ActoPim Privacy Policy and Data Protection Notice

Last Updated: October 6, 2026

This Privacy Policy and Data Protection Notice explains the purposes for which your personal data is processed within the scope of the ActoPim mobile application, the legal grounds relied upon, the parties with whom your data may be shared, how long your data may be retained, and your rights regarding your personal data.

Your personal data is processed by ACTO GmbH, acting as the data controller, in accordance with the European Union General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law No. 6698 (KVKK) to the extent applicable, and other applicable data protection legislation.

1. Data Controller

The data controller responsible for the processing of personal data within the scope of ActoPim is:

ACTO GmbH
Active Chemical Technology Organisation
Büchnerstrasse 11
38118 Braunschweig
Germany
Email: info@actogmbh.com
Website: www.actogmbh.com

This notice covers personal data processing activities carried out through the ActoPim mobile application, the servers and online services connected to the application, and other related processing activities performed through the application.

2. Personal Data That May Be Processed

Depending on the nature of the service and the features you use, the following categories of personal data may be processed within the scope of ActoPim:

Identification data: First name, last name, date of birth, and other identification information associated with your user account.
Contact data: Email address, telephone number, address, and other contact information provided by you.
Profile data: Biography, profile image, and optional profile information provided by you, such as Skype, WhatsApp, LinkedIn, or similar information.
Account and membership data: User account information, account status, email verification information, authorization details, and account-related preferences.
Usage data: Favorites, recently viewed products, documents, search history, application features used, and user preferences.
Device and technical data: Device model, operating system, operating system version, application version, device language, session information, technical error logs, and security logs.
Support and communication data: Support requests, feedback, and the content of communications you have with us.
Permission and preference data: Preferences relating to camera, microphone, speech recognition, notifications, and similar device permissions.

3. Special Categories of Personal Data

ActoPim is not designed for the collection of special categories of personal data. Users are expected not to provide health data, biometric data, or other personal data classified as special category or sensitive personal data under applicable legislation through support, profile, or other areas of the application.

If special category personal data is voluntarily provided by a user, such data may only be processed where a valid legal basis exists under applicable law and appropriate technical and organizational security measures are implemented. Data that is not necessary for processing may be deleted or access to such data may be restricted, subject to applicable legal obligations.

4. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

Creating, managing, and verifying user accounts.
Verifying corporate email addresses and authorizing user access.
Carrying out user login and session management processes.
Providing, maintaining, and securing ActoPim services.
Providing access to ACTO product catalogs, product information, and technical documentation.
Providing access to clinical study content.
Enabling users to search for products using barcodes or supported QR codes.
Providing voice search features on supported devices.
Providing personalized application features such as favorites and recently viewed content.
Storing user preferences and application settings.
Responding to support and information requests.
Detecting, preventing, and resolving technical issues, errors, misuse attempts, and security incidents.
Improving application performance, reliability, and user experience.
Generating aggregated or anonymized statistics regarding the use of services.
Complying with legal obligations and responding to lawful requests from competent authorities.
Establishing, exercising, or defending legal claims.

Your personal data will not be processed for purposes incompatible with those stated above unless such processing is permitted by applicable law or, where required, your explicit consent has been obtained.

5. Legal Grounds for Processing Personal Data

Depending on the relevant processing activity, one or more of the following legal grounds may apply:

Processing Activity	Primary Legal Basis
Account creation, user login, and provision of services	Necessary for the performance of a contract or, where applicable, legitimate interests relating to the provision of services
Providing access to products and documents	Performance of a contract or legitimate interests relating to the provision of services
Favorites and user preferences	Provision of the requested service, fulfillment of user requests, and, where applicable, legitimate interests
Technical error and security logs	Legitimate interests in ensuring information and system security and compliance with legal obligations
Support requests	Fulfillment of user requests, performance of a contract, and legitimate interests
Retention of legally required records	Compliance with legal obligations
Legal claims and disputes	Establishment, exercise, or defense of legal claims
Non-essential analytics, measurement, or similar activities	Explicit consent where required under applicable law

For processing activities subject to the GDPR, the applicable legal bases may include Article 6(1)(a), 6(1)(b), 6(1)(c), and 6(1)(f) of the GDPR, depending on the nature of the processing. Where special categories of personal data must exceptionally be processed, Article 9 of the GDPR may apply.

