Privacy Policy for the FutureBens Mobile App

This Privacy Policy applies to the Android and iOS apps “FutureBens: Employee Discounts,” which appear on the device under the name “FutureBens” (package name: co.futurebens). It supplements FutureBens’ general Privacy Policy available at https://www.futurebens.co/datenschutz. To the extent that provisions apply specifically to the mobile app, this Privacy Policy shall prevail.

1. Data Controller and Contact Information

The entity responsible for processing personal data in the mobile app is:

FutureBens GmbH
Albrechtstr. 19
10117 Berlin
Germany

Data Protection Contact: hi@futurebens.co

If you have any questions about the processing of your data or about exercising your data protection rights, you can contact us using this contact information. To prevent unauthorized requests, we may require you to provide appropriate proof of your identity.

2. Purpose and Functionality of the App

FutureBens provides eligible employees with personalized company offers, employee benefits, discount information, and discount codes. To this end, the app enables users to register, log in via email or one-time password (OTP), view offers, and receive and manage notifications.

The app is not intended for children. It is intended for adult users who have access to FutureBens based on their employment status or appropriate authorization.

3. What Data We Process

3.1 Registration and Account Information

When you create or manage an account, we may process the following data:

• First and last name;
• Email address;
• Password in encrypted form;
• Phone number, if you choose to provide it;
• Street, ZIP code, city, and country, if you choose to provide them;
• Company, company identifier, and affiliation with an accredited organization;
• Registration code and type of email address used, to the extent necessary to verify your eligibility;
• Your acknowledgment of the privacy policy;
• Your newsletter subscription preferences.

Required information is necessary to set up the account, verify your eligibility, and provide the service. You may omit information marked as optional.

3.2 Registration and Session Dates

To register for and manage your session, we process the following information in particular:

• Email address and one-time password (OTP);
• internal user and member IDs;
• Authentication and session tokens, as well as their expiration times;
• The timing and results of login, registration, and logout procedures.

The session token is stored on the device in the operating system's secure credential store. Passwords and OTP codes are not stored in plain text in our activity logs.

3.3 Equipment and Technical Specifications

When you sign in and use the app, we may process the following technical data:

• Operating system and platform;
• Device model;
• Screen width and screen height in pixels;
• App version and technical information about the app;
• IP address and technical query information, to the extent that such information is generated during the operation of our servers or by our service providers;
• Firebase installation ID and Firebase Cloud Messaging token (FCM token);
• App language settings and notification registration status.

We use this information to provide the app, support its display on various devices, investigate errors and misuse, and deliver notifications. The app does not request access to GPS location data, contacts, call logs, text messages, the camera, or the microphone.

3.4 Usage and Activity Data

To provide, secure, and support the service, we may log the following activities:

• Login attempts, successful logins, registrations, and logouts;
• Requirements for discount codes and reaching technical usage limits;
• affiliated company and the displayed product or brand name;
• Search terms used in the company search during registration, to the extent that they are transmitted to the server for processing the search request;
• Retrieval, delivery, and read status of notifications;
• Date, time, status, and technical error details for requests.

Search terms are processed to provide the search functionality. Security and activity logs may be linked to your account to track access, enforce usage limits, and investigate support or security incidents.

3.5 Notifications

The app uses Firebase Cloud Messaging and local notification features to display service-related messages, new offers, or other FutureBens announcements. In particular, the following data may be processed: FCM tokens, Firebase installation ID, platform, language, app version, notification content, and interaction status.

You can disable system notifications in your device's settings. Notifications within the app may still appear if they are part of the service.

3.6 Local Storage on the Device

The app stores only the information necessary for its operation locally, specifically:

• the session token in the operating system's secure credential store;
• technical status information indicating whether permission to send notifications has already been requested;
• temporary information about opening a notification;
• App data and cache files required for technical purposes.

This local data can be removed by signing out, clearing the app's data, or uninstalling the app. Uninstalling the app alone does not automatically delete your FutureBens account from the server.

3.7 Data That the App Does Not Process

The app does not process any payment or credit card information and does not facilitate any in-app purchases. If you open a partner company’s website via a promotional link, the privacy policy of that partner company applies to the processing of your data and any purchases made there.

The app does not collect precise GPS location data, call or text message logs, contacts, photos, videos, files, health data, or advertising IDs for its own advertising profiles.

4. Purposes and Legal Bases

We process personal data primarily for the following purposes:

• Setting up and managing your account, as well as verifying your access privileges;
• Completing the login process and maintaining a secure session;
• Providing personalized company offers, discount information, and discount codes;
• Provision of in-app and push notifications;
• Handling support requests and technical issues;
• Protection against misuse, unauthorized access, and fraudulent activities;
• Compliance with legal obligations and enforcement of legal claims;
• Sending a newsletter or other marketing communications, provided you have given your consent.

