Privacy Policy

Applies to silverfriend.de and related online offerings of Silverfriend GmbH. The mobile app is also covered by the App-specific Privacy Policy. Phone calls (companion service) are also covered by the Pre-call notice. The German Datenschutzerklärung is the legally binding original; this English version is a courtesy translation.

As of: 13 April 2026
Version: 1.0

1. Controller (Art. 4(7) GDPR)

Silverfriend GmbH
Döringstraße 6, 10245 Berlin, Germany
Email: datenschutz@silverfriend.de
Phone: to be announced

Managing Director: Feras Alsamawi — see Legal Notice.

2. Data Protection Officer

Until an external Data Protection Officer has been formally appointed by name, please reach us on any data-protection matter directly at:
Email: datenschutz@silverfriend.de
Postal: c/o Silverfriend GmbH, Döringstraße 6, 10245 Berlin, Germany

3. Scope and definitions

This policy explains:

• who we are and how to reach us,
• what personal data we process,
• why we process it and on what legal basis,
• who receives it,
• how long we store it,
• what rights you have and how to exercise them.

"Personal data" means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

4. Two data-subject roles

Our service involves two distinct categories of people with different roles:

1. Subscriber / family caregiver — the person who signs up and uses the app.
2. Senior / called person — the person our phone companion calls.

Each has its own rights and its own consent path. The senior's consent for voice processing is captured directly on the call, not through the caregiver's app — see Pre-call notice.

5. What we process and why

5.1 When you visit the website

Cookies and similar device-storage technologies: see Cookie Policy.

5.2 When you create a subscriber account

5.3 Phone companion (for the called senior)

5.4 Push notifications (app)

6. Express clarifications about the voice service

Two important points we want to make explicit:

1. SilverFriend does not analyse the senior's mood or mental state. No such assessments are produced or shared with the caregiver.

2. Exception — emergency: on concrete signs of acute danger (e.g. suicidal ideation or imminent harm), we ask the caregiver to check on the senior in person — without disclosing the content of the call. Legal basis: Art. 6(1)(d) GDPR (vital interests) read with Art. 9(2)(c) GDPR.

Speech model in use: Amazon Nova Sonic 2 via AWS Bedrock in EU region eu-central-1. Inputs are not used to train the base model under AWS terms.

7. Recipients and processors

A complete, current list is published at silverfriend.de/datenschutz/subprocessors.

Key recipients:

8. Transfers to third countries

Processing is in the EU by default (eu-central-1 Frankfurt, eu-north-1 Stockholm). Exceptions — control-plane access by certain US providers — are covered by EU Standard Contractual Clauses (Module 2) plus supplementary measures (encryption with customer-managed KMS keys, TLS 1.2+, data residency, logging).

The Transfer Impact Assessment is available from the DPO. We monitor the validity of the EU-US Data Privacy Framework for the listed US providers, all of which are DPF-certified.

9. Retention — overview

For each data category we have set a specific retention period (see tables above). Our full deletion strategy follows DIN 66398 and is documented internally — see DATA_RETENTION_SCHEDULE.

10. Your rights

As subscriber or as senior you have the right to:

• Access the data we process about you (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16),
• Erasure ("right to be forgotten", Art. 17),
• Restriction of processing (Art. 18),
• Data portability (Art. 20),
• Object to processing based on legitimate interest (Art. 21),
• Withdraw consent at any time, with effect for the future (Art. 7(3)),
• Lodge a complaint with a supervisory authority (Art. 77).

Please contact: datenschutz@silverfriend.de.

We respond within 30 days. Where identity verification is required we will request a suitable proof (e.g. confirmation from the registered email account). Seniors may submit requests via the caregiver or during a call ("nicht mehr anrufen" / "do not call again" stops further calls immediately).

Supervisory authority: Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin — https://www.datenschutz-berlin.de.

11. Automated decision-making

There is no automated decision-making within the meaning of Art. 22 GDPR. Specifically:

• We do not create credit, personality, or health profiles.
• The only model-supported decision is the detection of acute-danger signals (see §6); this triggers a human-oriented request for the caregiver to check in person — no automatic consequence.

12. Security (Art. 32 GDPR)

Among the technical and organisational measures we apply:

• Encryption of stored data with customer-managed KMS keys (AWS KMS),
• TLS 1.2+ for all transit,
• Role-based database access (Aurora role segregation),
• Credential management exclusively via AWS Secrets Manager,
• Web Application Firewall (AWS WAFv2),
• Logging of security-relevant events (CloudWatch),
• Quarterly security reviews and annual external audits.

13. Changes to this policy

We update this policy on material processing changes. Active subscribers are informed at least 14 days before the change takes effect by email or in-app banner. A change history appears at the end of this page (once changes occur).

14. Change history

As of 13 April 2026 · Controller: Management of Silverfriend GmbH · DPO: appointment in progress