Privacy Policy for the Zendure Forum

Last updated: April 30th, 2026

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Zendure DE GmbH
Niederkasseler Lohweg 18
40547 Düsseldorf
Germany

Represented by the Managing Director:
Mr. Bingbin Liu

Email: privacy@zendure.com

2. Data Protection Officer

The appointed Data Protection Officer is:

Rechtsanwalt Dr. Jörg Brettschneider
Alter Wall 32
20457 Hamburg
Germany

Phone: +49 40 33 46 64 190
Email: office1@brettschneider.law

You may contact the Data Protection Officer directly at any time with questions regarding data protection or to exercise your rights as a data subject.

3. Purpose and Function of the Zendure App

This Privacy Policy follows a multi-layered approach in accordance with Article 12 of the GDPR and is intended to provide clear, transparent, and easily accessible information. The Privacy Policy is accessible within the app via the settings menu and allows users to view individual sections separately.

The Zendure app allows users to configure, manage, and monitor Zendure’s smart energy products, including energy storage systems and solar-related devices.

In particular, the app allows users to:
- Register and manage Zendure devices
- Connect devices via Bluetooth and/or Wi-Fi
- Monitor real-time and historical energy data
- Configure device settings
- Receive system and security notifications
- Install firmware updates

Use of the Zendure app is voluntary. Users may contact Zendure at any time through alternative channels. The processing of personal data is necessary to provide the app features described above.

The Zendure app also provides access to the ZenWatts points and rewards programme, which allows users to earn and redeem points (ZenWatts) for certain activities (for example device binding, community participation and selected in-app tasks). Participation in ZenWatts is voluntary and subject to separate programme terms and conditions. The processing of personal data in connection with ZenWatts is described in a dedicated section of this Privacy Policy.

4. Data Processing When Downloading the App

No obligation to provide data

There is generally no legal or contractual obligation to provide personal data when downloading or using the Zendure app. However, certain app features may not be available or may be limited if required data is not provided.

When you download the Zendure app, certain data is processed by the respective app store provider (e.g., Apple App Store or Google Play Store), specifically:
- Username
- Email address
- Customer number
- Time of download
- Payment-related information
- Device identification number

This data processing is carried out exclusively by the respective app store provider under its own responsibility. Zendure is not responsible for this processing and has no influence over it.

The privacy policies of the respective app store providers apply.

5. Automatically Processed Technical Data

When using the Zendure app, certain technical data is processed automatically, including:
- Internal device ID
- Operating system and version
- App version
- Date and time of access
- IP address (truncated or anonymized before being stored in system logs, where technically possible)
- Additional device identifiers depending on the operating system, to the extent technically necessary for app functionality

Purposes
- Provision and technical operation of the app
- Ensuring system security and stability
- Error analysis and prevention of misuse

Legal basis
- Section 25(2)(2) of the German Telecommunications and Telemedia Data Protection Act (TTDSG)
- Article 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the app)

6. User Account and Registration

Use of the Zendure app requires the creation of a user account.

Required information
- Email address
- Password (stored exclusively in encrypted form)

Optional information
- Username
- Device name
- Location name

Purposes
- Authentication and account management
- Assignment and management of Zendure devices
- Communication regarding security, service, or contractual matters

Participation in the ZenWatts programme may require that you meet the minimum age required by applicable law in your country or region and, where you have not reached full legal capacity, that you participate with the consent and guidance of your legal guardian. We may process information relating to your participation status in ZenWatts (for example whether you have joined the programme, your current points balance and tier) as part of your user account data.

Legal basis
- Article 6(1)(b) GDPR (performance of a contract)

7. Device and Energy Data

When using the Zendure app, device- and usage-related data is processed, in particular:
- Device ID and serial number
- Device and system status
- Charging and discharging power
- Energy generation and consumption data
- Diagnostic and error information

This data may be indirectly personal as it is linked to a user account.

Purposes
- Display and analysis of energy data
- Device control and configuration
- Troubleshooting and customer support
- Provision of firmware updates

Legal basis
- Article 6(1)(b) GDPR (performance of a contract)

8. App Permissions

The Zendure app may request the following permissions:

Internet access
Required for communication with servers and devices.

