Privacy policy

This English text is a courtesy translation. Only the German version is legally binding.

1. Privacy at a glance

General information

The following information gives an overview of what happens to your personal data when you use our services. Personal data is any data that can be used to identify you personally. This privacy policy applies to:

• the website cyface.de,
• the web application Cyface Dashboard at cyface.de/app,
• the Cyface mobile app for Android and iOS.

Controller

Contact person for data protection: Dr. Klemens Muthmann, klemens.muthmann@cyface.de

How do we collect your data?

Some data is collected when you provide it to us, for example when you register or contact us. Other data is collected automatically by our IT systems when you visit the website, use the dashboard or record data with the app.

What do we use your data for?

We process your data to provide the website, the dashboard and the app, to manage user accounts, to analyse and display the data recorded with the app, to ensure the security and stability of our systems, and to analyse and improve the website and the registration process.

What rights do you have?

Subject to the legal requirements, you have in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority. See section 8 for details.

2. Hosting and storage

Our website, the dashboard and the servers to which the app transfers data are hosted by Hetzner Online GmbH and netcup GmbH.

Both providers process personal data as processors. A data processing agreement pursuant to Art. 28 GDPR is in place with each of them for this purpose. In the event of an attack, netcup may automatically collect log files that can contain personal data. This data is kept for a maximum of 14 days. The processing is based on Art. 6 (1) (f) GDPR; our legitimate interest is the secure, stable and efficient provision of our services.

3. Website

Server log files

Each time you access our website or the dashboard, our system automatically collects data that your browser transmits. This includes in particular:

• the IP address of the accessing device
• the date and time of access
• the page or file requested and the amount of data transferred
• whether the request was successful
• the browser and operating system used
• the referrer URL

This data is technically necessary to display the website and to ensure stability and security. It is not merged with other data sources or analysed for advertising purposes. The legal basis is Art. 6 (1) (f) GDPR. Log file data is deleted after seven days at the latest, or altered so that it can no longer be linked to the accessing client, unless longer storage is necessary to investigate security incidents or to establish, exercise or defend legal claims.

No cookies, no third-party services

The website does not set cookies, does not use analysis or tracking services of third parties and does not embed third-party content. Fonts and images are delivered from our own server. No connection to external servers is established when you visit the website.

Usage statistics

To improve the website and the registration process, and to analyse through which channels users become aware of Cyface, we may count the page views of the website and the registrations in aggregated form. The following information in particular is processed:

• the page accessed or the campaign identifier
• a reference code from the URL
• the category of the traffic source, for example the code of a campaign or an advertisement
• the day of the page view or of the registration

Our servers determine the traffic source from the address of the page accessed. Identifiers from advertising links, for example click IDs, are only assigned to a category and are not stored. The page views are counted per traffic source and day. No identifier is stored in your browser for these statistics (no cookie, no localStorage, no sessionStorage), and no visitor profile is created. The counts of the page views are not linked to your user account. We count registrations from the data that is stored with the registration (see section 4).

This data is used only for internal analyses. It is not passed on to third parties and is not used for advertising by third parties. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the analysis and improvement of the website and the registration process and the measurement of the success of our invitation and information channels.

Contacting us

If you contact us by email, phone or in a meeting, we process your details to handle your enquiry and possible follow-up questions. We keep notes of conversations where they are relevant for the business relationship, for example feedback and questions.

The “Write an email” buttons open a draft in the email program that you have set up. The draft already contains information about the context of your enquiry, for example its topic and the page from which you write; you can change it before you send it. We receive this information only when you send the email. If you use a web-based email service, it receives the draft as soon as it opens.

The legal basis is Art. 6 (1) (b) GDPR (initiation or performance of a contract) or Art. 6 (1) (f) GDPR (our legitimate interest in handling your enquiry). We keep messages and notes as long as the business relationship requires them, and at least for the statutory retention periods of business letters. On request, we delete your data unless a retention obligation applies.

