legal basis: Art. 6(1)(b) GDPR for the performance of the user agreement (free and paid features) and Art. 6(1)(f) GDPR for improving usability. For the processing of your meal photos and voice inputs, see section V (AI features).
During an active fasting phase, we can display the remaining progress on your lock screen (iOS Live Activities, Android notifications). By default, this display is only active if you have started a fasting phase, and it can be disabled in the device settings. Legal basis: Art. 6(1)(b) GDPR.
At your express request, the Fastic App can import health and fitness data from external platforms and write data back to them. A connection is only established after your express consent (Art. 9(2)(a) GDPR) and the respective system permission.
All health and fitness data is processed via the Vital service (Tryvital, Inc., USA; EU data residency active) as a unified integration layer. Vital acts as our processor (DPA concluded, Standard Contractual Clauses for transfers to the USA). The following sources can be connected via Vital:
Sleep, weight, step, hydration, calorie expenditure and workout data. We do not use data from health platforms for advertising and do not pass it on to advertising services.
Legal basis: express consent pursuant to Art. 9(2)(a) GDPR. You can disconnect at any time in the app settings or in the respective source system. Disconnecting only takes effect for the future.
The website web.fastic.com serves as an independent onboarding and subscription platform. Users typically reach web.fastic.com directly via online marketing and there complete - independently of the app - a full onboarding process up to the purchase of a subscription. Downloading the Fastic App is only recommended after purchase.
The onboarding questionnaire on web.fastic.com corresponds in content to the app questionnaire described in section III.1. The same data categories are collected - including special categories of personal data under Art. 9 GDPR (medical conditions, allergies, intolerances, pregnancy) - and the same legal bases apply as described there. You can withdraw your consent by email to datenschutz@fastic.com or by deleting your account.
The data collected in the questionnaire is stored continuously - i.e. while you are filling it in - in Firebase (Firestore, region europe-west1) under a pseudonymous user ID. This user ID is stored in the local browser storage (IndexedDB) and is retained even after the browser is closed until you actively delete the browser storage. After registration, the questionnaire answers are linked to the permanent customer account. Without registration, the profile contains only the questionnaire answers and the technical user ID. You can remove it at any time by deleting the browser data for web.fastic.com. Unregistered profiles that are not converted into a registered customer account within 30 days are deleted automatically.
Sign-in on web.fastic.com takes place exclusively via a sign-in link sent by email (magic link) or via a single-use code. Data processed: email address, authentication token, timestamp. Legal basis: Art. 6(1)(b) GDPR.
On web.fastic.com, subscriptions can be purchased and existing subscriptions managed (renewal, cancellation, dunning). The data processed and the payment service providers used correspond to section VI.
In the logged-in area of web.fastic.com (Profile → Settings), you can manage your consent to email and SMS marketing and unsubscribe from SMS notifications. Data processed: email address or telephone number, selected preference, timestamp of the change. Legal basis: Art. 6(1)(a) GDPR (management of your consent) and Art. 6(1)(f) GDPR (proof of consent and unsubscription).
On individual pages of www.fastic.com, we embed videos from YouTube (Google Ireland Ltd.) and TikTok (TikTok Technology Limited, Ireland). When a video is loaded, the respective provider receives, for technical reasons, your IP address as well as device and browser information; data may be transferred to the USA in this context. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation of our services).
The Fastic App offers AI-supported features such as the automatic recognition of meals from photos, voice inputs and text inputs. For this purpose, we transmit input data to external AI providers that act as our processors:
Data transmitted, depending on the feature: meal photo, transcript of your voice input (the conversion into text is carried out by the speech recognition of your operating system, e.g. from Apple or Google), meal description, ingredients, contextual information from your profile (e.g. age, gender, weight, goal) to improve recognition.
Legal basis: Art. 6(1)(b) GDPR (provision of the booked feature). Where health context is also transmitted, the processing is based on your consent pursuant to Art. 9(2)(a) GDPR.
When you book a paid subscription, we process the following, depending on the payment method:
When you enter your address on web.fastic.com, we suggest matching addresses. For this purpose, we transmit your input to the Google Places API (Google Ireland Ltd.).
Legal basis: Art. 6(1)(b) GDPR (performance of the contract); for address suggestions Art. 6(1)(f) GDPR.
Depending on the payment method you choose, your payment data is transmitted directly to the payment service provider or app store:
Apple and Google receipts are sent to the Apple App Store Server API or the Google Play Developer API for verification.