Camera
Used exclusively for scanning QR codes during device registration.

Bluetooth and/or Wi-Fi
Used to connect, configure, and manage Zendure devices locally.

Push notifications
Used to send security-related system messages, alerts, and important status updates.

Optional, non-essential notifications (e.g., informational or usage-related messages) are only sent if they have been explicitly enabled by the user. Declining optional notifications does not affect the core functionality of the app.

Legal basis
- Section 25(2)(2) TTDSG
- Article 6(1)(b) GDPR (technically necessary notifications)
- Article 6(1)(a) GDPR (optional notifications based on consent)

Permissions can be managed or revoked at any time via the device settings.

9. Push Notification Services (JPush and Firebase Cloud Messaging)

We use the services JPush and Firebase Cloud Messaging (FCM) to deliver push notifications.

JPush

JPush is operated by:

Shenzhen Aurora Mobile Technology Co., Ltd. (Aurora Mobile), China

JPush processes personal data as a data processor in accordance with Article 28 GDPR. A corresponding data processing agreement has been concluded.

Processed data may include:
- Device and app identifiers
- Unique push tokens
- IP address
- Delivery and interaction metadata

Content of Push Notifications
Push notifications delivered via JPush do not contain any sensitive personal data. To the extent technically possible, the notification content is limited to abstract system messages or event references. Detailed information is retrieved by the app only after secure authentication.

Push payloads are transmitted in encrypted form. Zendure does not transmit account data, passwords, or detailed usage data via push notification services.

JPush is used to deliver technically necessary system notifications and, provided consent has been granted, optional notifications.

Data transfers to China
The transfer of personal data to China takes place in accordance with Articles 44 et seq. GDPR. Since there is no adequacy decision by the European Commission for China, the transfer is based on EU Standard Contractual Clauses in conjunction with supplementary technical and organizational measures (including encryption and access restrictions). A Transfer Impact Assessment (TIA) has been conducted. Under Chinese law, access by Chinese authorities to transferred data cannot be completely ruled out. The supplementary measures implemented are intended to mitigate this risk to the extent technically and contractually possible.

Legal basis
- Article 6(1)(b) GDPR (technically necessary notifications)
- Article 6(1)(a) GDPR (optional notifications based on consent)

Firebase Cloud Messaging (FCM)

Firebase Cloud Messaging is provided by:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Firebase Cloud Messaging is used to deliver push notifications to devices using Google services. Google processes personal data as a data processor in accordance with Article 28 GDPR. A corresponding data processing agreement has been concluded.

Processed data may include:
- Device and app identifiers
- Push tokens
- IP address
- Delivery and interaction metadata

Data transfers to the U.S.
Personal data may be transferred to the United States. Google LLC is certified under the EU‑US Data Privacy Framework (DPF), for which the European Commission has issued an adequacy decision. Transfers to Google LLC are therefore made on the basis of this adequacy decision. In addition, EU Standard Contractual Clauses and additional technical and organizational measures are in place as supplementary safeguards.

Legal basis
- Article 6(1)(b) GDPR (technically necessary notifications)
- Article 6(1)(a) GDPR (optional notifications based on consent)

10. External Service Providers and Data Sharing

Personal data will only be disclosed if:
- the disclosure is permitted or required by law,
- it is necessary for the performance of a contract, or
- external service providers are commissioned to operate and secure the Zendure app.

All service providers are carefully selected and contractually bound in accordance with Article 28 GDPR.

10.1 Hosting and Cloud Infrastructure (Amazon Web Services – AWS)

The backend systems of the Zendure app are hosted by:

Amazon Web Services EMEA SARL
38 Avenue John F. Kennedy
L-1855 Luxembourg

AWS processes personal data as a data processor.

Hosting takes place primarily within the European Union. To the extent that data is transferred to third countries (in particular to the U.S.), this is done in accordance with Articles 44 et seq. GDPR. Amazon Web Services, Inc. is certified under the EU‑US Data Privacy Framework; transfers are additionally based on EU Standard Contractual Clauses.