4. Registration and user account

You need to register to use the dashboard and the app. Registration and login use our login service (Keycloak), which runs on our servers. The following data is processed:

• first and last name
• municipality (or “not specified”)
• email address
• password or authentication data
• time of registration and of the consent to this privacy policy or the terms of use
• where applicable, an invitation code, link or QR code to which the user account is linked; you are informed about this during registration and can also register without an invitation

Registration serves to create and manage your user account, to log you in, to display the data you recorded yourself and to delete this data pursuant to Art. 17 GDPR. Your consent to this privacy policy or the terms of use is stored on the server side in the login service during registration. The login service sets technically necessary cookies, with which it recognises your session during and after the login (§ 25 (2) no. 2 TDDDG). Registration data is not passed on to third parties unless stated otherwise in this privacy policy.

The legal basis is Art. 6 (1) (b) GDPR, where registration serves the performance of a contract or pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR; our legitimate interest is to provide registered users with access to the dashboard and the app. The data is deleted once the user account is deleted, unless statutory retention obligations apply. You can delete your user account in the dashboard or in the app, or request its deletion or correction at support@cyface.de.

Anti-bot service hCaptcha

On the registration page, we use the anti-bot service hCaptcha of Intuition Machines, Inc., USA. hCaptcha checks whether input comes from a human or an automated program and protects the registration against abuse and spam. For this purpose, hCaptcha may process in particular the IP address, browser and device information, the time spent on the page and interaction data such as mouse movements.

Intuition Machines processes the data as a processor; a data processing agreement is in place for this purpose. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is protecting our services against automated abuse. Data may be transferred to the USA; this is based on the EU-U.S. Data Privacy Framework or on standard contractual clauses. Further information: https://www.hcaptcha.com/privacy

5. Cyface Dashboard

Storage of data in the browser

The dashboard stores the data that is technically necessary for the login in the localStorage of your browser: the authentication tokens (access, refresh and ID token) and their expiry time, your user name and user ID, and the configuration of the login service. During the login, the dashboard also stores the login request with its security parameters for a short time; it is deleted when the login is complete. The Mapbox map library stores a random identifier there (see “Mapbox map service”). The tokens are used to authenticate you when requests are sent to our servers. This data is deleted when you log out. The dashboard does not set cookies; for the cookies of the login service, see section 4.

Temporary data that is required for the current use can be stored in the sessionStorage, for example a session identifier and temporary states of the application. The sessionStorage is deleted automatically when the browser tab is closed.

Storage and access are strictly necessary and therefore based on § 25 (2) no. 2 TDDDG; further processing is based on Art. 6 (1) (f) GDPR or, where applicable, Art. 6 (1) (b) GDPR.

Mapbox map service

After login, the dashboard uses, in the map view, the map service Mapbox of Mapbox, Inc., USA, to provide maps, map tiles and the address search. A connection to Mapbox servers is established, and in particular the IP address, technical browser and device information, the time of the request, the requested map areas and address search queries may be transferred. The map library stores a random identifier and the time of the last transfer in the localStorage; Mapbox uses this data to count the map loads. Mapbox is not loaded on the public website.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the map-based presentation of the analyses. Where the map functions are required to provide contractually owed services, Art. 6 (1) (b) GDPR is an additional legal basis. A data processing agreement is in place with Mapbox, where Mapbox processes personal data on our behalf. Mapbox may transfer data to the USA; this is based on the EU-U.S. Data Privacy Framework or other appropriate safeguards. Further information: https://www.mapbox.com/legal/privacy

Error tracking with Sentry

To ensure stable and secure operation, the dashboard uses Sentry, a service of Functional Software Inc., USA, after login. Sentry is used to detect, analyse and fix technical errors. The processing takes place on servers in the European Union (EU data residency). Sentry is started after login and stopped at logout. A separate consent is not required for this, because the processing serves the stability, security and functionality of the dashboard and is described in this privacy policy.