If a payment is not made - for subscriptions as well as for the prevention course - we remind you by email, by SMS (if we have your telephone number; sent via smsapi.pl, Poland) and, where applicable, by letter. To send physical letters, we use Pingen AG (Switzerland; adequacy decision of the European Commission), which forwards the letters to local postal service providers, and Deutsche Post AG (E-POST) (Germany). If payment arrears persist, we transmit the data required to enforce the claim (name, address, email address, contract and claim data) to Debtist GmbH or Collectia Group GmbH (debt collection).
Legal basis: Art. 6(1)(b) GDPR (contract handling) and Art. 6(1)(f) GDPR (legitimate interest in enforcing outstanding claims).
For prevention courses eligible for funding under Section 20 SGB V, we offer the option of submitting a reimbursement application to your statutory health insurer. For this purpose, we process:
Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (statutory retention obligations) and Art. 6(1)(f) GDPR (enforcement of claims).
Cookies are small text files that are stored on your device when you visit a website or use an app. Similar technologies such as local storage, session storage and IndexedDB perform comparable functions. We use these technologies for the following purposes:
You can delete cookies and local storage data at any time in your browser settings. Please note that deleting strictly necessary cookies may impair the functionality of our services.
Before carrying out the processing subject to consent described in this section VIII, we obtain your consent via our consent and preference centres.
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG (storing or accessing information on end devices).
The specific implementation differs depending on the service:
In the Fastic App, we use the Google User Messaging Platform (UMP) of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. It is part of our advertising stack and complies with the IAB Europe Transparency & Consent Framework (TCF) version 2.2.
a) What the TCF is and how it works
The TCF is an industry-wide standard of the Interactive Advertising Bureau (IAB) Europe with which advertising and analytics providers uniformly declare their processing purposes and legal bases. The list of participating vendors is the so-called Global Vendor List (GVL), which is maintained and regularly updated by IAB Europe.
When you use our app for the first time in a country of the European Economic Area or in the United Kingdom, or when the GVL has been updated, the consent banner is displayed to you automatically. There you can decide individually for each processing purpose and each vendor whether you consent.
Your choice is stored on your device in a standardised TCF string and read automatically by all participating vendors so that they respect your choice.
b) Number of listed vendors
The banner displays several hundred vendors per processing purpose (as of 2026: around 1,000 vendors in the GVL in total). This list includes all vendors registered with IAB Europe that could theoretically participate in an ad auction via our advertising mediation. The fact that a vendor appears in the list does not mean that this vendor receives data from you. Data is only transmitted if (1) you have consented and (2) the vendor is actually involved in an ad served to you. The direct recipients relevant in practice are the services named individually below (sections VIII.2 to VIII.6).
c) Processing purposes (TCF purposes)
TCF v2.2 distinguishes the following standardised purposes:
| No. | Purpose | Typical legal basis according to the vendor |
|---|---|---|
| 1 | Store and/or access information on a device | Consent |
| 2 | Use limited data to select advertising | Consent or legitimate interest |
| 3 | Create profiles for personalised advertising | Consent |
| 4 | Use profiles to select personalised advertising | Consent |
| 5 | Create profiles to personalise content | Consent |
| 6 | Use profiles to select personalised content | Consent |
| 7 | Measure advertising performance | Consent or legitimate interest |
| 8 | Measure content performance | Consent or legitimate interest |
| 9 | Apply market research to generate audience insights | Consent or legitimate interest |
| 10 | Develop and improve services | Consent or legitimate interest |
| 11 | Use limited data to select content | Consent or legitimate interest |
In addition, there are so-called special purposes (security, technical delivery), for which no consent is required under the TCF.
d) Consent versus legitimate interest
You will notice in the banner that vendors state "legitimate interest" as the legal basis for some purposes (Art. 6(1)(f) GDPR). The choice of this legal basis is declared in the GVL by the respective vendor itself. You nevertheless have the right at any time to object to processing based on legitimate interest by deactivating the corresponding toggle in the banner.