Where the KVKK applies, personal data is processed on the basis of the applicable processing conditions set out in Article 5 of the KVKK, and special categories of personal data are processed in accordance with Article 6 of the KVKK.

Where processing is based on legitimate interests, ACTO GmbH may rely on legitimate interests such as ensuring application security, preventing misuse, improving services, responding to user requests, and maintaining the continuity of information systems. In such cases, a balance is maintained between ACTO GmbH’s legitimate interests and the fundamental rights and freedoms of the data subject.

Where processing is based on your explicit consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Data Stored Locally on Your Device

ActoPim may store certain information locally on your device in order to maintain your session, remember user preferences, display favorites, ensure application security, and enable the service to function properly.

Depending on the technical architecture of the application, secure local storage mechanisms, session storage, or similar technologies may be used for these purposes.

Device access, analytics, or measurement activities that are not strictly necessary for the operation of the service will be subject to your prior consent where required by applicable law.

Certain data stored on your device may be deleted when you sign out, delete your account, clear application data through device settings, or uninstall the application. Technical backups or records that must be retained by law may be excluded from this scope.

7. Camera and Barcode / QR Code Scanning

Camera access is requested in order to scan product barcodes or supported QR codes and provide access to the relevant product information.

Camera permission is required only for the relevant feature. You may disable camera access at any time through your device’s operating system settings. Disabling camera access may prevent barcode or QR code scanning but will not prevent you from using other features of the application that do not require camera access.

Images obtained through the camera are not stored as separate user content unless this is technically necessary for the operation of the application. If a future feature requires camera data to be transmitted to a server, users will be informed separately before such processing takes place.

8. Voice Search and Microphone Access

When the voice search feature is used on supported devices, access to the microphone or the operating system’s speech recognition feature may be requested.

The voice search feature is activated only when the user actively chooses to use it. Microphone or speech recognition permissions may be disabled at any time through your device settings. Disabling such permissions will affect only the voice search feature.

If speech recognition is performed by the device manufacturer, operating system provider, or another technical service provider, the privacy terms of the relevant provider may also apply.

9. Notifications

ActoPim may request permission to send notifications for important application information, security notices, reminders requested by the user, or other service-related communications.

You may change or disable notification permissions at any time through your device’s operating system settings. Disabling notifications does not prevent access to the core features of the application.

Where marketing or promotional electronic communications are sent, any additional consent or authorization requirements under applicable law will be observed.

10. Sharing of Personal Data and Categories of Recipients

Your personal data may be shared, where necessary for the provision of services and only to the extent required for the relevant purpose, with the following categories of recipients:

Hosting and server service providers.
Database and cloud infrastructure providers.
Email delivery and account verification service providers.
Technical support and software infrastructure providers.
Information security and system monitoring service providers.
Analytics and performance measurement service providers, where applicable.
Notification service providers.
Mobile operating system and application store service providers.
Other technical service providers processing data on behalf of and under the instructions of ACTO GmbH.
Competent public authorities, courts, regulatory authorities, and supervisory bodies where required by law.
Authorized legal, audit, and advisory service providers where necessary to protect legal rights.

Service providers processing personal data on behalf of ACTO GmbH are required to process such data only in accordance with ACTO GmbH’s instructions, for contractually specified purposes, and subject to appropriate security obligations.

Your personal data is not sold or rented to third parties for commercial purposes.

11. App Stores and Third-Party Services

If you download ActoPim through the Apple App Store, Google Play, or a similar application distribution platform, the relevant platform provider may independently process certain information such as device, account, download, payment, error, or usage data within the scope of its own services.

