girl in berlingirl in berlingirl in berlingirl in berlin

Privacy policy

Last updated: 19.12.2023

Welcome to our privacy policy! It is detailed… but we’d recommend you read it in full so you know exactly what we do with data here at Tandem. If you’re pressed for time, here are the key points:

  • We don’t monitor, record or store the contents of your audio calls, video calls or Tandem Party conversations. We do store messages, message information like timestamps and your Topics, but these will not be shared with any third parties unless required by law.
  • You can download, edit or permanently delete your personal data at any time. Your personal data is accessed through the “My Profile” tab.
  • We keep your data on secured and restricted database servers. We do everything we can to keep your data secure and encrypted between your device and our servers. Tandem is a global community and we may store data on servers outside your home country. Please note that encryption is not supported in China.
  • We reserve the right to restrict access to Tandem in the event of misconduct. Providing a safe and friendly community for language learners is our top priority. We therefore take reports of abuse very seriously. Reports of misconduct on Tandem are reviewed by human moderators and can lead to a ban from our app. Please note that you can choose to share messages with our moderators only as part of the reporting process.

PRIVACY POLICY

This statement details how we handle personal data here at Tandem, if you use our mobile apps or website. We are respectful of the data that is shared with us by our members and take protecting it very seriously.

Tandem is made in Germany and as a company based in the European Union we are firmly committed to meeting and often exceeding European data protection standards for all our members wherever possible.

Please take the time to read these details to fully understand how we handle your data and keep it safe.

Contact

Tripod Technology GmbH
Represented by Arnd Aschentrup and Tobias Dickmeis
Bölschestr 21
30173 Hannover
Germany

You can reach out to us directly via support@tandem.net.

External Data Protection Officer

ePrivacy GmbH
Represented by Prof. Dr. Christoph Bauer
Burhardstraße, 14
20095 Hamburg

For all requests concerning the security of your data, please contact our privacy team and our data protection officer at privacy@tandem.net.

If you have a particularly sensitive request, please contact our data protection officer by postal mail, as communication by email can always be flawed by security vulnerabilities. When making your request, please state that your request relates to Tripod Technology GmbH.

1. Personal Data

Personal data is all information about an identified or identifiable person. This includes the following categories of personal data that we process:

  • Your contact details (such as first and last name, address, email address, location). We will never share your last name with other Tandem members.
  • Information within your profile (such as your age, gender, city),
  • Personal images you provide within your profile,
  • Information you share within your messages (images, voice messages, comments, correction, topics),
  • Your correspondence with us,
  • Log files with information about your visit to our website and apps,
  • Online identifiers (such as cookie IDs, IP addresses, advertising IDs),
  • Awards (such as language certificates),
  • Activity on our apps and websites (e.g. clicks, screens viewed, pages visited).
2. Purposes of Use

Personal data will only be collected by us to the extent and for the purpose for which you provide the data to us, e.g. for registering an account. We use and store your personal data as part of our services for the following purposes:

  • To create a public user profile for you on Tandem;
  • To provide a curated community just for language learners, where access is restricted to members only. We do our best to prevent abuse and ban offenders, as soon as we are made aware of abuse. Such control takes place, for example, by checking the authenticity of profile pictures you provide. This helps to increase the safety of the community and identify fraudulent accounts (e.g. scams). We conduct, for example, a comparison of hashed – thus no longer personally identifiable – profile photos with known images that scammers use or that have been flagged due to misuse on Tandem.
  • To send information relevant to the service, e.g. via email or push notification (e.g. updates on your membership status, missed calls/messages, new followers);
  • To target ads in the app (this can be turned off in settings);
  • To find Tandem partners nearby;
  • To understand how Tandem is used and optimize the service;
  • To help keep our community safe, friendly and accountable in both one-on-one chats, parties, clubs and group chats, including by encouraging authentic communication;
  • For corresponding with you;
  • For processing contracts with you;
  • For advertising purposes such as the dispatch of our newsletter;
  • On quality assurance and statistics;
  • For your participation in our competitions;
  • For your participation in our events;
  • For your participation in our surveys;
  • To consider your application for membership and for community moderation;
  • In order to improve our service;
  • We create a member profile for you on Tandem so that others can easily find and communicate with the most suitable language exchange partners. Only verified community members can discover and contact you through the Tandem app. We ensure your privacy by never displaying your email address, exact location, last name, or any other information you choose not to share in your profile settings.

Otherwise, your personal data will not be shared with third parties unless you have given explicit consent or we are obligated to disclose it – for example, on the instruction of a court or an administrative authority. To provide functionality and for usage analysis and marketing purposes, we collect information.

