Data protection is a particularly high priority for the management of the JOTOMI GmbH. The use of the Internet pages of the JOTOMI GmbH is possible without any indication of personal data; however, if a data subject wants to use special enterprise services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject.

As the controller, the JOTOMI GmbH has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.

1. Name and Address of the Controller

Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is:

JOTOMI GmbH
Riedstraße 9
88069 Tettnang
Germany

Email: info@jotomi.com
Website: www.jotomi.com

You can reach our data protection officer Joachim Raff at raff@jotomi.de.

Supervisory authority responsible for JOTOMI:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Postfach 10 29 32, 70025 Stuttgart, Königstraße 10a, 70173 Stuttgart

•  

2. External Hosting

This website is being hosted by an external service provider (hosting provider). The personal data recorded on this website are being stored on the servers of the hosting provider. This data may include IP addresses, metadata and communication data, website access data and other data generated by a website.

We are using the hosting provider to ensure a secure, fast, and efficient operation of our online services through a professional provider (Art. 6 Nr. 1 f GDPR).

Our hosting provider will process your data only insofar as required to fulfill its service obligations, and will follow our directives regarding this data.

We are using the following hosting provider:

ALL-INKL.COM – Neue Medien Münnich

To ensure GDPR compliant data processing, we concluded an agreement for contract data processing with our hosting provider.

3. Contacting JOTOMI

When you contact us by e-mail, telephone, or telefax, personal data is being processed. Your message and all personal data that is transferred within or with the message will be stored and processed on our side in order to process your request. We do not transfer any of this data to third parties without your consent.

We are processing personal data such as name, address, e-mail address, phone no. or fax no. of a data subject in compliance with the GDPR and the country-specific regulations that apply to JOTOMI.

4. Collection of general data and information

The website of the JOTOMI GmbH collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.

This general data and information is stored only by our hosting provider, not by JOTOMI GmbH. It is needed to (1) deliver the content of our website correctly, (2) ensure the long-term viability of our information technology systems and website technology, and (2) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack.

5. Routine deletion and blocking of personal data

Art. 6(1) lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services.

Is our company subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. Then the processing would be based on Art. 6(1) lit. d GDPR.

Finally, processing operations could be based on Article 6(1) lit. f GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator.

6. Storage period for personal data

The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of storage, or as far as this is granted by the European legislator or other legislators in laws or regulations to which the controller is subject to.

If the storage purpose is not applicable, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.

7. Cookies / Analysis

Cookies are text files that are stored in a computer system via an Internet browser. The Internet pages of the JOTOMI GmbH does not use cookies.

JOTOMI does not perform analysis or tracking on this website.

8. Rights of the data subject

a) Right of confirmation

Each data subject shall have the right granted by the European legislator to obtain from the controller the confirmation as to whether or not personal data concerning him or her are being processed. If a data subject wishes to avail himself of this right of confirmation, he or she may, at any time, contact any employee of the controller.

b) Right of access

Each data subject shall have the right granted by the European legislator to obtain from the controller free information about his or her personal data stored at any time and a copy of this information. Furthermore, the European directives and regulations grant the data subject access to the following information:

• • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing;

the existence of the right to lodge a complaint with a supervisory authority;

• where the personal data are not collected from the data subject, any available information as to their source;
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organisation. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to avail himself of this right of access, he or she may, at any time, contact any employee of the controller.

c) Right to rectification

Each data subject shall have the right granted by the European legislator to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

If a data subject wishes to exercise this right to rectification, he or she may, at any time, contact any employee of the controller.

d) Right to erasure (Right to be forgotten)

Each data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies, as long as the processing is not necessary:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• The data subject withdraws consent to which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing.
• The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.
• The personal data have been unlawfully processed.
• The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by the JOTOMI GmbH, he or she may, at any time, contact any employee of the controller. An employee of JOTOMI GmbH shall promptly ensure that the erasure request is complied with immediately.

e) Right of restriction of processing

Each data subject shall have the right granted by the European legislator to obtain from the controller restriction of processing where one of the following applies:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use instead.
• The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
• The data subject has objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by the JOTOMI GmbH, he or she may at any time contact any employee of the controller. The employee of the JOTOMI GmbH will arrange the restriction of the processing.

f) Right to data portability

Each data subject shall have the right granted by the European legislator, to receive the personal data concerning him or her, which was provided to a controller, in a structured, commonly used and machine-readable format. He or she shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means, as long as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.

