Wullup

Last Updated: 04.06.2025

1. Introduction and Legal Basis

This Data Protection Policy outlines how Wullup processes personal data in compliance with the General Data Protection Regulation (GDPR), German Federal Data Protection Act (BDSG), and other applicable data protection laws.

Our servers are hosted by netcup.de in Germany, ensuring data remains within EU jurisdiction and benefits from strong European data protection standards.

2. Data Controller Information

Data Controller: Wullup GmbH Im Vogelsang 14
35452 Heuchelheim
Germany Email: admin@wullup.com

3. Legal Basis for Data Processing

Consent (Article 6(1)(a)): Analytics, marketing communications, optional features
Contract Performance (Article 6(1)(b)): Account management, service delivery
Legal Obligation (Article 6(1)(c)): Compliance, safety reporting, tax obligations
Legitimate Interests (Article 6(1)(f)): Security, fraud prevention, service improvement

3.2 Special Category Data (Article 9)

When processing special categories of personal data:

Explicit consent obtained for sensitive data collection
Processing necessary for substantial public interest (safety)
Data subject made information manifestly public

4. Data Collection and Categories

4.1 Personal Data Categories

Identity Data: Username, display name, profile information
Contact Data: Email address, phone number (if provided)
Technical Data: IP address, browser type, device information
Usage Data: Platform interactions, content engagement, preferences
Content Data: Posts, comments, music uploads, playlists

4.2 Special Categories

Biometric Data: Voice recordings (for music content only)
Health Data: Mental health crisis detection (for safety purposes)
Political/Religious Views: If expressed in music preferences or content

4.3 Data Sources

Direct collection from users
Automatic collection through platform use
PostHog analytics integration
Third-party authentication services
Public sources (social media profiles, music databases)

5. Purposes of Data Processing

5.1 Primary Service Functions

User account creation and management
Music content delivery and recommendations
Social networking features
Platform security and safety
Customer support and communications

5.2 Analytics and Improvement

Platform performance analysis via PostHog
User experience optimization
Feature development and testing
Business intelligence and reporting

5.3 Legal and Safety Obligations

Child safety protection measures
Copyright infringement prevention
Legal compliance and reporting
Fraud prevention and security

6. PostHog Analytics Integration

6.1 Data Collected by PostHog

User interaction events
Page views and navigation patterns
Feature usage statistics
Performance metrics
Error tracking and debugging data

6.2 PostHog Data Processing

Data processed within EU (GDPR compliant)
Anonymization and pseudonymization applied
Retention limited to 24 months maximum
User opt-out available through privacy settings

6.3 Purpose Limitation

PostHog data used exclusively for:

Product improvement and optimization
Technical performance monitoring
User experience enhancement
Security and error detection

7.1 Authorized Recipients

Netcup.de: Server hosting and infrastructure (Germany)
PostHog: Analytics platform (EU-based processing)
Music Partners: Licensed content delivery
Moderation Services: Content review for safety compliance
Legal Authorities: When required by law

7.2 Data Transfer Safeguards

Standard Contractual Clauses (SCCs) for third-party processors
Adequacy decisions for transfers to approved countries
Additional safeguards for high-risk transfers
Regular review of transfer impact assessments

7.3 International Transfers

Primary data processing within EU/EEA
Limited transfers outside EU only with adequate protection
User notification of any significant processing location changes
Right to object to international transfers

8. Data Retention and Deletion

8.1 Retention Periods

Active Account Data: Retained while account remains active
Inactive Accounts: Deleted after 24 months of inactivity
Content Data: Removed within 30 days of user deletion request
Analytics Data: Anonymized after 24 months, deleted after 5 years
Legal Compliance Data: Retained as required by applicable laws

8.2 Deletion Procedures

Automated deletion processes for expired data
Secure deletion methods preventing data recovery
Backup system integration for complete removal
Verification procedures for successful deletion

8.3 Exceptions to Deletion

Data may be retained longer for:

Legal proceedings and investigations
Safety and security purposes
Regulatory compliance requirements
Protection of rights and interests

9. Data Subject Rights

9.1 Access Rights (Article 15)

Right to confirmation of data processing
Access to personal data copies
Information about processing purposes and recipients
Details of retention periods and rights

9.2 Rectification (Article 16)

Correction of inaccurate personal data
Completion of incomplete data
User-accessible profile editing tools
Verification procedures for sensitive changes

9.3 Erasure/Right to be Forgotten (Article 17)

Account deletion with complete data removal
Content deletion upon user request
Automated deletion of expired data
Exceptions for legal compliance and public interest