3. Legal Basis

Your data is processed according to the following legal provisions:

  • Art. 6(1)(a) General Data Protection Regulation, provided you have agreed to the setting of cookies or advertising;
  • Art. 6(1)(b) GDPR, to establish and implement the contract, for example to join the community;
  • The fulfillment of legal obligations, Art. 6(1)(c) GDPR),
  • With regard to messages you share with your Tandem partners, both in one-on-one chats, Tandem Parties and group chats, based on your legitimate interests, Art 6(1)(f) GDPR.

Moreover, with particular regard to statistical data and online identifiers based on legitimate interests, pursuant to Art 6(1)(f) of the GDPR (see below).

Legitimate Interests

When processing your data, we pursue the following legitimate interests:

  • Providing and improving our service;
  • Protecting against misuse;
  • Statistics and service analytics;
  • To increase the integrity and credibility of our Community.
4. Data Sources

Unless otherwise specified, we obtain the data from you (including via devices used by you).

5. Data Transfer to Third Countries

Data is transferred to countries outside the European Economic Area. We only transfer personal data to third countries where the EU Commission has confirmed an adequate level of protection or if we can ensure the careful handling of the personal data through contractual agreements or other appropriate guarantees, such as certifications or proven compliance with international security standards.

  • USA (Adequacy Decision/Standard Contractual Clauses)
  • India (Standard Contractual Clauses)
  • China (Standard Contractual Clauses)
6. Retention Period

We retain your data:

  • If you have consented to this as part of processing, until such time as you withdraw your consent (e.g. by deleting your account);
  • If we need the data to fulfill an agreement, until such time as the contractual relationship with you ceases or legal retention periods expire;
  • If we use the data on the basis of a legitimate interest, until such time as your overriding interest obliges us to delete or anonymize it;
  • Please note that if you delete your account, your personal information will be deleted, but we will retain the messages you sent to a Tandem Partner;
  • If you delete your account, we will continue to store your email address associated with the account so that we can process deletion requests after you delete your account;
  • We will also continue to store your Tandem ID so that we can respond to user inquiries after an account is deleted;
  • We store Community membership applications, including your personal information, for at least seven days. After this period has expired, you can permanently delete all personal data from Tandem using the “Delete my application” button in the app.
  • To ensure that Tandem remains a safe place for language learners, we take violations of our community rules very seriously. Therefore, we may retain anonymous personal identifiers for up to 24 months and prevent access to the Community on this basis during that period.
7. Our Policy on Children’s Information

Children and young people under 16 are not allowed to use Tandem. If you reside in the European Economic Area (EEA), you may only use Tandem if you are over the age at which you can consent to data processing under the laws of your country or if we have been provided a verifiable parental consent for your use of Tandem. If you are a parent and find out that your child is using Tandem and you do not wish this to happen, please contact support@tandem.net.

8. Cookies

Cookies and similar technologies are very small text documents or pieces of code that often contain a unique identification code. When you visit a website or use a mobile application, a computer asks your computer or mobile device for permission to save this file on your computer or mobile device and gain access to information. Information collected through cookies and similar technologies may include the date and time of the visit and how you use a particular website or mobile application.

We need cookies to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information; (c) to provide and monitor the effectiveness of our Service; (d) to monitor and aggregate metrics such as total number of visitors, traffic, and demographic patterns; (e) to diagnose or fix technology problems; (f) to help you efficiently access your information after you sign in; (g) to keep you logged in; and (h) to keep the Tandem community safe for members.

Switching off or revoking cookie consent:

Changing consent or revoking consent for the setting of cookies can be done by clicking the “Change your cookie consent” button at the bottom of this page.

9. Data Recipients

We use your personal information only within the company and forward it only to those companies that are involved in performing the contracts concluded with you or otherwise involved in providing the relevant service. We forward the following customer data to third parties:

  • To analyze how Tandem is used by our members and optimize the service and design, pseudonymous usage and personal data is shared with Google Analytics and Firebase Analytics.
  • To communicate information relevant to the service via email or push notification, names, device IDs, email addresses and other personal information may be shared with Iterable and Sparkpost (https://sparkpost.com). You can control what type of messages you receive in the profile settings, switch off push notifications for Tandem completely in your device settings and unsubscribe from email notifications in each individual email.
  • With your explicit consent, in order to make ads more personal, we may share personal but anonymized information, such as age and gender as well as device identifiers with Admob by Google, MoPub and Facebook Audience Network. iOS and Android devices have a resettable advertising identifier that companies can use to target ads based on the apps you use.
  • For both iOS and Android devices, you have the option to disable the use of mobile advertising identifiers. For iOS, go to your iOS device settings and turn on the “Limit ad tracking” setting. For Android, turn on “Opt out of ads personalization” in your Android device settings.
9.1 Registration and Authentication