In the event of an error, the following information in particular may be transmitted to Sentry:

• error messages and technical details of the error
• information about the use of the dashboard immediately before the error (so-called breadcrumbs)
• the date and time of the error
• technical information such as the operating system, browser and screen resolution
• the address of the page on which the error occurred, without authentication data
• the version of the application

Sentry is configured to remove authentication data such as tokens, cookies and passwords before transmission and not to store IP addresses or user data in the error events. The IP address may nevertheless be processed when the technical connection is established. Session Replay is not enabled. The data is not used for advertising purposes and is deleted after 90 days at the latest.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the stability, security and functionality of the dashboard. Functional Software Inc. processes the data as a processor; a data processing agreement is in place for this purpose. You can object to the processing pursuant to Art. 21 GDPR on grounds relating to your particular situation; please contact support@cyface.de. Further information: https://sentry.io/privacy/

6. Cyface app

Recorded data

While you record with the app, the following data is recorded continuously:

• geographic coordinates (longitude, latitude, altitude and the estimated horizontal and vertical accuracy)
• air pressure data from the barometer to calculate the altitude
• 3-axis acceleration data, 3-axis angular acceleration data and 3-axis magnetometer data
• a pseudonymous identifier that allows data from the same device to be recognised
• the link to your user account
• the smartphone model and the operating system version

Location data is recorded at intervals of at least one second, the other sensor data up to the maximum frequency supported by the hardware. The data is transferred via an encrypted connection to our servers in Germany and stored there for further processing. You start and stop the recording yourself in the app.

Purpose and legal basis

We analyse the data in particular to determine the condition of cycle paths and traffic information. We display the results to you in the dashboard. In aggregated and anonymised form, we use them in map-based presentations and provide them to our partners for analyses and applications built on them.

As part of research and development projects, the recorded data is made accessible to the partners of these projects. A written joint controllership agreement pursuant to Art. 26 GDPR is in place with these partners.

The legal basis is Art. 6 (1) (b) GDPR, where the recording serves the performance of a contract with you, and otherwise your consent pursuant to Art. 6 (1) (a) GDPR, which you give by registering and starting a recording. For storage in log files, the legal basis is Art. 6 (1) (f) GDPR.

Storage period and deletion

Measurement data is deleted as soon as the purpose of storage no longer applies (for example when the related project ends) or when you delete the data or your user account. Log file entries are deleted after seven days at the latest, or altered so that they can no longer be linked to you. You can withdraw your consent at any time with effect for the future by not starting any further recordings and by deleting your data in the app or requesting its deletion at support@cyface.de.

Google Maps map service (Android)

The Android app shows your position and your trips on a map. For this purpose, it uses the map service Google Maps of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map is displayed, a connection to Google servers is established. In particular, the IP address, device information, the displayed map area and the time of the request may be transferred to Google. The iOS app does not contain a map.

To determine the position, the Android app uses the location services of the operating system (Google Play services). Depending on the settings of your device, for example Google Location Accuracy, Google may process location data under its own terms. You can change these settings in the location settings of your device.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the map-based presentation of your recordings in the app. Google may transfer data to the USA; this is based on the EU-U.S. Data Privacy Framework or on standard contractual clauses. Further information: https://policies.google.com/privacy

Error tracking with Sentry (Android)

To ensure stable and secure operation, the Android app uses Sentry (see section 5) after login. Sentry is started after login and stopped at logout. In the event of an error, in particular error messages, information about the use of the app immediately before the error, the date and time, device information (operating system, app version, device model), the device status (for example battery level, memory, connection type, language, time zone) and a pseudonymous device identifier may be transmitted. Authentication data and user data are removed before transmission. The processing takes place on servers in the European Union. The iOS app does not use error tracking.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the stability, security and functionality of the app. You can object to the processing pursuant to Art. 21 GDPR on grounds relating to your particular situation; please contact support@cyface.de. The data is deleted after 90 days at the latest.

7. SSL/TLS encryption

The website, the dashboard and the app use SSL/TLS encryption for the secure transmission of data. You can recognise an encrypted connection by the address bar of your browser starting with “https://” and, in many browsers, by a lock symbol.

8. Rights of the data subject

If your personal data is processed, you have in particular the following rights, subject to the legal requirements:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of a given consent with effect for the future (Art. 7 (3) GDPR)
• lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

An informal message to support@cyface.de or to the address above is sufficient to exercise your rights.

The supervisory authority usually responsible for Cyface GmbH is:

9. Changes to this privacy policy

We update this privacy policy whenever changes to our services or to the legal situation make this necessary. The current version on this page always applies.