Privacy Policy

English courtesy translation. In case of conflict, the German version (Impressum/AGB/Datenschutz) prevails.

As of: 10 September 2026 · Version 2026-09-10

1. Controller (store / platform operation)

Friends4Life.club by KERN|flip
Dahlemstr. 5
53359 Rheinbach
Germany
Email: hello@kernflip.com

For content and guest data in an individual book, the respective book operator (tenant) is responsible. We operate the technical platform and the store.

2. Data in the store purchase process

To perform the contract we process in particular: name, email, billing/shipping address, imprint details (for new setups), order line items, payment status (via the payment service provider, e.g. SumUp — without full card data held by us), optional notes and withdrawal requests. Legal basis: Art. 6(1)(b) GDPR (contract) and (c) (legal obligations).

3. Data on the platform (books)

Books may store, among other things, guestbook entries, media, events (including RSVP, menu, seating plan, optional Social Wall for projector display), trips, activities, Wi-Fi notes, business cards and SOS/pet cards. Details of processing in a given book are controlled by the book operator; the specific privacy notice of that book (guest/member pages) is decisive. We provide storage and technical operation. Legal bases may include consent (Art. 6(1)(a)), contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)).

3b. PINGCode (anonymous contact gateway)

PINGCode lets finders contact the book operator without seeing their phone number, email or guestbook. Public PINGCode pages (form, chat, thanks) intentionally do not link to the guestbook and show the friends4life platform imprint/privacy (this notice / our imprint) so the recipient stays anonymous.

Processed data may include topic, optional message, name, email, phone, optional location, form photos and — if chat is enabled — chat messages and chat photos. We obtain consent before submit (and an additional photo consent when photos are uploaded). Requests and related content are usually deleted after 48 hours without interaction (chat: idle timeout). Notifications to recipients and optionally to guests are sent by email and/or SMS. Optional newsletter signup for friends4life.club uses a separate double opt-in. Legal bases: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b)/(f) (providing the contact feature).

3a. Event Social Wall (optional integration)

Book operators may optionally enable a Social Wall for events (display e.g. on a projector via a secret link). No event RSVP data from guests is collected for the wall. Content sources may include:

  • public posts from connected social networks (phase 1: Instagram/Facebook/Meta and LinkedIn) via the book operator’s OAuth
  • selected book content (activities, trips, event photos) and manual posts, including multiple media items per post and moderation status
  • display settings (layout, theme, language, title/font, optional logo) and optional sponsor logos

Purpose: event atmosphere and coverage on a shared display surface. Legal bases: Art. 6(1)(a)/(b) GDPR (connecting accounts / use of booked event features) and (f) (legitimate interest in displaying public or approved content). When the wall page is loaded, fonts may be fetched from Google Fonts (IP transmission possible). The book’s privacy notice is decisive; we store OAuth tokens and wall posts on behalf of the book operator until disconnection/deletion.

4. Wahoo and Strava (optional integrations)

Members or fellow travellers in a book may optionally connect their Wahoo and/or Strava account or provide a Wahoo Live Share link. The connection occurs only upon the data subject’s explicit action and can be disconnected at any time.

Purpose of processing: Finished workouts/activities and — for Wahoo Live — ongoing tracks are intended to appear as routes and posts in Activities and in the travel journal so the club group can share memories and routes together. There is no use for advertising purposes and no sale of data to third parties.

Data typically processed:

  • OAuth access and refresh tokens and technical account/athlete identifiers
  • for Wahoo Cloud: workout metadata and movement data (e.g. FIT/GPX, distance, duration, sensor values) within the granted permissions
  • for Wahoo Live: retrieval of the publicly shared Live Share page (positions/track), storage of the link and status
  • for Strava: activity metadata and routes/streams (permissions including read, activity:read_all); optional webhooks for timely imports; import from the time of connection onward, no full history dump
  • club content derived therefrom (tracks, statistics, related posts) according to book/trip/activity visibility

Legal basis: Art. 6(1)(a) GDPR (consent by connecting or providing the live link) as well as (b) and (f) GDPR (use of booked club features / legitimate interest in technical provision). Withdrawal by disconnecting or removing the live link; imported content may additionally be deleted.

Recipients: During OAuth and API retrieval, data is transmitted to Wahoo Fitness or Strava, Inc. (USA). Their privacy notices apply; for transfers to the USA, appropriate safeguards (e.g. Standard Contractual Clauses) may apply. As platform operator, we store tokens and imported content on our systems (hosting) on behalf of the respective book operator.

Weather (Open-Meteo): For entries/activities with a place and time, weather data may be retrieved via Open-Meteo and cached (coordinates and timestamps, no account data). Purpose: displaying “weather at the place”; legal basis Art. 6(1)(f) or (b) GDPR.