Such processing is subject to the relevant service provider’s own privacy policy and terms of use. ACTO GmbH may access only the information made available to it by the relevant platform and necessary for the management of ActoPim services.

12. International Transfers of Personal Data

As ACTO GmbH is established in Germany and technical service providers used for the ActoPim infrastructure may be located in different countries, your personal data may, in certain circumstances, be transferred outside your country of residence or processed abroad.

Where personal data subject to the GDPR must be transferred outside the European Economic Area, the transfer will be carried out on the basis of an adequacy decision adopted by the European Commission, appropriate safeguards, Standard Contractual Clauses adopted by the European Commission, or another lawful transfer mechanism permitted under the GDPR.

Where the KVKK applies to an international data transfer, such transfer will be carried out in accordance with Article 9 of the KVKK and the applicable secondary legislation concerning international transfers of personal data, on the basis of an adequacy decision, appropriate safeguards, standard contracts published by the Turkish Personal Data Protection Board, binding corporate rules, or another lawful transfer mechanism provided by law.

Depending on the nature of the transfer, contractual, technical, and organizational safeguards are implemented to protect the confidentiality, integrity, and security of personal data.

13. Retention Periods

Your personal data is not retained indefinitely. Data is retained only for as long as necessary for the relevant processing purpose and in accordance with applicable statutory retention, limitation, and record-keeping periods.

Account and profile information: May be retained for the duration of the active user account and, after account closure, for as long as required by legal obligations or legal claims.
Favorites and user preferences: May be retained until deleted by the user, the account is closed, or the data is no longer necessary for providing the relevant feature.
Search and usage data: May be retained for as long as necessary to provide the relevant functionality, ensure security, or improve services, after which it may be deleted or anonymized.
Technical and security logs: Retained for a reasonable and necessary period for information security, error investigation, and prevention of misuse.
Support requests: May be retained for the time necessary to resolve the request and, where required, manage legal claims.
Consent and preference records: May be retained for as long as necessary to demonstrate compliance with applicable law.

When the purpose of processing no longer exists and applicable legal retention periods have expired, personal data is deleted, destroyed, or anonymized.

14. Account Deletion

You may request deletion of your user account through the account deletion feature provided within the application or by contacting ACTO GmbH.

When an account is deleted, personal data retained solely for the purpose of providing the service and not supported by another valid legal basis will be deleted or anonymized.

Where certain data must be retained due to legal obligations, security records, dispute resolution, the establishment or defense of legal claims, or applicable legislation, only the data necessary for such purposes may be retained for the relevant statutory period.

15. Security of Personal Data

ACTO GmbH implements technical and organizational security measures appropriate to the level of risk in order to prevent unlawful processing of personal data, prevent unauthorized access, and ensure that personal data is stored securely.

Depending on the technical infrastructure and the nature of the processing, these measures may include:

Restricting access rights on a role-based and need-to-know basis.
Using authentication and authorization mechanisms.
Protecting data in transit using appropriate encryption methods.
Using secure server and database infrastructure.
Maintaining system and access logs.
Monitoring suspicious access and security incidents.
Applying regular data backup and business continuity measures.
Implementing security updates and necessary technical controls.
Entering into appropriate data protection agreements with data processors.

However, no method of data transmission over the internet or electronic storage can be guaranteed to be absolutely secure. ACTO GmbH applies the necessary and reasonable security measures required under applicable law to protect personal data.

16. Automated Decision-Making and Profiling

ActoPim does not carry out solely automated decision-making that produces legal effects concerning users or similarly significantly affects them.

If content rankings or recommendations are displayed based on favorites, previous usage, or user preferences, such processing does not constitute automated decision-making that produces legal effects concerning the user.

17. Children’s Privacy

ActoPim is not designed for children. The application is primarily intended for professional, commercial, and corporate use.

ACTO GmbH does not intentionally seek to collect personal data from children without the legal conditions required under applicable legislation.