Legal basis
- Article 6(1)(b) GDPR
- Article 6(1)(f) GDPR

10.2 Content Delivery and Security (Cloudflare)

To ensure secure and efficient backend communication, we use services from:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

Cloudflare provides services for content delivery networks (CDN) and security (e.g., DDoS protection).

Processed data may include IP addresses, device and usage data, access times, and security logs.

Cloudflare acts as a data processor in accordance with Article 28 GDPR. Data transfers to the U.S. are secured by EU Standard Contractual Clauses and additional technical and organizational measures. Access by U.S. authorities cannot be completely ruled out.

Legal basis
- Article 6(1)(f) GDPR

10.3 Content Delivery Network (Amazon CloudFront)

For the fast and reliable delivery of app content and updates, we use Amazon CloudFront, a CDN service from Amazon Web Services.

The service is provided by:

Amazon Web Services, Inc. / Amazon Web Services EMEA SARL

CloudFront processes personal data as a processor in accordance with Article 28 GDPR. Processed data may include:
- IP address
- Device and browser information
- Request and access logs
- Date and time of access

CloudFront is used to ensure the performance, availability, and security of the Zendure app and its backend services.

Personal data may be transferred to the United States. Amazon Web Services, Inc. is certified under the EU‑US Data Privacy Framework; transfers are additionally based on EU Standard Contractual Clauses and additional safeguards implemented by AWS.

Legal basis
- Article 6(1)(f) GDPR

10.4 Analytics and Usage Evaluation (GrowingIO)

We use the analytics service GrowingIO to analyze and improve the performance, stability, and user-friendliness of the Zendure app.

The service is provided by:

Beijing Yishu Technology Co., Ltd. (GrowingIO)
China

GrowingIO processes personal data as a data processor in accordance with Article 28 GDPR. A corresponding data processing agreement has been concluded.

Processed data may include:
- App and device identifiers (pseudonymized)
- Usage and interaction data
- Event and performance data
- IP address (truncated or anonymized prior to storage, where technically possible)

Individual users are not directly identified. The processed data is used exclusively in aggregated or pseudonymized form and is not combined with other data sources.

The analytics service is used exclusively to identify technical errors, optimize app performance, and improve user-friendliness. No profiling or tracking takes place across apps or services.

ZenWatts-related usage events (for example completion of certain tasks or participation in campaigns) may be included in the technical and usage data analyzed by GrowingIO, to the extent necessary to ensure the stability, security and user-friendliness of the Zendure app and the ZenWatts features. To the extent that such analysis is not technically necessary, we will rely on your consent obtained via the in-app consent mechanisms.

Note regarding Section 25 TTDSG: To the extent that the GrowingIO SDK accesses information stored on the end device (e.g., via device identifiers), this constitutes access to end devices within the meaning of Section 25 TTDSG. This access is either technically necessary for the provision of the app within the meaning of Section 25(2)(2) TTDSG or is based on the user’s consent pursuant to Section 25(1) TTDSG in conjunction with Article 6(1)(a) GDPR. Where consent is required, it will be obtained via the consent mechanism provided in the app prior to the first use of GrowingIO.

Legal bases
- Article 6(1)(f) GDPR (legitimate interest in ensuring the stability, security, and continuous improvement of the Zendure app), to the extent that Section 25 TTDSG does not require consent
- Article 6(1)(a) GDPR, to the extent that access to device information requires consent

10.5 Email Communication (Gmail / Google Workspace)

We use Google email services (Gmail / Google Workspace) for email communication related to the operation of the Zendure app, customer support, and security or service-related inquiries.

The service is provided by:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Google processes personal data as a data processor in accordance with Article 28 GDPR. A corresponding data processing agreement has been concluded.

Processed data may include:
- Email addresses
- Communication content
- Metadata (e.g., date and time of communication, sender and recipient information)

Email communication is conducted exclusively for the purposes of customer support, contractual communication, and the secure operation of the Zendure app.

To the extent that personal data is transferred to the United States, this is done on the basis of the adequacy decision for the EU‑US Data Privacy Framework, under which Google LLC is certified, as well as on the basis of EU Standard Contractual Clauses and additional technical and organizational measures.

Legal basis
- Article 6(1)(b) GDPR
- Article 6(1)(f) GDPR

10.6 Customer Support and Ticketing (Zendesk)

We use the Zendesk customer support platform to provide customer support and process support requests related to the Zendure app.

The service is provided by:

Zendesk International Ltd.
55 Charlemont Place
Saint Kevin’s
Dublin 2
Ireland

Zendesk processes personal data as a data processor in accordance with Article 28 GDPR. A corresponding data processing agreement has been concluded.

Processed data may include:
- Name and contact information (e.g., email address)
- Communication content and attachments
- Metadata related to support requests (e.g., date and time, status, ticket number)
- Technical information required to resolve support issues

Zendesk is used to efficiently process support requests, respond to inquiries, and improve the quality and security of customer support.

Personal data may be transferred to the United States. These transfers are carried out in accordance with Articles 44 et seq. GDPR based on EU Standard Contractual Clauses and additional technical and organizational measures.

Legal basis
- Article 6(1)(b) GDPR
- Article 6(1)(f) GDPR

10.7 Other IT and Technical Service Providers

Zendure engages additional IT and technical service providers for system maintenance, error analysis, secure app operation, and customer support. These service providers process personal data exclusively on our instructions as data processors in accordance with Article 28 GDPR.

11. Data Transfers to Third Countries

To the extent that personal data is processed outside the European Economic Area (EEA), this is done exclusively in accordance with Articles 44 et seq. GDPR.

Transfers are based on:
- Adequacy decisions (Article 45 GDPR), in particular the EU‑US Data Privacy Framework (DPF) for transfers to certified US organizations
- EU Standard Contractual Clauses (Article 46(2)(c) GDPR), supplemented, where necessary, by additional technical and organizational measures

For transfers to countries without an adequacy decision – in particular to China – Transfer Impact Assessments (TIAs) have been conducted in accordance with the requirements of the ECJ ruling in the Schrems II case. The TIAs assess whether the legal framework in the recipient country enables the data importer to fulfill the obligations under the Standard Contractual Clauses and whether the supplementary measures taken are sufficient to ensure a level of protection essentially equivalent to that of the EU. Copies of the applicable safeguards may be requested upon request.

12. Data Retention and Deletion Periods

Personal data is deleted or anonymized as soon as it is no longer necessary for the respective purposes.

Specifically:
- User account data: for the duration of the active user account
- Device and usage data: for the duration of device use and the existence of the account
- Technical log data: up to 30 days from creation
- Technical backups: up to 7 days after account deletion

ZenWatts-related data (such as points balances, transaction history and activity records) are stored for the duration of your participation in the ZenWatts programme and your user account. Certain records relating to fraud prevention, anomalies and violations may be retained for a longer period where necessary to investigate and prevent repeated misuse, to comply with legal obligations or to assert or defend legal claims. Such data will be restricted in use and deleted or anonymized when no longer needed for these purposes.

Data may be stored for a longer period if statutory retention obligations apply or if data is necessary to assert or defend legal claims.

13. Rights of Data Subjects

Withdrawal of Consent

To the extent that the processing of personal data is based on your consent, you have the right to withdraw your consent at any time with future effect. The withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal.

You can withdraw your consent via the app settings or by contacting us using the contact details provided above.

Your rights

You have the right to:
- Access (Article 15 GDPR)
- Rectification (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Objection to processing (Article 21 GDPR)

Requests may be directed to Zendure or directly to the Data Protection Officer. We respond to requests from data subjects without undue delay and in any case within one month of receipt, in accordance with Article 12(3) GDPR.

Where processing is based on our legitimate interests, you have the right to object at any time on grounds relating to your particular situation. This includes, in particular, processing carried out for fraud prevention and abuse detection in the ZenWatts programme. In addition, the ZenWatts programme provides an in-app appeal mechanism for contesting programme-related measures (such as point revocations or suspensions), which exists alongside your statutory data protection rights.

Right to object (Article 21 GDPR) – Separate notice

To the extent that we process your personal data on the basis of Article 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time for reasons arising from your particular situation. Upon receipt of your objection, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims. You may exercise your right to object at any time by contacting us using the contact details provided in Section 1 or by contacting the Data Protection Officer named in Section 2 directly.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Germany, or with another competent data protection supervisory authority.

14. Chatbots and Automated Support

The Zendure app and Zendure customer support can provide chat-based assistance to answer frequently asked questions and help users resolve standard inquiries.

Chatbots are used exclusively as support tools and do not make legally binding decisions or produce legal effects vis-à-vis users.

Processed Data
When using a chatbot, the following data may be processed:
- User inputs and communication content
- Technical metadata (e.g., time of the request, device or session identifiers)
- Contextual information necessary to respond to the request

The use of chatbots is voluntary. Users may contact customer support at any time via alternative channels.

Purposes
- Responding to user inquiries
- Improving the efficiency and availability of customer support
- Quality assurance and training of support systems (where possible in anonymized or aggregated form)

Service Providers
To the extent that external service providers are used to operate chatbot functions, they act as data processors in accordance with Article 28 GDPR and are contractually bound. To the extent that personal data is transferred to third countries in connection with chatbot services, this is done in accordance with Articles 44 et seq. GDPR, in particular on the basis of EU Standard Contractual Clauses and appropriate safeguards.

Legal bases
- Article 6(1)(b) GDPR (performance of a contract / customer support)
- Article 6(1)(f) GDPR (legitimate interest in efficient customer support)

15. Automated Decision-Making and Profiling

Zendure does not use automated decision-making within the meaning of Article 22 of the GDPR that produces legal effects concerning you or similarly significantly affects you solely on the basis of automated processing.

To operate and protect the Zendure app and the ZenWatts points programme, we may use automated tools and profiling in the sense of the GDPR (for example to analyse usage patterns and detect potentially abusive behaviour), but decisions with significant impact on your participation in the ZenWatts programme are not taken solely by automated means and are subject to human review. Your rights in connection with such processing, including the right to object, are described in the relevant sections of this Privacy Policy.

16. Age Restriction

The Zendure app is not intended for children under the age of 16. Zendure does not knowingly process personal data of children under this age.

Should we become aware that personal data of a child under the age of 16 has been processed without the appropriate authorization, we will delete this data immediately.

17. Social Media Presence (Facebook and Instagram)

Zendure maintains official profiles on social media, particularly on Facebook and Instagram, to provide information about products and services and to communicate with users.

The services are provided by:

Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

Joint controllership pursuant to Article 26 GDPR

When you visit our Facebook or Instagram pages, personal data is processed by Meta Platforms Ireland Limited and Zendure as joint controllers within the meaning of Article 26 GDPR, particularly with regard to so-called Page Insights.

In accordance with Article 26(2) sentence 2 GDPR, the key provisions of the joint controller agreement with Meta are as follows:

• Meta Platforms Ireland Limited is primarily responsible for enabling the processing of personal data on its platforms and for ensuring that data subjects can exercise their rights against Meta. Zendure’s responsibility is limited to the decision to maintain a presence on the Facebook/Instagram platform, as well as to the configuration of the page (e.g., audience settings, category selection).

• Data subjects may exercise their rights (access, erasure, objection, etc.) both with respect to Zendure (via the contact details in Section 1 or via the Data Protection Officer in Section 2) and directly with respect to Meta Platforms Ireland Limited.

• With regard to the processing of statistical data (Page Insights), Meta is the primary controller responsible for the lawfulness of the processing. Zendure receives only anonymized, aggregated data and has no access to the personal data of individual users beyond the information they actively share.

Processed data may include:
- Interaction data (e.g., likes, comments, messages)
- Profile information visible to us in accordance with your privacy settings
- Usage and device data collected by Meta

Zendure processes this data exclusively for the purposes of communication, public relations, and the analysis of aggregated statistics regarding the use of our social media pages.

