Privacy Notice fiveways App

Last updated 15.09.2026   

Privacy Notice for the fiveways App
 

1. General Information 

The protection of your personal data is important to us. This Privacy Notice explains which personal data we process in connection with your use of the fiveways app, the purposes for which such data is processed, the legal bases on which the processing is carried out, and the rights available to you under applicable data protection law, in particular the General Data Protection Regulation (GDPR). 

This Privacy Notice applies to the use of the fiveways app and all related features and services. 

1.1 Controller 

The controller responsible for the processing of personal data within the meaning of Article 4(7) GDPR is: 

SRH Berufsbildungswerk Neckargemünd GmbH 
Im Spitzerfeld 25 
69151 Neckargemünd 
Germany 

Phone: +49 (0) 6223 89-1010 
Fax: +49 (0) 6223 89-2126 
Email: info(at)fiveways.app 
Website: www.fiveways.app 

1.2 Legal Representatives 

SRH Berufsbildungswerk Neckargemünd GmbH is legally represented by: 

Sascha Lohwaßer, Stefan Medinger 
(Managing Directors) 

Shareholder: SRH Bildung GmbH 
Bonhoefferstr. 1 
69123 Heidelberg 
Germany 

Register Court: Mannheim Local Court 
Commercial Register No.: HRB 335376 

VAT identification number pursuant to Section 27a of the German VAT Act (Umsatzsteuergesetz): DE 174 981 459 

1.3 Data Protection Officer 

frankenDSB 
DatenschutzManufaktur GmbH 
Jörg Flierenbaum 
Unterer Steinberg 11 
97453 Schonungen 
Germany 
Email: datenschutzbeauftragter-srh@frankendsb.de 

1.4 App Publisher 

The fiveways app is made available by SRH Berufsbildungswerk Neckargemünd GmbH through the relevant app stores (Apple App Store and Google Play Store). 

SRH Berufsbildungswerk Neckargemünd GmbH 
Im Spitzerfeld 25 
69151 Neckargemünd 
Germany 

1.5 Classification of the fiveways App 

fiveways is a digital companion for students. The app supports users in addressing typical challenges of student life and developing personal skills. To this end, fiveways provides evidence-based content and interactive features covering topics such as stress and inner balance, self-management and time management, body and energy, relationships and communication, and future and career. Users can set their own priorities, engage with content and track their progress within the app. 

fiveways takes a resource-oriented and preventive approach by encouraging users to engage with typical challenges of student life at an early stage and to strengthen personal skills and resources. The app is not intended to prevent specific diseases or mental disorders. It has no medical intended purpose and, in particular, is not intended for the detection, diagnosis, monitoring, prediction, prognosis, treatment or alleviation of diseases or mental disorders. 

fiveways does not carry out medical or psychological assessments of users and does not provide diagnoses or individual treatment recommendations. The app is not a medical device within the meaning of Regulation (EU) 2017/745 (MDR) and is not a German Digital Health Application (Digitale Gesundheitsanwendung – DiGA) within the meaning of Section 33a of the German Social Code Book V (SGB V). 

The content and features of the app are not a substitute for medical, psychotherapeutic or other healthcare advice, diagnosis or treatment. In the event of an acute crisis or where professional support is needed, fiveways refers users to appropriate external points of contact and support services. 

2 Collection and Processing of Personal Data 

We process personal data only to the extent necessary to provide and enable the use of the fiveways app, to fulfil contractual or legal obligations, to pursue legitimate interests, or on the basis of your consent. The specific data processed depends on the features of the app you use and the information you provide. 

2.1 Registration and Account Data 

To create and manage your user account, we process the data required for this purpose. This includes in particular: 

• email address, 
• password or authentication data, 
• date and time of registration and account status, 
• information used to verify the user account, such as email verification or two-factor authentication, where applicable. 

For users whose access is associated with a university, educational institution or other cooperating organisation, we may additionally request information about the relevant institution. This may be necessary in particular where the email address used does not allow the institution to be clearly identified. 

2.2 Onboarding and Personalisation 

During onboarding, we collect information used to tailor the content displayed to your individual usage context. This includes in particular your preferred form of address, your stage of study, and selected topics and areas of interest that you would currently like to focus on. 

You can update this information at a later stage using the “Adjust recommendations” feature. Based on the current information selected by you, suitable content and features are suggested on the dashboard. 

This information is used solely to personalise the content of the app. It is not used to draw conclusions about your mental or physical health, your personality, or your actual level of competence. 