By registering or authenticating, users allow Tandem to identify them securely and give them access to its services. Depending on what is described below, third parties may provide registration and authentication services. In this case, Tandem will be able to access some data stored by these third-party services for registration or identification purposes, with the user’s explicit consent:

  • Facebook Authentication (Meta, Inc.): Facebook Authentication is a registration and authentication service provided by Facebook, Inc. and is connected to the Facebook social network. The personal data collected is various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • Firebase Authentication (Google Inc.): Firebase Authentication is a registration and authentication service provided by Google Inc. To simplify the registration and authentication process, Firebase Authentication can make use of third-party identity providers and save the information on its platform. Personal Data collected: email. Place of processing: United States – Privacy Policy.
  • Google OAuth (Google Inc.): Google OAuth is a registration and authentication service provided by Google Inc. and is connected to the Google network. Personal Data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • Weibo (Sina.com): Weibo is a registration and authentication service provided by Sina.com and is connected to the Sina Weibo social network and SDK. Personal Data collected: various types of data as specified in the privacy policy of the service. Place of processing: China – Privacy Policy
  • WeChat (Tencent Inc.): WeChat Auth is a registration and authentication service provided by Tencent Inc. and is connected to the WeChat network and SDK. Personal Data collected: various types of Data as specified in the privacy policy of the service. Place of processing: Canada and Hong Kong – Privacy Policy
  • Sign in with Apple (Apple Inc.): Sign in with Apple is a registration and authentication service provided by Apple Inc. In cases where Users are required to provide their email address, Sign in with Apple may generate a private relay address on behalf of Users that automatically forwards messages to their verified personal email account - therefore shielding their actual email address from the Owner. Personal Data processed: email address; first name; last name; User ID. Place of processing: United States – Privacy Policy.
9.2 Hosting and Backend Infrastructure

This type of service has the purpose of hosting data and files that enable Tandem to run and be distributed, as well as providing a ready-made infrastructure to run specific features or parts of Tandem. Some of these services work through geographically distributed servers, making it difficult to determine the actual location where personal data is stored.

  • Amazon Web Services (AWS) (Amazon Web Services, Inc.): Amazon Web Services is a hosting and backend service provided by Amazon.com Inc. A wide range of Personal Data, including sign-in data, images and message content is stored on AWS infrastructure as Tandem’s main hosting and infrastructure provider. Place of processing: Germany and the United States – Privacy Policy.
  • Google Cloud Platform (Google Inc.): Google Cloud Platform is a hosting and backend service provided by Google Inc. Personal Data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • Azure: Azure is a hosting and backend service provided by Microsoft Ireland Operations Ltd. A wide range of personal data, including login credentials, images and message content, is stored on Tandem's Azure infrastructure as a key hosting and infrastructure provider. Place of processing: Germany – Privacy Policy.
  • CDS Global Cloud (Beijing CapitalOnline Data Service): CDS Global Cloud is a specialized international provider of hosting services. At Tandem we use CDS to optimize the speed and reliability of data transmission from or to Mainland China. Place of Processing: European Union - Privacy Policy.
9.3 Processing Payments

Payment processing services enable Tandem to process payments. To ensure greater security, Tandem does not process or store credit card details, and uses only the information necessary to execute the transaction with the financial intermediaries handling the transaction.

Some of these services may also enable the sending of timed messages to you, such as emails containing invoices or notifications concerning the payment.

  • Payments processed via the Apple App Store (Apple Inc.): Tandem uses a payment service provided by Apple Inc. that allows the Owner to offer the purchase of the app itself or in-app purchases. Personal Data processed to complete the purchases are processed by Apple, as described in the privacy policy for the App Store. Personal Data processed: payment data. Place of processing: United States – Privacy Policy.
  • Payments processed via the Google Play Store (Google Ireland Limited): Tandem uses a payment service provided by Google Ireland Limited that allows the Owner to offer the purchase of the app itself or in-app purchases. Personal Data processed to complete the purchases are processed by Google, as described in the privacy policy for the Google Play Store. Personal Data processed: payment data. Place of processing: Ireland – Privacy Policy.
9.4 Infrastructure Monitoring

This type of service allows Tandem to monitor the use and behavior of its service components, so its features, performance, operation, maintenance and troubleshooting can be improved. Which Personal Data are processed depends on the characteristics and mode of implementation of these services, whose function is to filter the activities of Tandem.