Data transfers to third countries
Personal data may be transferred to the United States. These transfers are made in accordance with Articles 44 et seq. GDPR based on the adequacy decision for the EU‑US Data Privacy Framework (DPF), under which Meta Platforms, Inc. is certified, as well as on the basis of EU Standard Contractual Clauses and additional safeguards implemented by Meta.

Legal bases
- Article 6(1)(f) GDPR (legitimate interest in communication and public relations)
- Article 6(1)(a) GDPR (to the extent that consent is provided to Meta)

18. ZenWatts Points Programme and Fraud Prevention

ZenWatts is a voluntary points and rewards programme integrated into the Zendure app. Participation in ZenWatts is optional; however, the processing of certain personal data is necessary to operate the programme, to allocate and redeem points, and to protect the integrity of the points system.

18.1 Categories of data processed

In connection with ZenWatts and fraud prevention, we process in particular the following categories of data:

• Basic account data (e.g. email address, user ID, participation status and level/tier in ZenWatts).

• Device and technical data (e.g. device ID, internal device identifiers assigned by the app, operating system and version, app version, IP address, security and access logs).

• ZenWatts activity and transaction data (e.g. points earned and redeemed, purchase-related transaction data used for points allocation and order validation, participation in specific ZenWatts campaigns or activities such as device binding, profile completion, content creation or community tasks).

• Content and community interaction data, to the extent linked to ZenWatts (e.g. the fact that content was created to earn points, frequency of posts, obvious repetitions of the same content, likes and other interactions, indications of self-question-and-answer behaviour or copy‑pasted replies, “Helpful marks” and participation in rankings such as “Monthly Top 10 Quality UGC”).

• Referral and promotion data (e.g. referral relationships, confirmation that a referred user has bound a device and completed email verification, where applicable).

We do not use special categories of personal data (such as health data) for these purposes.

18.2 Purposes of processing

We process the above data in particular for the following purposes:

1. Operation of the ZenWatts programme, including allocation, management and redemption of points and validation of qualifying activities and transactions (for example, device binding, participation in campaigns, content creation and community interactions).

2. Prevention, detection and investigation of fraudulent or abusive behaviour in connection with ZenWatts, for example:

  – use of fake or multiple user accounts on the same device for point farming,

  – arbitrage behaviour through repeated purchases and returns solely to obtain points,

  – automated or bulk activities and the posting of obviously low‑quality or repeatedly identical content to gain points,

  – self-question-and-answer constellations and copy‑pasted replies that do not provide meaningful contributions,

  – abusive use of referral or promotion functions and manipulation of rankings or statistics.

3. Ensuring the security, stability and integrity of our systems and of the ZenWatts programme, including the prevention of technical misuse and attacks.

For these purposes, we may analyse how ZenWatts and related features are used and derive indicators that help us assess whether certain activities are likely to be abusive. This constitutes profiling within the meaning of the GDPR, but it is limited to the fraud prevention and programme security context described here and is not used for marketing or general behavioural scoring.

18.3 Fraud detection measures and role of automation

To achieve the above purposes, we use a combination of automated, rule‑based checks and human review. In particular, this may include:

• Monitoring unusual login, device or IP patterns that may indicate abuse (for example, if several user accounts use the same device in a way that is atypical for normal use; in such cases, activity from those accounts may be subject to closer review).

• Identifying atypical usage or points‑earning patterns (for example, very high numbers of posts or interactions in a short period, repeated posting of substantially identical content, or patterns typical of automated tools or coordinated fake interactions).

• Applying technical thresholds and filters (for example, temporary restrictions where a device is used in combination with an unusually high number of accounts, or automatic rejection of content that consists to a large extent of repeated text; such cases are recorded as potentially abnormal behaviour and may trigger additional checks).