9.4 Restriction of Processing (Article 18)

Temporary suspension of data processing
Limited processing for specific purposes
User notification before restriction removal
Secure storage during restriction period

9.5 Data Portability (Article 20)

Machine-readable data export
Direct transfer to other services where possible
Comprehensive data package including all user content
Secure transfer procedures

9.6 Objection Rights (Article 21)

Objection to processing based on legitimate interests
Opt-out of direct marketing
Objection to automated decision-making
Balancing test for compelling legitimate grounds

10. Privacy by Design and Default

10.1 Technical Measures

Encryption of data in transit and at rest
Pseudonymization of personal data where possible
Access controls and authentication systems
Regular security updates and patches

10.2 Organizational Measures

Staff training on data protection principles
Privacy impact assessments for new features
Data protection by default settings
Regular compliance audits and reviews

10.3 Minimization Principles

Collection limited to necessary data only
Purpose limitation strictly enforced
Storage limitation with defined retention periods
Processing minimization through anonymization

11. Security Measures

11.1 Technical Security

AES-256 encryption for sensitive data
TLS 1.3 for data transmission
Multi-factor authentication options
Regular penetration testing
Automated threat detection systems

11.2 Access Controls

Role-based access permissions
Principle of least privilege
Regular access reviews and updates
Secure authentication for staff access
Activity logging and monitoring

11.3 Incident Response

24-hour breach detection capabilities
Incident response team and procedures
User notification within 72 hours if required
Regulatory notification within 72 hours
Post-incident review and improvement

12. Automated Decision-Making

12.1 Automated Processing Activities

Content recommendation algorithms
Safety and security monitoring
Spam and abuse detection
Music preference analysis

12.2 User Rights and Protections

Right to human review of automated decisions
Explanation of algorithmic logic where significant
Right to challenge automated decisions
Opt-out options for non-essential automated processing

13. Cross-Border Data Flows

13.1 Primary Processing Location

Main servers located in Germany (netcup.de)
EU/EEA data processing preference
Local data residency options where required
Compliance with national data localization laws

13.2 Transfer Mechanisms

Standard Contractual Clauses for EU transfers
Adequacy decisions for approved countries
Binding Corporate Rules for group companies
Specific derogations for necessary transfers

14. Vendor and Processor Management

14.1 Processor Selection Criteria

GDPR compliance capabilities
Technical and organizational security measures
Data protection track record
Location and jurisdiction considerations

14.2 Data Processing Agreements

Comprehensive DPA requirements
Regular processor audits and assessments
Incident notification procedures
Data subject rights facilitation

14.3 Processor Monitoring

Regular compliance reviews
Security assessment requirements
Performance monitoring and reporting
Termination procedures for non-compliance

15. Supervisory Authority Relations

15.1 Lead Supervisory Authority

German Federal Commissioner for Data Protection and Freedom of Information Graurheindorfer Str. 153 53117 Bonn, Germany Email: poststelle@bfdi.bund.de

15.2 Cooperation Procedures

Proactive engagement with regulators
Voluntary compliance reporting
Cooperation with investigations and inquiries
Implementation of regulatory guidance

16. Training and Awareness

16.1 Staff Training Programs

Mandatory GDPR training for all employees
Role-specific data protection training
Regular updates on regulatory changes
Incident response training exercises

16.2 User Education

Privacy policy explanations and guides
Data protection rights information
Security best practices recommendations
Regular communication about privacy updates

17. Compliance Monitoring

17.1 Regular Assessments

Annual data protection compliance audits
Privacy impact assessments for new features
Vendor compliance reviews
User rights fulfillment monitoring

17.2 Continuous Improvement

Regular policy updates based on legal changes
Implementation of regulatory guidance
User feedback integration
Technology and security updates

18. Contact and Complaints

18.1 Data Protection Contacts

General Inquiries: admin@wullup.com
Data Protection Officer: admin@wullup.com
User Rights Requests: admin@wullup.com
Security Incidents: admin@wullup.com

18.2 Complaint Procedures

Internal complaint handling process
Response within 30 days for rights requests
Escalation procedures for complex issues
Right to lodge complaints with supervisory authorities

19. Policy Updates and Changes

19.1 Regular Reviews

Annual policy review and updates
Updates following regulatory changes
Technology and business change adaptations
User feedback integration

19.2 Change Communication

30-day advance notice for material changes
Clear explanation of changes and impacts
User consent re-collection where required
Continued use as acceptance for non-material changes