  • Crashlytics (Google Inc.): Crashlytics is a monitoring service provided by Google Inc. to enable Tandem to improve the stability of the app and reduce app crashes. Personal Data collected: geographic position, unique device identifiers for advertising (Google Advertiser ID or IDFA, for example) and various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • Firebase Crash Reporting (Google Inc.): Firebase Crash Reporting is a monitoring service provided by Google, Inc. to improve the stability of the app and reduce app crashes. Personal Data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • Firebase Performance Monitoring (Google Inc.): Firebase Performance Monitoring is a monitoring service provided by Google, Inc. Personal Data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
9.5 Managing Contacts and Sending Messages

This type of service makes it possible to communicate with users outside of the app, e.g. via push notifications and email. They may manage a database of email contacts, phone contacts or any other contact information to communicate with the user. These services may also collect data concerning the date and time when the message was viewed by the user, as well as when the user interacted with it, such as by clicking on links included in the message.

  • Firebase Cloud Messaging (Google Inc.): Firebase Cloud Messaging is a message sending service provided by Google, Inc. Firebase Cloud Messaging allows the Owner to send messages and notifications to Users across platforms such as Android, iOS, and the web. Messages can be sent to single devices, groups of devices, or specific topics or User segments. Personal Data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • SparkPost (Message Systems, Inc.): SparkPost is an email address management and message sending service provided by Message Systems, Inc. Personal Data collected: email address and various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • Iterable (Iterable, Inc.): Iterable is a User Communications and database management service provided by Iterable, Inc. Personal Data processed: email address; Tracker; various types of personal data. Place of processing: United States – Privacy Policy..
  • Agora (Agora Lab, Inc): Agora is a real-time engagement platform. Tandem uses the Vonage video and voice communication API to provide global high audio- and video-calling functionality across our mobile and web applications. Agora Lab Inc. only collects Internet Protocol (IP) addresses and operational information necessary for providing their services. Place of processing: United States – Compliance & Privacy.
9.6 Web and Mobile Analytics

The services contained in this section enable us to monitor and analyze web and mobile traffic and can be used to keep track of how Tandem is used by users.

  • Analytics collected directly (Tandem): Tandem uses an internal analytics system that does not involve third parties. Personal data collected: cookies and usage data.
  • Google Analytics (Google Inc.): Google Analytics is a web analysis service provided by Google Inc. (“Google”). Google utilizes the data collected to track and examine the use of Tandem, to prepare reports on its activities and share them with other Google services. Google may use the data collected to contextualize and personalize the ads of its own advertising network. Personal Data collected: cookies and usage data. Place of processing: United States – Privacy PolicyOpt Out.
  • Google Analytics for Firebase (Google Inc.): Google Analytics for Firebase or Firebase Analytics is an analytics service provided by Google Inc. In order to understand Google’s use of data, Google’s partner policy. Firebase Analytics may share data with other tools provided by Firebase, such as Crash Reporting, Authentication, Remote Config or Notifications. The user may check this privacy policy to find a detailed explanation about the other tools used by the owner. Tandem uses identifiers for mobile devices (including Android Advertising ID or Advertising Identifier for iOS, respectively) and technologies similar to cookies to run the Firebase Analytics service. Users may opt out of certain Firebase features through applicable device settings, such as the device advertising settings for mobile phones or by following the instructions in other Firebase related sections of this privacy policy, if available. Personal Data collected: cookies, unique device identifiers for advertising (Google Advertiser ID or IDFA, for example) and usage data. Place of processing: United States – Privacy Policy.
  • Adjust (Adjust GmbH): Adjust is an analytics and ad attribution service provided by Adjust GmbH. Personal data collected: Cookies, Device Identifiers and Usage Data. Place of processing: Germany – Privacy PolicyOpt Out.
  • Facebook Ads conversion tracking (Facebook, Inc.): Facebook Ads conversion tracking is an analytics service provided by Facebook, Inc. that connects data from the Facebook advertising network with actions performed on Tandem. Personal Data collected: cookies and usage data. Place of processing: United States – Privacy Policy.
  • TestFlight (Apple Inc.): TestFlight is an analytics service provided by Apple Inc. Personal Data collected: Cookies, email address and usage data. Place of processing: United States – Privacy Policy.
9.7 Managing Support and Contact Requests

Our customer support platform allows us to manage support and contact requests received via email or by other means, such as the contact form. The personal data processed depends on the information provided by the user in the messages and the means used for communication (e.g. email address).