We do not pass on your data if you object - regardless of the legal basis stated by the vendor.
e) Withdrawal and accessing your settings again
You can withdraw your consent at any time with effect for the future or adjust your choice by opening the following path in the app:
Profile → Settings → Privacy Settings
The lawfulness of processing carried out before the withdrawal remains unaffected.
f) Exceptions: Plus subscribers
Users with an active Plus subscription do not see the consent banner for advertising purposes, as within the Plus subscription no personalised advertising is served and no advertising profile is created. Mandatory processing for the provision of the booked services (sections III to VII) remains unaffected by this.
g) Proof of your consent
We document the time and content of your consent so that we can demonstrate your consent as part of our accountability obligations (Art. 7(1) GDPR). The data stored for this purpose is retained for the duration of the consent and for up to three years after withdrawal or the last update.
When you first visit www.fastic.com, you are informed about the services we use that require consent and can accept or reject them in full. If you reject them, the services requiring consent - in particular Google Analytics 4, Meta Pixel and the AppsFlyer Smart App Banner - are not loaded.
Your choice is stored locally in your browser (local storage). You can adjust your choice at any time by deleting the locally stored website data in your browser settings; the notice will then appear again on your next visit.
Exception - first-party reach measurement: Regardless of your consent, our hosting provider Vercel collects aggregated website visits without cross-user profiling as part of a first-party reach measurement ("Vercel Analytics"). This processing is based on our legitimate interest in ensuring and optimising the operation of the website (Art. 6(1)(f) GDPR).
When you first visit web.fastic.com, you are informed about the services we use that require consent and can accept or reject them in full. If you reject them, the services requiring consent - in particular Google Analytics 4, Amplitude and Hotjar as well as the transmissions to Meta (Conversions API), TikTok (Events API), Google Ads and OpenAI Ads - are not loaded.
Your choice is stored locally in your browser (local storage). You can adjust your choice at any time by deleting the locally stored website data in your browser settings; the notice will then appear again on your next visit.
We use the services listed in VIII.2 to VIII.6 only with your consent, unless they are technically necessary for operation. The "Consent" column shows which services this applies to. Where a service processes data on the basis of your consent and you have not consented, we do not transmit any data to this service. The services listed below represent the subset of TCF vendors actually actively used by us as well as further services used exclusively for the websites.
We use services without consent because they are strictly necessary for stable and secure operation (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).
| Service | Platform | Provider / location | Data processed | Retention period | Consent |
|---|---|---|---|---|---|
| Firebase Analytics / Google Analytics for Firebase | App | Google Ireland Ltd. (EU); USA via SCC where applicable | pseudonymous user ID, events, screen views, IP (truncated), device information, app version, language, country | up to 14 months | yes |
| Google Analytics 4 | Website (www + web) | Google Ireland Ltd. (EU); USA via SCC where applicable | pseudonymous client ID, page views, time spent on page, referrer, IP (truncated), device and browser information, approximate geolocation | up to 14 months | yes |
| Firebase Performance | App | Google Ireland Ltd. | trace data, network latencies, app start times | see Firebase Analytics | yes |
| Firebase Crashlytics | App | Google Ireland Ltd. | crash stack traces, pseudonymous user ID, device model, OS version, breadcrumbs | 90 days | no (technically necessary) |
| Firebase Remote Config | App | Google Ireland Ltd. | feature flag states, app version, country, language | until the next update | no (technically necessary) |
| Firebase A/B Testing | App | Google Ireland Ltd. | experiment buckets, events | until the experiment ends | yes |
| Amplitude | App + website (web.fastic.com) | Amplitude, Inc. (USA, EU-U.S. Data Privacy Framework; additionally SCC) | pseudonymous user ID, events, user properties | up to 24 months | yes |
| Vercel Analytics | Website (www.fastic.com) | Vercel Inc. (USA, SCC) | aggregated page views, approximate geolocation, referrer; no cross-user profiling | up to 30 days | no (anonymous) |
| Sentry | Website (web.fastic.com) | Functional Software, Inc. d/b/a Sentry (USA, SCC) | error stack traces, pseudonymous session ID, browser and OS version, URL at the time of the error | 90 days | no (technically necessary) |
| Service | Platform | Provider / location | Data processed | Retention period | Consent |
|---|---|---|---|---|---|