2.3 Personal Entries and Self-Assessments in Interactive Features 

In various areas of the app, particularly exercises, Mini Quests, Guides, checklists and reflection activities, users can voluntarily provide their own information. This may include notes, reflections, goals and plans as well as responses to questions for personal self-assessment. 

These features are intended solely for users’ own reflection and orientation. They may, for example, help users reflect on personal habits, preferences or their own experiences in everyday student life. The information provided is not used to medically or psychologically assess users, infer a health condition, or create personality or competence profiles. 

Certain entries may subsequently be displayed again within the app as part of retrospective views. Where such content is stored exclusively locally on the relevant end device, the specific content is not stored in the fiveways backend and cannot be accessed by fiveways, the relevant university or other organisations. 

Free-text fields and individual reflection activities may, in principle, also contain information falling within special categories of personal data within the meaning of Article 9 GDPR, such as information concerning physical or mental health. fiveways does not request such information for the purpose of medical or psychological assessment and does not use it for diagnostic purposes or to infer a health condition. 

2.4 Activity and Progress Data 

When you use the app, certain activity and progress data is recorded. This includes, in particular, completed content and activities, experience points (XP), levels, streaks and badges. This information is used to make your progress within the app visible and to provide gamified progress features. 

For multi-part content such as Guides, the app also shows which content has already been completed and the progress made within the relevant Guide. 

The app also contains an overall progress display referred to as the “Competence Profile”. It reflects your usage progress across the five fiveways topic areas. The levels displayed are based exclusively on the extent to which content and activities have been completed within the respective topic area. 

The Competence Profile does not measure users’ actual level of personal competence and does not constitute a psychological, medical, diagnostic or other qualitative assessment. Personal free-text entries, reflection content, responses and other information provided within interactive features are not analysed for this purpose. 

2.5 Technical Usage Data 

When you use the app, technical information is processed to the extent necessary to provide the app and ensure its secure and stable operation. This includes, in particular, device information, operating system and app version, language settings, technical connection data including the IP address, date and time of access, and error and security-related log data. 

This data is processed in particular for the technical provision of the app, error analysis and ensuring IT security. 

2.6 Communications and Push Notifications 

We may send emails that are necessary for the provision and management of your user account, for example in connection with registration, verification, password resets, security or important information concerning the use of the app. 

In addition, users may voluntarily consent to receiving further email communications. These may include information, suggestions and news relating to fiveways. Consent may be withdrawn at any time with effect for the future, for example using the unsubscribe option provided in the relevant email. 

If users enable push notifications, the device and/or push information required for technical delivery is processed. Permission to receive push notifications is requested via the operating system and can be changed at any time in the device settings. 

2.7 Analytics and Tracking 

We use analytics and tracking technologies to analyse the use of the fiveways app and continuously improve it. Where consent is required for such processing, it is carried out only on the basis of your prior consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25 TDDDG. 

2.7.1 Matomo 

For the purpose of analysing and improving the fiveways app, we use Matomo only with your prior consent. The legal basis for accessing or storing information on your end device is Section 25(1) TDDDG. The subsequent processing of personal data is based on your consent pursuant to Article 6(1)(a) GDPR. 

In this context, technical device and app information, operating system, language settings, a truncated or anonymised IP address, approximate location information derived from the IP address, and information about your use of the app may be processed. This may include, for example, areas and content accessed, the use of individual features, and the time and duration of use. In addition, a pseudonymous visitor identifier may be processed. 

The information collected is used exclusively to analyse and improve the app and is not combined with directly identifiable account data such as your email address. Personal entries, free-text content or responses provided as part of reflection activities are not analysed using Matomo. 

Processing takes place on servers located in Germany. Session replays, heatmaps or comparable technologies are not used. 

2.7.2 Marketing Tracking 

To measure and optimise our marketing activities, we use technologies provided by Meta and TikTok in the fiveways app subject to your prior consent. 

Certain events relating to the use of the app are recorded and transmitted to Meta and/or TikTok. These include the first launch of the app following installation, completion of registration and subsequent app launches. In connection with these events, information processed may include the time of the event, device and advertising identifiers, device and app information, and technical connection information such as IP address, language and time zone. 

Names, email addresses, personal entries or information about the content and topics used within fiveways are not transmitted as part of this tracking. In particular, no health-related information is transmitted. Contact data matching (“Advanced Matching”) is not used. 

The tracking technologies of Meta and TikTok are activated only after prior consent has been given. The legal basis for accessing or storing information on the end device is your consent pursuant to Section 25(1) TDDDG. The subsequent processing of personal data is based on your consent pursuant to Article 6(1)(a) GDPR. Without your consent, the relevant tracking technologies remain deactivated; the use of fiveways is not dependent on your consent. 

