Privacy Statement – DDigit Collection Mobile

1. Which data do we process?

The app collects only data that is necessary for the operation of the application. Depending on your use, this may include:

1.1 User data

This data is managed by your organization via Single Sign-On (such as Microsoft Entra ID):

• Name
• Email address
• User ID

1.2 Application data

• Object and location data entered by the user (for example, when registering movements).
• Timestamps and technical logs for troubleshooting purposes

1.3 Automatically collected technical data

• App version
• Device type and operating system
• Crash logs or error reports

We do not collect GPS location data, contacts, photos outside of explicit uploads, or tracking data for advertising purposes.

2. How do we obtain data?

Data is obtained:

• directly from the user, or
• provided by the user’s organization via a secure SSO integration.

3. For what purposes do we use the data?

We process data exclusively for the following purposes:

• operation of the app
• registration of object movements
• authorization and authentication (SSO)
• crash and error analysis to improve the app
• security purposes and prevention of misuse

4. Do we share data with third parties?

We share data only when necessary:

• with your organization
• with hosting and infrastructure providers (e.g. Microsoft Azure)
• with crash and error analysis providers

We never sell personal data to third parties.

5. Data retention periods

We do not retain data longer than necessary:

• Operational data: in accordance with agreements with your organization
• Log files: up to 90 days, unless further investigation is required
• User accounts: managed by your organization

6. Security

We take appropriate technical and organizational measures, including:

• encrypted communication (TLS)
• secure storage on servers located within the EU
• access control via SSO (Entra ID)
• restricted access for support staff

7. User rights

Under the GDPR, you have the right, among other things, to:

• access
• rectification
• erasure (where possible within the agreements with your organization)
• restriction of processing
• data portability
• object

Requests must be submitted via your own organization.

8. Data controller

The primary data controller is the organization that grants you access to the app. Double Dig IT acts as a data processor on behalf of this organization.