In order to assert the right to data portability, the data subject may at any time contact any employee of the JOTOMI GmbH.

g) Right to object

Each data subject shall have the right granted by the European legislator to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her, which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on these provisions.

The JOTOMI GmbH shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

In order to exercise the right to object, the data subject may contact any employee of the JOTOMI GmbH. In addition, the data subject is free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use his or her right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling

Each data subject shall have the right granted by the European legislator not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her, as long as the decision (1) is not is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is not based on the data subject’s explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) it is based on the data subject’s explicit consent, the JOTOMI GmbH shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and contest the decision.

If the data subject wishes to exercise the rights concerning automated individual decision-making, he or she may, at any time, contact any employee of the JOTOMI GmbH.

i) Right to withdraw data protection consent

Each data subject shall have the right granted by the European legislator to withdraw his or her consent to processing of his or her personal data at any time.

If the data subject wishes to exercise the right to withdraw the consent, he or she may, at any time, contact any employee of the JOTOMI GmbH.

9. Legal basis of the processing

Article 6 I lit. a DS-GVO serves our company as the legal basis for processing operations in which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Article 6 I lit. b DS-GVO. The same applies to such processing operations that are necessary for the implementation of pre-contractual measures, for example in cases of inquiries about our products or services. If our company is subject to a legal obligation by which a processing of personal data becomes necessary, such as for the fulfillment of tax obligations, the processing is based on Art. 6 I lit. c DS-GVO. In rare cases, the processing of personal data might become necessary to protect vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were to be injured on our premises and as a result his or her name, age, health insurance data or other vital information had to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6 I lit. d DS-GVO.

Finally, processing operations could be based on Art. 6 I lit. f DS-GVO. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject are not overridden. Such processing operations are permitted to us in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (recital 47 sentence 2 DS-GVO).  

10. Legitimate interests in the processing pursued by the controller or a third party

If the processing of personal data is based on Article 6 I lit. f DS-GVO, our legitimate interest is the performance of our business activities for the benefit of the well-being of all our employees and our shareholders.

11. Duration for which the personal data are stored

The criterion for the duration of storage of personal data is the respective statutory retention period. After expiry of the period, the corresponding data is routinely deleted, provided that it is no longer required for the fulfillment or initiation of the contract.

12. Provision of personal data as statutory or contractual requirement; Requirement necessary to enter into a contract; Obligation of the data subject to provide the personal data; possible consequences of failure to provide such data

We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner).

Sometimes it may be necessary to conclude a contract that the data subject provides us with personal data, which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our company signs a contract with him or her. The non-provision of the personal data would have the consequence that the contract with the data subject could not be concluded.

Before personal data is provided by the data subject, the data subject must contact any employee. The employee clarifies to the data subject whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of non-provision of the personal data.

13. Existence of automated decision making

© 2023 JOTOMI GmbH

Last revision: August 2nd, 2023

Dictate⁺ Privacy Policy

1. General

The app Dictate⁺ is provided by JOTOMI GmbH („JOTOMI“). The contact details are:

JOTOMI GmbH

Riedstraße 9

88069 Tettnang

GERMANY

www.jotomi.de

info@jotomi.de

This privacy policy declares which personal data is collected while using the app, and which rights the user has.

2. Data acquisition / data processing

a) The app records speech as directed by the user, and sends it as an (optionally encrypted) audio file to a sharing destination which is configured and selected by the user. No data at all is being sent to JOTOMI, neither manually nor automatically, unless the user manually activates and uses the service ”Dictate⁺ Transfer”. JOTOMI explicitly makes a point of not collecting or receiving usage statistics or telemetry data.

b) Data is transmitted from the app to JOTOMI when the user explicitly wants to contact JOTOMI by e-mail with the “Support” button in the app; JOTOMI may receive the following data as part of the e-mail:

aa) E-mail address of the sender

bb) Name of the sender (if configured in the system settings of your device)

cc) Version number of the installed app

dd) Model and type of the device on which the app is installed

ee) Version number of the installed operating system

The user can manually remove the data referenced in cc) to ee) before sending the e-mail.