5. Recipients / processing on our behalf

Payment processing via SumUp; hosting/email delivery via our service providers. Reach measurement in the store via Umami Cloud (Umami Software, Inc.; retrieval from cloud.umami.is, see section 9).

Optionally, and only when used by end users: Wahoo Fitness, Strava, Inc., Open-Meteo (see section 4), Meta/LinkedIn (event Social Wall), Google Fonts (wall title fonts), OpenAI (AI text features in books), OpenStreetMap/map CDNs, Microsoft Bookings (booking page, see section 12). There is no disclosure to third parties for advertising purposes.

6. Retention period

We retain order and invoice data in accordance with commercial and tax retention periods. Book content remains until the operator deletes it or the book is terminated, subject to legal retention. OAuth tokens for Wahoo/Strava remain stored until the connection is disconnected or the related record is deleted. Aggregated store usage statistics (Umami) are kept according to our Umami Cloud account settings or until deletion.

7. Your rights

You have rights of access, rectification, erasure, restriction, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. Contact: hello@kernflip.com. For data in a specific book, additionally contact the controller named there (imprint/privacy notice of the book).

8. Security

Transmission via TLS; sensitive credentials are hashed; selected secrets (including OAuth tokens) are stored encrypted or otherwise protected.

9. Cookies / technology

Technically necessary cookies: For the store, login, session and shopping cart we set technically required cookies or session data. Legal basis: Art. 6(1)(b) and (f) GDPR (performance of the contract / legitimate interest in secure operation). These cookies are required for use and are explained informatively in the cookie notice.

Fonts: Fonts (Outfit, Syne) are served locally from our servers. There is no retrieval via Google Fonts / fonts.googleapis.com; thus no IP address is transmitted to Google for font loading.

Reach measurement (Umami Cloud): On the store pages (including https://www.friends4life.club/books/store) we use the privacy-friendly analytics service Umami Cloud (Umami Software, Inc.). The tracking script is loaded from https://cloud.umami.is/script.js. According to the provider, Umami sets no cookies and stores no personal identifiers; anonymised or aggregated usage data is collected, in particular page views, referrer URL, browser, operating system, device type and approximate country of origin. Purpose: improvement and statistical evaluation of the store (which pages and offers are used). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement without profiling/advertising). On access, a connection to Umami’s servers is established; the IP address may be processed technically and (according to the provider) anonymised. Details and DPA: umami.is/privacy. Objection: browser settings (e.g. tracking protection / script blockers) or contact at hello@kernflip.com.

External media (optional): Embedded YouTube videos (youtube-nocookie.com) are loaded only after your express consent. Without consent, placeholders are shown. With consent, YouTube (Google Ireland Ltd. / Google LLC) may process technically required data (including IP address); details are in Google/YouTube’s privacy policy. Legal basis: Art. 6(1)(a) GDPR (consent), revocable via the cookie notice or browser data (localStorage key for media consent).

We do not set advertising cookies or tracking for advertising purposes in the store.

10. Partner / referral programme

For applicants and partners, the Partner Program Privacy notice and the Partner Participation Terms apply in addition.

Referral cookie: When visiting the store with a partner reference (parameter ?ref= or after entering a partner discount code), we technically store the partner code in session and cookie f4l_partner_ref (typically 30 days) for first-touch attribution. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in correct commission allocation) or (b) upon order. Without this cookie, referrals cannot be reliably attributed.

11. Feedback and support forms

Via the store page Feedback and Support you may send feedback or support requests. We process name, email, optional club name/customer number and the information you enter (e.g. rating, affected areas, problem description, device/browser) and technical metadata (time, IP address, user agent). Purpose: handling your message, traceability and communication regarding the ticket (ticket number, status, updates by email). Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contractual communication) and (f) (legitimate interest in product improvement and support). Tickets and related updates are stored as long as handling and reasonable traceability require, at longest until an erasure request, unless legal retention obligations apply. Contact: hello@kernflip.com.

12. Booking a meeting (Microsoft Bookings)

Via the store page Book a meeting you can schedule a short call about friends4life (events, tickets, club organization). Scheduling runs through Microsoft Bookings (Microsoft Ireland Operations Ltd. / Microsoft Corporation). Opening the page establishes a connection to Microsoft; when you book a slot, Microsoft processes the details required for the appointment (typically name, email, chosen time, optionally phone/message). We use the booking to organize the meeting and prepare for it. Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication at your request) and (f) (legitimate interest in being reachable for advice). Microsoft’s privacy notices apply. Booking is voluntary; alternatives are email or Feedback/Support.