The recipients of the data are Meta Platforms Ireland Limited and TikTok Technology Limited, both based in Ireland. Where personal data is transferred to countries outside the European Economic Area, such transfers take place only where the legal requirements are met. This may, in particular, be based on an adequacy decision by the European Commission or appropriate safeguards pursuant to Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses. You may request information about the safeguards used in each case via the contact details provided above. 

Further information on the processing of personal data by Meta and TikTok can be found in the respective providers’ privacy notices. 

Withdrawal of Consent and Deletion of Marketing Data 

Consent to marketing tracking may be withdrawn at any time with effect for the future via the relevant settings within the fiveways app. Where marketing tracking on iOS requires system-level permission, this permission is additionally obtained through the relevant operating system settings and can be changed there at any time. 

Following withdrawal of consent, the Meta and TikTok tracking technologies will no longer be used for the further collection and transmission of marketing data. Data already transmitted to Meta or TikTok is processed by the respective provider in accordance with its own privacy and deletion policies. Information and options for managing or deleting such data are available in the privacy and account settings provided by Meta and TikTok. 

2.7.3 Managing Your Consent 

Consent to consent-based analytics and tracking is voluntary. You may change or withdraw consent at any time with effect for the future via the privacy settings within the app or using the respective withdrawal option provided. 

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. 

2.8 Purposes of Processing 

We process personal data in particular for the following purposes: 

• providing and operating the fiveways app, 
• managing your user account, 
• providing personalised content and features, 
• providing support for everyday student life and promoting self-management and well-being, 
• storing your personal content and exercises, 
• communicating with you, 
• sending service emails and push notifications, 
• sending newsletters and marketing communications where you have provided the relevant consent, 
• analysing and further developing our services, 
• ensuring IT security and preventing misuse, 
• complying with legal obligations. 

3 Legal Bases for Processing 

We process personal data only where there is a legal basis for doing so under the GDPR. Depending on the purpose of processing, the following legal bases may apply in particular: 

3.1 Performance of a Contract and Provision of the App 

Where the processing of personal data is necessary to provide and enable the use of the fiveways app and to manage your user account, processing is carried out on the basis of Article 6(1)(b) GDPR. 

This applies in particular to registration and management of the user account and to the provision of the app features used by you. 

3.2 Consent 

Where we store or access information on your end device for analytics or marketing purposes, this is carried out on the basis of your consent pursuant to Section 25(1) TDDDG. The subsequent processing of personal data is based on your consent pursuant to Article 6(1)(a) GDPR. 

Voluntary email communications, in particular newsletters and information about fiveways, are sent on the basis of your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. 

3.3 Legitimate Interests 

Where processing is necessary for the purposes of our legitimate interests or those of a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, processing is carried out on the basis of Article 6(1)(f) GDPR. 

This may apply in particular to processing necessary to ensure the security and stability of the app, prevent misuse, or establish, exercise or defend legal claims. 

3.4 Legal Obligations 

Where we are legally required to process or retain personal data, processing is carried out on the basis of Article 6(1)(c) GDPR. 

This applies in particular to statutory retention and documentation obligations and compliance with orders issued by competent public authorities. 

3.5 Special Categories of Personal Data 

The fiveways app is not designed to specifically collect special categories of personal data within the meaning of Article 9 GDPR. However, users may voluntarily enter information in free-text fields which, in individual cases, may include special categories of personal data. 

Such information is not used for medical or psychological assessment, diagnostic purposes, to infer a health condition, or to create the Competence Profile. 

Where users voluntarily enter special categories of personal data in free-text fields or reflection activities that are stored on servers and such data is processed by us, the processing is carried out exclusively on the basis of explicit consent pursuant to Article 9(2)(a) GDPR. 

4 Service Providers 

We use external service providers to provide and operate the fiveways app and to send emails. Where these service providers process personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR, where the relevant requirements are met. 

4.1 Technical Development and Operation of the App 

We use the following technical service provider for the technical development, provision and maintenance of the fiveways app and operation of the backend: 

Bornholdt Lee GmbH 
ABC-Straße 21 
20354 Hamburg 
Germany 

Data Protection Officer of Bornholdt Lee GmbH: 
Sebastian Hertig 
Hertig Oberbeck Datenschutz GmbH 
Hallerstraße 76 
20146 Hamburg 
Germany 

Where the service provider processes personal data in this context, it does so on our behalf pursuant to Article 28 GDPR. 