  • Zendesk (Zendesk, Inc.): Zendesk is a support and contact request management service provided by Zendesk Inc. Personal Data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • FeatureOS (Skcript Technologies Private Limited): FeatureOS is a service used to collect user feedback and feature requests provided by Skcript Technologies Private Limited. Data collected: logs, analytic, cookies and other tracking technologies. Place of Processing: Safe Harbor Privacy Principles agreed upon by the U.S, the European Union and Switzerland - Privacy Policy.
9.8 Advertising

Ads (e.g. banners, interstitials, and native ads) help us make money and continue to provide most of Tandem's features for free. When we tell advertisers your age, gender, location and device information, the ads you see on Tandem are more relevant and we earn more from them. We only pass on your personal data with your express consent. If you do not want your data to be passed on, you can revoke your consent at any time. Below you will find information and terms of use. Some of the services listed below may use cookies or mobile advertising identifiers to identify users, or they may use the technique of behavioral retargeting, i.e. displaying ads tailored to the user's interests and behavior, including those outside of Tandem recognized. Further information can be found in the privacy policies of the respective services. In addition to any opt-out offered by any of the services below, the user may opt out of a third-party service’s use of cookies by visiting the Network Advertising Initiative opt-out page. Another option for disabling ad personalization is the preference management of YourOnlineChoices https://youronlinechoices.com.

  • AdMob (Google Inc.): AdMob is an advertising service provided by Google Inc. In order to understand Google’s use of data, consult Google’s partner policy. Personal Data collected: cookies, unique device identifiers for advertising (Google Advertiser ID or IDFA, for example) and usage data. Place of processing: United States – Privacy PolicyOpt Out.
  • DoubleClick for Publishers (Google Inc.): DoubleClick for Publishers is an advertising service provided by Google Inc. that allows the owner to run advertising campaigns in conjunction with external advertising networks that the owner, unless otherwise specified in this document, has no direct relationship with. In order to opt-out from being tracked by various advertising networks, Users may make use of Youronlinechoices. In order to understand Google’s use of data, consult Google’s partner policy. This service uses the “Doubleclick” Cookie, which tracks use of Tandem and User behavior concerning ads, products and services offered. Users may decide to disable all the Doubleclick Cookies by clicking on: google.com/settings/ads/onweb/optout?hl=en. Personal data collected: Cookies and Usage Data. Place of processing: United States – Privacy Policy.
  • Facebook Audience Network (Facebook, Inc.): Facebook Audience Network is an advertising service provided by Facebook, Inc. In order to understand Facebook’s use of Data, consult Facebook’s data policy. Tandem may use identifiers for mobile devices (including Android Advertising ID or Advertising Identifier for iOS, respectively) and technologies similar to cookies to run the Facebook Audience Network service. One of the ways Audience Network shows ads is by using the User’s ad preferences. The User can control this in the Facebook ad settings. Users may opt out of certain Audience Network targeting through applicable device settings, such as the device advertising settings for mobile phones or by following the instructions in other Audience Network related sections of this privacy policy, if available. Personal data collected: cookies, unique device identifiers for advertising (Google Advertiser ID or IDFA, for example) and Usage Data. Place of processing: United States – Privacy PolicyOpt Out.

9.9 Content Performance and Features Testing (A/B testing)

The services contained in this section allow the Tandem to track and analyze the user response concerning web traffic or behavior regarding changes to the structure, text or any other component of Tandem.

  • Firebase Remote Config (Google Inc.): Firebase Remote Config is an A/B testing and configuration service provided by Google Inc. Personal data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
  • Google Optimize (Google Inc.): Google Optimize is an A/B testing, website testing, and personalization tool provided by Google Inc. Personal data collected: various types of data as specified in the privacy policy of the service. Place of processing: United States – Privacy Policy.
10. Your Rights

As a Tandem user, you have the right to information, correction, objection, complaint, deletion and blocking of your personal data. More specifically:

  • You have the right to request information about whether and which personal data is processed by our company. You also have the right to request that your personal data be amended or changed.
  • Under certain circumstances, you have the right to request the deletion of your personal data, for example by tapping “Delete Account” in “My Profile/Settings”.
  • Under certain conditions, you have the right to request a restriction on the processing of your personal data.
  • You can revoke your consent to the processing and use of your data in whole or in part at any time with effect for the future.
  • You have the right to receive your personal data in a common, structured and machine-readable format, e.g. via the “Download my data” button in “My Profile/Settings”.
  • If you have any questions, comments, complaints or requests in connection with our data protection declaration and the processing of your personal data, you can also contact our data protection officer in detail.
  • You also have the right to complain to the responsible supervisory authority if you believe that the processing of your personal data violates legal regulations.
11. Requirement or obligation to provide data

Unless expressly stated, when data is collected, the provision of data is neither required nor obligatory.

Date of issue of this data privacy statement

19.12.2023