E-mail address and name of the sender will not be used for commercial or marketing purposes and will not be transmitted to third parties.

c) If the app terminates due to a technical error (“crash”), the user may be asked to send diagnostic information by e-mail to JOTOMI. This information does not contain personal information, only technical data about the error. The data will not be transmitted automatically, the user has the final decision if and which data is transmitted.

Diagnostic data that the user transmitted voluntarily will only be used to analyze the error and for continuous improvement of the app according to article 6 1. b), c) GDPR, and deleted after three years or earlier.

d) The app requires access to the microphone in order to record dictations. It will ask the user for permission to access the microphone on first launch to perform its primary function. If that permission is not granted, the app won’t be able to record anything. Recorded audio will only be transmitted outside the app upon request of the user. 

e) If the user activates “Siri”, Apple’s speech recognition service, to enter text in any of the app’s text entry fields, the respective speech recordings will be sent to Apple. The app has no influence on this process. The recordings that the user sends to Apple are transcribed there and returned as a displayable text. This process is governed by Apple’s privacy policy.

f) If the user wants to read a QR code, barcode, matrix code or other visual code into a dictation’s metadata, or wants to take a photo or scan a document to add to a dictation as an attachment, the app needs access to the camera of the device. Upon first use of this feature, the app will ask for permission to use the camera. Even if the user grants this permission, the app will not record, store or transmit photos or videos taken during visual code scanning. Photos or documents recorded as attachments will only be transmitted outside the app upon request by the user. 

g) The user can manually send dictations and attachments to pre-configured or manually configured sharing destinations such as e-mail, FTP servers, or cloud services. These sharing processes are not subject to this privacy policy, but governed by the privacy policy of the respective recipient and intermediate transfer agents.

h) When the user sets up a sharing destination to a file server, i.e. SFTP, FTP, WebDAV, and cloud services like Microsoft™ 365, Google Drive™, Dropbox™, then Dictate⁺ can theoretically read the files on that server to which the user has access. Dictate⁺ will not read any file contents on such servers. It may request lists of the items contained in folders during sharing destination setup in order to allow the user to pick a destination folder, and, as part of the upload process for each file, request a list of items in the destination folder to check if the file to be uploaded is already present. No data acquired from such a file server will be stored by Dictate⁺ on the user’s device or transmitted anywhere else.

i) If the user manually activates and uses the Dictate⁺ Transfer service, JOTOMI or a cloud service provider under contract with JOTOMI may receive and store encrypted dictations, attachments, and metadata as long as necessary to transfer the data to the recipient’s computer. All required encryption keys are held exclusively by the Dictate⁺ app and the recipient’s Dictate⁺ Transfer software. Therefore, the data is not readable by JOTOMI or the cloud service provider, and will not be shared with third parties.

3. Rights of the user:

The user has the right to access to his or her personal data, to request rectification or erasure of his or her personal data, to restrict the processing of his or her personal data, to object against processing his or her personal data, or to receive his or her personal data in a structured, commonly used and machine-readable format. By choosing to contact JOTOMI by e-mail, the user declares consent in the sense of article 6. 1. a) GDPR. This consent can be withdrawn anytime, which shall not affect the lawfulness of processing based on consent before its withdrawal.

The user can exercise these rights by contacting JOTOMI via e-mail. The authority responsible for supervising JOTOMI is:

Der Landesbeauftragte für den Datenschutz und 

die Informationsfreiheit Baden-Württemberg

Postfach 10 29 32, 70025 Stuttgart 

Königstraße 10a, 70173 Stuttgart

JOTOMI continuously checks and updates this privacy policy. It can change without explicit notification to the user.

Last update: 06/19/2023

JOTOMI GmbH