| UXCam | App | UXCam, Inc. (USA, SCC) | pseudonymised recording of screen interactions (tap heatmaps, navigation paths). Sensitive fields (passwords, payment data, free-text notes) are masked before recording. Recordings only take place within the first 12 days after onboarding (data minimisation). | 30 days | yes |
| Hotjar | Website (web.fastic.com) | Hotjar Ltd. (Malta / EU) | pseudonymised recording of mouse movements, clicks and scrolling behaviour (heatmaps, session recordings). Sensitive fields (payment data, passwords) are masked before recording. | 90 days | yes |
| Amplitude Session Replay | App, website | Amplitude, Inc. (USA, EU-U.S. Data Privacy Framework; additionally SCC) | pseudonymised recording of interactions (clicks, scrolling behaviour, navigation flow) to analyse the onboarding funnel. Sensitive input fields are masked before recording. | 90 days | yes |
| Service | Platform | Provider / location | Data processed | Retention period | Consent |
|---|---|---|---|---|---|
| AppsFlyer OneLink (deep links) | App, website | AppsFlyer Ltd. (Israel, adequacy decision) | deep link parameters, e.g. for signing in to the app after a purchase on the website | up to 24 months | no (technically necessary) |
| AppsFlyer (attribution) | App | AppsFlyer Ltd. (Israel, adequacy decision) | IDFA (iOS) / GAID (Android), AppsFlyer ID, install referrer, ad click/conversion events, deep link parameters | up to 24 months | yes |
| AppsFlyer Smart App Banner | Website | AppsFlyer Ltd. (Israel, adequacy decision) | pseudonymous web visitor ID, referrer, click parameters (utm_, fbclid, gclid, af_sub), browser and device information; linking with subsequent app install for marketing attribution | up to 24 months | yes |
| Apple AdServices | App (iOS) | Apple Distribution International Ltd. | attribution token for Apple Search Ads campaigns | see Apple | yes |
| Apple SKAdNetwork / AdAttributionKit | App (iOS) | Apple Distribution International Ltd. | anonymised install postbacks (no direct personal reference) | see Apple | no (anonymous) |
| Service | Platform | Provider / location | Data processed | Consent |
|---|---|---|---|---|
| Meta Pixel / Meta Conversions API | Website (www.fastic.com: Pixel; web.fastic.com: Conversions API), app (Conversions API) | Meta Platforms Ireland Ltd. (EU) / Meta Platforms Inc. (USA, SCC) | hashed email address, telephone number, name, postcode and gender, IP address, user agent, events (page view, onboarding, purchase with value); where applicable, linking to an existing Meta profile | yes |
| TikTok Events API | App, website (web.fastic.com) | TikTok Technology Limited (Ireland) / TikTok Inc. (USA, SCC) | hashed email address, telephone number, name, postcode and gender, ttclid, IP address, user agent, events | yes |
| Google Ads | App, website | Google Ireland Ltd. | conversion tracking (gclid, wbraid, gbraid), hashed email address, telephone number, name, postcode, IP address, user agent, purchase events | yes |
| OpenAI Ads | Website (web.fastic.com) | OpenAI, L.L.C. (USA, Standard Contractual Clauses) | click ID, hashed email address, telephone number, name, postcode and gender, IP address, user agent, events | yes |
| MoEngage | App | MoEngage, Inc. (USA, SCC; EU data residency available) | pseudonymous user ID, email, push token, IDFA status, subscription status, onboarding progress, fasting activity (started/completed), app level, weight goal progress, A/B experiment assignments - for controlling personalised in-app and email communication | yes |
We are joint controllers with Meta Platforms Ireland Ltd. for the collection and transmission of data to Meta (Art. 26 GDPR). The essential content of the agreement is available at https://www.facebook.com/legal/controller\_addendum. Meta is solely responsible for the subsequent processing.
The retention period at these providers is governed by their own specifications; according to their own statements, Meta, TikTok and Google use hashed matching data (e.g. email address, telephone number) only for matching and delete it afterwards.
If you do not have an active subscription, ads are served via the following networks. Non-personalised advertising (without the use of device identifiers) is shown on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Personalised advertising - i.e. the use of the IDFA (iOS) or advertising ID (Android) for behaviour-based targeting - only takes place if you have given your consent to this:
| Service | Platform | Provider / location | Data processed | Consent |
|---|---|---|---|---|
| Google AdMob | App | Google Ireland Ltd. | device identifiers (IDFA/GAID, if consented), IP address, approximate location, ad interactions | yes (personalised advertising) |
| AppLovin MAX | App | AppLovin Corporation (USA, SCC) | device identifiers (IDFA/GAID, if consented), IP address, approximate location, ad interactions | yes (personalised advertising) |
AppLovin MAX and Google AdMob conduct a real-time auction ("header bidding") for each ad impression, in which the TCF vendors listed in our CMP can participate. Individual vendors only participate to the extent that you have consented via the CMP. The direct mediation adapters that we have activated in our configuration typically include: Meta Audience Network, Google Ad Manager, Google Ads, InMobi, ironSource, BidMachine, Fyber, Unity Ads.
Each of these partners processes device identifiers (IDFA/GAID, if consented), IP address, approximate location and ad interactions when an ad is served.
A complete, up-to-date list of advertising partners can be viewed in the CMP ("Privacy Settings").
The retention period at the advertising networks is governed by their own specifications.
On iOS, you are shown Apple's App Tracking Transparency (ATT) dialog before ads are served for the first time. If you do not grant permission, the IDFA is not used for ad personalisation; conversion measurement then takes place exclusively in anonymised form via Apple SKAdNetwork / AdAttributionKit. On Android, you can reset or disable your advertising ID at any time in the Google system settings.
We only send push notifications after you have actively allowed them. You can switch them off at any time in your device's system settings.
Legal basis: Art. 6(1)(b) GDPR for transactional communication; Art. 6(1)(a) GDPR for promotional communication (promotional push notifications, newsletters, marketing emails and marketing text messages). We only send promotional messages with your consent; consent can be withdrawn at any time.
If you book the Fastic App via one of our partners, we transmit entitlement and usage status data to the following for the performance of the contract (Art. 6(1)(b) GDPR):
For Wellhub, we process the following data provided by the partner: partner user ID, email address, first and last name, country of origin, entitlement status. For the other partners: pseudonymous partner user ID, entitlement status.
Where data is transferred to countries outside the EU/EEA without an adequacy decision (in particular the USA and the United Arab Emirates), we conclude the EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 with the respective recipients and supplement them - where necessary - with additional technical measures (encryption, pseudonymisation). Where a recipient is certified under the EU-U.S. Data Privacy Framework, we base the transfer on the adequacy decision of the European Commission.
We transfer pseudonymous campaign and attribution data to a service provider in the United Arab Emirates that supports us in running our marketing campaigns (Standard Contractual Clauses).
You can request a copy of the respective safeguards from the controller (contact details in section I).
We process your personal data only for as long as is necessary to achieve the stated purposes or as statutory retention obligations apply (in particular Section 257 HGB, Section 147 AO - 6 to 10 years).
In particular, the following periods apply, among others:
fastic_country, fastic_region, fastic_city, ttclid, __oppref: 30 days; gclid: 90 daysYou can delete your account at any time in the app under "Settings → Account → Delete account" or on web.fastic.com under "Profile → Delete account". Deletion covers your personal data stored in our systems. Where third-party service providers keep their own copies of data as part of our processing (e.g. payment service providers, CRM, analytics and attribution services), deletion there takes place in accordance with the respective retention periods of these providers or upon your separate request. Statutory retention obligations (in particular invoice and tax data, 6-10 years) remain unaffected. Deleting your account does not end an ongoing subscription: you cancel store subscriptions in the App Store or on Google Play, and web subscriptions on web.fastic.com.
You have the following rights towards us:
You can obtain information about the data stored about you as an encrypted ZIP file by sending a request to datenschutz@fastic.com.
You are not obliged to provide us with personal data. However, without certain information we cannot provide individual services: without onboarding information (e.g. height, weight, goal) we cannot calculate a personal fasting plan or calorie and nutrient targets, without registration (email address, telephone number or Apple, Google or Facebook account) we cannot provide a subscription across devices, and without payment and billing data we cannot conclude a paid contract. Information on medical conditions, allergies, intolerances and pregnancy is voluntary; without it, your plan and your recommendations will not be adapted to it.
The calculation of your personal fasting plan and your calorie and nutrient targets as well as the selection of content and recommendations take place automatically. They do not produce legal effects and do not similarly significantly affect you; they are not a decision within the meaning of Art. 22 GDPR.
Fastic is intended for persons aged 18 and over. Minors may only use the app with the consent of a parent or legal guardian. Paid contracts may only be concluded by persons of full age. If we become aware that personal data of minors has been collected without the required consent, we will delete it without undue delay. Please send any such information to datenschutz@fastic.com.
Right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on a balancing of interests pursuant to Art. 6(1)(f) GDPR; this also applies to profiling based on these provisions. In this case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You have the right to object at any time to the processing of your personal data for direct marketing purposes, with the result that the data will no longer be processed for these purposes.
In the event of discrepancies, the German version shall prevail.