To the extent that the GDPR applies, the processing is based, depending on the purpose, on:

• Art. 6(1)(b) of the GDPR, to the extent that it is necessary for the provision of the service, the performance of a contract, or the implementation of precontractual measures;
• Art. 6(1)(a) of the GDPR, to the extent that you have provided consent, in particular for optional marketing communications;
• Article 6(1)(f) of the GDPR, based on our legitimate interests in ensuring the secure, reliable, and user-friendly operation of the app, as well as in error analysis, support, and the prevention of misuse;
• Art. 6(1)(c) of the GDPR, to the extent that the processing is necessary to comply with a legal obligation.

You may revoke your consent at any time, effective for the future. The lawfulness of the processing carried out up to the time of revocation remains unaffected.

5. Recipients and Service Providers

We disclose personal data only to the extent necessary for the purposes described, where there is a legal basis for doing so, or where you have given your consent. Recipients may include, in particular:

• Memberstack for account and member management;
• Google Firebase Cloud Messaging and Firebase Install for the technical delivery of push notifications;
• Webflow and related platform services for business, membership, and content processes, to the extent they are used;
• Hosting, database, email, maintenance, and IT security service providers;
• the administrator of your authorized organization, to the extent necessary for managing access and providing support;
• Government agencies, courts, or other entities, if we are legally required to disclose information;
• Acquirers or advisors in connection with a restructuring, merger, or acquisition, in compliance with applicable data protection requirements.

Service providers who process data on our behalf are contractually obligated to process the data only in accordance with our instructions and using appropriate security measures.

6. International Data Transfers

Some service providers may process data outside the European Economic Area. In such cases, we use the safeguards provided for under applicable data protection law, such as an adequacy decision, the European Commission’s standard contractual clauses, and supplementary technical or organizational measures, as necessary.

7. Retention Period

We do not store personal data for longer than is necessary for the respective purpose:

• Account and profile information is generally stored for the duration of your account;
• Session data is stored until the session expires, the user logs out, or the session is invalidated for technical reasons;
• Device and notification tokens are processed until the user logs out, the device is unregistered, the account is deleted, or the tokens become technically invalid;
• Activity, security, and error logs are stored only as long as necessary for operations, support, abuse prevention, and the enforcement of usage limits;
• Data that is subject to statutory retention requirements or that is necessary for the assertion, exercise, or defense of legal claims may be retained for the period permitted by law.

Once the applicable retention period has expired, the data will be deleted or anonymized.

8. Account Deletion and Data Deletion

You may request the complete and permanent deletion of your FutureBens account and the associated personal data at any time.

In the app, select More → Delete Account. This will open the publicly accessible page where you can request the deletion of your account. You can also go directly to the page:

https://www.futurebens.co/account-deletion

Upon receipt of your request, we will verify your identity to prevent unauthorized deletions. We will then delete or anonymize the account and the associated data in our systems and, if necessary, instruct our data processors to do the same. Data may only continue to be retained if and as long as there is a legal obligation or another permissible reason to do so, such as for fraud prevention, security, or the defense of legal claims. In this case, the data will be blocked and not used for any other purposes.

Simply deactivating or suspending an account does not constitute account deletion.

9. Data Security

We take appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, alteration, and disclosure. These measures include, in particular, encrypted transmission via TLS/HTTPS, access restrictions, authentication and authorization protocols, logging of security-related events, and the secure storage of the session token on the device.

No method of electronic transmission or storage is completely risk-free. We therefore review and improve our security measures in line with technological developments and the specific risks involved.

10. Your Rights

Provided that the legal requirements are met, you have the right, in particular, to:

• Information about the data processed regarding you;
• Correction of inaccurate or incomplete data;
• Deletion of Your Data;
• Restriction of processing;
• Data portability;
• Objection to processing based on legitimate interests;
• Withdrawal of consent that has already been given, effective for the future;
• File a complaint with a competent data protection supervisory authority.

In the case of direct marketing, you may object to the processing at any time without providing a reason.

11. Third-Party Links and Offers

The app contains links to websites and offers from partner companies. Once you open such a link, the privacy policy of the respective provider applies. FutureBens is not responsible for the privacy practices of independent third-party providers. Please review their privacy policies before entering personal information or making a purchase on their sites.

12. Changes to This Privacy Policy

We may update this Privacy Policy if the app, our data processing practices, or legal requirements change. The most current version will be posted in the app and on our website. In the event of material changes, we will notify you in an appropriate manner.

13. Contact

FutureBens GmbH
Data Protection Officer
Albrechtstr. 19
10117 Berlin
Germany

Email: hi@futurebens.co