If you are a parent or legal guardian and believe that personal data relating to your child has been unlawfully processed through ActoPim, you may contact us at info@actogmbh.com. The matter will be reviewed and appropriate action will be taken in accordance with applicable law.

18. Your Rights Under the GDPR

Where the GDPR applies, and subject to the applicable legal conditions, you may have the following rights:

The right to obtain confirmation as to whether your personal data is being processed and to request access to your personal data.
The right to request rectification of inaccurate or incomplete personal data.
The right to request deletion of your personal data where the legal conditions are met.
The right to request restriction of processing.
The right to data portability where the applicable conditions are met.
The right to object, on grounds relating to your particular situation, to certain processing activities based on legitimate interests.
The right to object at any time to processing for direct marketing purposes.
The right to withdraw your consent at any time with future effect where processing is based on consent.
The right to exercise the protections available under the GDPR in relation to decisions based solely on automated processing that produce legal or similarly significant effects.
The right to lodge a complaint with a competent data protection supervisory authority.

19. Your Rights Under the KVKK

Where the KVKK applies, you have the following rights under Article 11 of the KVKK:

To learn whether your personal data is being processed.
To request information if your personal data has been processed.
To learn the purpose of processing and whether your personal data is being used in accordance with that purpose.
To know the third parties to whom your personal data has been transferred domestically or abroad.
To request correction if your personal data has been processed incompletely or inaccurately.
To request deletion or destruction of your personal data where the conditions specified by law are met.
To request notification of correction, deletion, or destruction operations to third parties to whom your personal data has been transferred.
To object to an outcome that is detrimental to you resulting from the analysis of processed data exclusively by automated systems.
To request compensation for damages where you suffer damage as a result of unlawful processing of personal data.

20. How to Exercise Your Rights

You may submit requests relating to the processing of your personal data to info@actogmbh.com or use any other application method provided under applicable law.

In order to process your request securely and prevent disclosure of personal data to unauthorized persons, we may request reasonable additional information necessary to verify your identity.

Your request will be handled as soon as reasonably possible and within the time limits prescribed by applicable law, depending on the nature of the request.

Requests are generally handled free of charge. However, where fulfilling a request results in a separate cost and applicable law permits a fee to be charged, the applicable fee may be requested.

21. Right to Lodge a Complaint with a Supervisory Authority

If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority.

Under the GDPR, you may in particular lodge a complaint with the competent data protection authority in the European Union Member State of your habitual residence, place of work, or the place of the alleged infringement.

With respect to ACTO GmbH’s activities in Germany, your right to contact the competent German data protection supervisory authorities remains unaffected.

Where the KVKK applies, you may apply to the Turkish Personal Data Protection Board in accordance with the application procedures and conditions prescribed by law.

Contacting ACTO GmbH first at info@actogmbh.com may help resolve your concern more quickly. This does not affect your right to lodge a complaint with a competent supervisory authority.

22. External Links and Websites

ActoPim may contain links to websites, documents, or other online resources operated by ACTO GmbH or third parties.

Third-party websites and services are subject to their own privacy policies and terms of use. ACTO GmbH is responsible for independent processing activities carried out by third parties only to the extent attributable to ACTO GmbH under applicable law.

23. Changes to This Privacy Policy

ACTO GmbH may update this Privacy Policy and Data Protection Notice due to changes in legislation, improvements to the ActoPim application, the addition of new features, changes in the technical infrastructure used, or changes in personal data processing activities.

The current version of this notice will be made available within the ActoPim application and/or through the relevant online services of ACTO GmbH.

Where material changes significantly affect the processing of personal data, users may also be informed through an in-app notification, email, or another appropriate communication method. Where a change legally requires renewed explicit consent, the relevant processing activity will not be carried out without obtaining the required consent.

24. Contact

If you have any questions regarding this Privacy Policy, your personal data, or the data processing activities carried out within the scope of ActoPim, you may contact us using the details below: