What does Firebase &quot;use exclusively for purposes related to my trade, business, craft or profession&quot; mean? I'm creating a project in Firebase and it's asking me to confirm this statement: ☐ I confirm that I will use Firebase exclusively for purposes relating to my trade, business, craft, or profession (Firebase terms) What does it mean? What am I not allowed to do? I can only think of using Firebase for someone else's business, disallowing companies to make use of Firebase without a license.
This distinguishes you as a business user as opposed to a consumer. The specific wording comes from EU consumer rights law. Consumers - ordinary members of the public who buy products and services - have certain legal rights that businesses don't. The theory is that what's going on when you buy a TV for your house is different from what's going on when you buy 1000 TVs for your hotel chain. The appropriate remedies and processes if you're dissatisfied are different. By asking you to identify yourself as not a consumer, the idea is that you wouldn't be able to use consumer rights law in the event you find Google's services to be defective, too expensive, not matching the advertising, etc. In the UK's transposition of EU law, the onus is on the trader (Google) to prove that you are not a consumer, in any legal proceedings. If they can point to you ticking a box saying that you are not a consumer, the argument is much easier for them to make. EU legislation using this phrase, or nearly, includes - Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts, Article 2 ‘consumer’ means any natural person who, in contracts covered by this Directive, is acting for purposes which are outside his trade, business or profession; ‘seller or supplier’ means any natural or legal person who, in contracts covered by this Directive, is acting for purposes relating to his trade, business or profession, whether publicly owned or privately owned. Council Directive 85/577/EEC of 20 December 1985 to protect the consumer in respect of contracts negotiated away from business premises, Article 2 ‘consumer’ means a natural person who, in transactions covered by this Directive, is acting for purposes which can be regarded as outside his trade or profession; ‘trader’ means a natural or legal person who, for the transaction in question, acts in his commercial or professional capacity, and anyone acting in the name or on behalf of a trader. Directive 2011/83/EU on consumer rights, the main current directive on this topic, Article 2 ‘consumer’ means any natural person who, in contracts covered by this Directive, is acting for purposes which are outside his trade, business, craft or profession; ‘trader’ means any natural person or any legal person, irrespective of whether privately or publicly owned, who is acting, including through any other person acting in his name or on his behalf, for purposes relating to his trade, business, craft or profession in relation to contracts covered by this Directive Directive 2019/770 of 20 May 2019 on certain aspects concerning contracts for the supply of digital content and digital services, specially relevant to the Google service, makes the same definitions as in the Directive of 2011. National legislation implementing these directives uses the same phrases in English. For example: the UK's Consumer Rights Act 2015, s.2 has &quot;trade, business, craft, or profession&quot; in Ireland, the Consumer Rights Act 2007, s.2 uses &quot;trade, business or profession&quot;; and the draft Consumer Rights Bill currently before the Oireachtas uses &quot;trade, business, craft, or profession&quot;, reflecting the most recent EU wording. in Malta, Chapter 378 of the consolidated laws also reflects the EU terminology.
Yes, it also applies. However, an employment implies they agree to having employment related data stored and processed (e.g., to be paid). When there are performance related bonuses in the contract, this will likely (but IANAL) imply they agree to performance data being collected and stored appropriately. Furthermore I would assume most of such data processing (such as knowing who is responsible for a certain change, who created a file, modified it etc.) falls into "legitimate interests" of the employer, as this information may be necessary for operations. I'd assume (still IANAL) that much of the consequence wrt. GDPR is the right to have your data erased. So a company should be prepared to remove such data when an employee leaves the company, e.g., by clearing the responsible person fields upon request. At least for data where there is no legal requirement to have such data provenance. But: consult your lawyer for a proper legal opinion!