4.2 Email Delivery via Brevo 

We use Brevo, a service provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, to send emails. 

In connection with email delivery, the email address and the information required for sending and technically delivering the relevant email are processed in particular. 

5 Disclosure of Personal Data 

Personal data is disclosed only where this is necessary to provide the fiveways app, where an appropriate legal basis exists, or where we are legally required to do so. 

5.1 Processors 

We use external service providers to provide and operate the fiveways app. Where these service providers process personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR. 

The service providers currently used are listed in Section 4 of this Privacy Notice. 

5.2 Universities and Organisations 

Where you use fiveways in connection with a university, educational institution or other organisation, your user account may be associated with the respective organisation. Personal notes, reflections, free-text entries or other personal information, such as usage, activity, progress or profile data, will not be disclosed to the respective organisation. 

5.3 Legal Obligations 

Personal data may be disclosed to public authorities, courts or other public bodies where we are legally required to do so or where disclosure is required by an applicable administrative or court order. 

6 Retention and Deletion 

We retain personal data only for as long as necessary for the respective purposes or where statutory retention obligations apply. Once the purpose of processing no longer applies, personal data is deleted or anonymised unless statutory or other lawful grounds require or permit further retention. 

6.1 User Account 

Data required for the user account is generally retained for the duration of your use of fiveways. 

Following deletion of the user account, the associated personal data is deleted unless statutory retention obligations or other legal grounds require further retention. 

6.2 Personal Entries and Progress Data 

Personal entries and progress data are generally retained for as long as they are required to provide the relevant features within the app. 

Where personal content is stored exclusively locally on the end device, such content is not stored in the fiveways backend. The deletion of data stored locally depends on the relevant technical configuration of the app and the end device. 

6.3 Analytics and Technical Data 

Analytics and technical usage data is retained only for as long as necessary for the respective purpose. For consent-based analytics, the retention and deletion periods specified for the relevant analytics method apply. 

6.4 Communications and Log Data 

Communication data is retained only for as long as necessary to handle the relevant matter and to comply with any applicable statutory documentation or retention obligations. 

Technical log data is retained only for the period necessary for operation, error analysis and IT security. 

6.5 Deletion 

Where the relevant purpose of processing no longer applies or the user account is deleted, the personal data concerned is deleted unless statutory retention obligations or other legal grounds prevent deletion. 

User accounts for which no login has occurred for a period of six months may be deleted due to inactivity. Before deletion, users will be notified by email and given the opportunity to prevent deletion by logging in again within 14 days. If no login occurs within this period, the user account and the personal data associated with it will be deleted unless statutory retention obligations or other legal grounds require further retention. 

7 Rights of Data Subjects 

As a data subject, you have the following rights under the GDPR in particular: 

• right of access pursuant to Article 15 GDPR, 
• right to rectification pursuant to Article 16 GDPR, 
• right to erasure pursuant to Article 17 GDPR, 
• right to restriction of processing pursuant to Article 18 GDPR, 
• right to data portability pursuant to Article 20 GDPR, where the statutory requirements are met, 
• right to object pursuant to Article 21 GDPR, where the statutory requirements are met, 
• right to withdraw consent pursuant to Article 7(3) GDPR with effect for the future, 
• right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR. 
• the supervisory authority responsible for us is, in particular: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg 
  (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, Phone: +49 (0) 711 615541-0, Email: poststelle@lfdi.bwl.de, Website: https://www.baden-wuerttemberg.datenschutz.de 

To exercise your rights, you may contact us or our Data Protection Officer at any time using the contact details provided in this Privacy Notice. Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. 

For personalisation purposes, only the information you have selected regarding your stage of study, topics and areas of interest is processed automatically in order to suggest relevant content. This personalisation does not produce any legal effects concerning you or similarly significantly affect you. No decision based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place. 

8 Data Security 

We implement appropriate technical and organisational measures pursuant to Article 32 GDPR to protect personal data against loss, destruction, unauthorised access, unauthorised alteration or disclosure. 

These security measures are regularly reviewed and adjusted where necessary, taking into account the state of the art, the nature and scope of processing, and the associated risks. 

9 Changes to this Privacy Notice 

We may amend this Privacy Notice where legal, technical or organisational circumstances or the processing of personal data within the fiveways app change. 

The current version is available within the app and on the designated website. 

Where changes materially affect the processing of personal data or users’ rights, we will provide appropriate notice. Where consent is required for changed processing activities, the relevant consent will be obtained.