• Applying a tiered response and penalty system (ladder system) in case of confirmed violations, for example:

  – minor violations: rejection of point claims and in‑app warning notifications,

  – moderate violations: forfeiture of unlawfully obtained points and temporary suspension of point‑earning privileges,

  – severe violations: clearing of all points, downgrade of membership tier, and temporary blocking of point‑related functions,

  – malicious violations: permanent blocking of all point‑related functions in ZenWatts.

Automated checks are used in particular to detect patterns and to flag cases that require attention. Decisions with significant impact on your participation in ZenWatts – in particular severe or malicious violations (such as long‑term or permanent blocking of point‑related functions or clearing of all points) – are not taken solely on the basis of automated processing. Such measures are always subject to human review, taking into account the specific circumstances of the case.

18.4 Appeal mechanism and user rights

If you are affected by measures in connection with fraud prevention (for example, rejection of point claims, suspension of point‑earning privileges, clearing of points or blocking of point‑related functions), you may file an appeal and provide supporting information via the in‑app support or appeal channels described in the ZenWatts programme information.

We will review your appeal without undue delay and generally within seven working days. If the appeal is successful, points or benefits will be restored to the extent appropriate. We may regularly publish anonymised and aggregated information about the handling of appeals in our official information channels in order to ensure transparency of the programme rules.

In addition, you may exercise your general data subject rights (in particular access, rectification, erasure, restriction of processing, data portability and objection) as described in Section 13 of this Privacy Policy.

18.5 Legal bases and access to device information

The processing of personal data for the operation of the ZenWatts programme and for fraud prevention and system security is based on the following legal bases:

• Article 6(1)(b) GDPR (performance of a contract) – to the extent that the processing is necessary to operate the ZenWatts programme, to allocate, manage and redeem points and to ensure a fair and functioning points system for participants.

• Article 6(1)(f) GDPR (legitimate interests) – for processing carried out to prevent, detect and investigate misuse and fraud, to protect the ZenWatts programme and our systems against abusive behaviour and to avoid economic damage, while appropriately balancing these interests with your rights and freedoms. Our legitimate interests include in particular the protection of our services and other users against abusive and fraudulent behaviour, the maintenance of a fair rewards programme and the safeguarding of our IT security.

To the extent that the processing involves access to or storage of information on your device (such as certain device identifiers or similar technical data) that is necessary for the secure operation of the app and the ZenWatts programme (for example, to prevent clearly abusive multi‑account use on a single device or to protect against attacks), this access is based on the applicable provisions of the TTDSG, in particular Section 25(2)(2) TTDSG. Where access to or storage of information on your device is not strictly necessary for these purposes, we will obtain your consent via the consent mechanisms in the app before such access takes place.

This section does not cover any use of ZenWatts data for personalisation or targeted campaigns (for example, tester recruitment scenarios). Such processing will only take place on the basis of your separate consent and is described in a separate section of this Privacy Policy, if and when such functions are introduced.

19. Community and Forum Functions

The Zendure app may provide community and forum functions, including the ability to create posts, comments, replies and other user-generated content, to mark content as helpful, and to interact with content via likes or similar features.

In connection with these functions, we process:
- the content you submit (e.g. text, images, videos),
- your account identifier and display name,
- interaction data (e.g. likes, helpful marks, replies, views),
- moderation data (e.g. flags, reports, review decisions), and
- timestamps and technical metadata relating to your posts and interactions.

Where these activities are linked to ZenWatts (for example quality posts, helpful marks, daily interaction tasks or rankings such as “Monthly Top 10 Quality UGC”), the data may also be processed for the purposes of operating the ZenWatts programme and fraud prevention as described in Section 18.

The legal bases are Article 6(1)(b) GDPR (performance of the contract regarding the provision of community features, where applicable) and Article 6(1)(f) GDPR (our legitimate interest in providing, moderating and improving community functions and preventing abuse). Content that violates our terms, community guidelines or applicable law may be removed or restricted in accordance with those rules.

20. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy to reflect legal, technical, or organizational changes, including changes relating to the ZenWatts programme and its features. The current version is available within the Zendure app.

Substantial changes that significantly affect the way we process your personal data will be communicated to you in an appropriate manner (for example via in-app notification), where required by law.