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
Yes. Art 13 requires you to provide “the identity and the contact details of the controller”. You are the data controller. Your name and address are necessary to establish your identity. Using AdSense means you're offering an internet society service commercially. In that case, there's also probably some EU fair competition directive that was implemented in your countries national law and will provide equivalent requirements. For example, my country Germany has a far-reaching Impressumspflicht. Not sure if this is the most relevant EU law, but Art 22 of Directive 2006/123 requires that your country passed laws to ensure that you make available “the name of the provider, his legal status and form, the geographic address at which he is established and details enabling him to be contacted rapidly and communicated with directly and, as the case may be, by electronic means”. I think you would be in scope of this directive since you're acting commercially. This legally mandated self-doxxing is unfortunate for private bloggers, but it's also essential for making it possible to enforce data subject rights: if you were to violate someone's privacy rights, how could they sue you if they don't know where to serve you with a lawsuit? However, all things are a balancing act. These requirements are not intended to limit freedom of expression. If you're just trying to communicate something to the public without jeopardizing your anonymity, then paradoxically social media services can be more attractive.
In German Law you need to give your agreement ("Willenserklärung") to a contract or in this case terms of service. This is done by telling the other part. In some cases this can also be implied by an action (example: putting your bottle of beer onto the cashiers table is an offer to buy this bottle). As a second criteria a "Willenserklärung" needs to be the exact will of the part that declares its will (the website user in this case) §§ 133, 157 BGB or that the other side (you) could only see so (not the case here as this mainly speaks of content). If you visit a website and there are terms of services, the "Willenserklärung" is only given when the user read and agreed to the terms. If he did not, the terms of service are not applied until the user agrees to them. So I would recommend to block the website until the user agreed (overlay) as you need to proof he did when in court. Additionally there are so called AGB's in Germany. Those are contracts that are used or planed for many (more than 3) uses and set by one side (you). This may apply here, so you need to follow a lot of other rules like making sure the user had access and agreed, then there are many content restrictions and so on... I recommend consulting a German Lawyer specialized on this topic as this is very complex and includes other German laws for Media too, depending on the content of your site and terms. Also note that everything said is only based on my own knowledge and can not be used as safe legal source.
You will need to obtain permission from the company whose logo you intend to use before using it. Just because you use a product from that company in your devices doesn't necessarily give you permission to use their logo. Many companies have co-marketing plans that you can apply to be a part of but generally you and your product must meet certain requirements in order to be a part of it.
Critique I'm technically a director of a company ... You either are or you aren't - there is no "technically" involved. ... is not currently trading ... And doing nothing can create a conflict of interest? How? You mustn’t be involved either directly or indirectly with any other trade or business competing in or conflicting with the interests of our Company. "competing or conflicting" is the key here - if the "other trade or business" can adversely affect the performance of your employer then you have a conflict, if not, you don't. are only related in such that they are both technology based but otherwise are unrelated. Sorry, but that is so vague as to be totally useless - what company today is not "technology based"? Pharmaceutical companies are technology based, so are construction companies, so are law firms but one would hardly call them "related". Solution Conflicts of interest are easy: If you don't think you have a conflict of interest and they don't think you have a conflict of interest then you don't have a conflict of interest. If either or both of you do; then you do. Tell them about it! Conflicts of interest are a problem because people think that if you are keeping secrets then you are doing it for a nefarious purpose! In 90% of cases declaring the potential conflict resolves the conflict because the other party says "That! Don't be silly; that's not a problem!" or words to that effect. In the 99.9% of the remaining 10% of cases then sensible people can come up with sensible solutions, for example: If you want to be involved with another business whilst working for us then you’ll need to get a letter from the Director of your area confirming that they’re happy for you to do this.
An app(lication program) is software run on the end-users machine. That does not fall under the GDPR. Any processing (including storage) you do on user data has to be compliant with the GDPR. Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data. Providing this "basic data" as a JSON or CSV file should meet data portability requirements. Allows a user to upload a GPX file (a route or some other activity) Stores the above file to Google's database Allows the user to analyze that file. Since the user is actively choosing to upload each file you have permission to do this. You should make it clear in your privacy policy that the data will be held by Google. Doing so should not be a problem as Google has set up the legal framework to do this under the GDPR. You don't have to store the information encrypted, but you should use encryption (e.g. HTTPS) for any data transmission. Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent). Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data. Finally, make sure there is a "Close my account and delete all my data" option.