Privacy Policy – caritag app

Privacy Policy_V1.0_March 2025
Information regarding the processing of personal data in conjunction with the mobile version of the caritag app

ETOSPHERES Labs GmbH („ETOSPHERES“) considers the protection and security of your personal data to be highly important. In the following document, you will find the information required in accordance with the General Data Protection Regulation (“GDPR”) regarding the processing of your personal data by ETOSPHERES in conjunction with your use of the mobile version of the caritag app (“app”).

 

1 Who is the controller under data protection law?

ETOSPHERES Labs GmbH | Hardtring 6 | 78333 Stockach | Germany | legally represented by its Managing Director Dr. Michael Schwabe („ETOSPHERES“)
provides you with the app for use and is responsible for the processing of your personal data as described in this Privacy Policy.

You can contact the person responsible for data protection at service@caritag.com

 

2 How can I contact the ETOSPHERES Data Protection Officer?

You can contact the Data Protection Officer of ETOSPHERES as follows:
The Data Protection Officer ETOSPHERES | c/o ETOSPHERES Labs GmbH | Hardtring 6 | 78333 Stockach | Germany | datenschutz@etogruppe.com

 

3 Which of my personal data is processed by ETOSPHERES?

In connection with your use of the app, ETOSPHERES processes the following categories of personal data:

 

3.1 Log data

When you use the app, ETOSPHERES processes the “log data” transmitted by your device to the app server, including in particular the following information:

• IP address of the device used
• Operating system version of the device used
• Date and time the connection was formed to the app servers / date and time of the last login
• Access token used
• IMEI/IMSI of bought and configured caritags

 

3.2 Setting data

ETOSPHERES processes the “setting data” transmitted by your device to the app server in conjunction with your use of the app, including in particular the following information:

• Information regarding the settings you select in the app (such as app language, app mode)

 

3.3 Account data

When you create an account for the app, ETOSPHERES collects “account data” from you, including in particular the following information:

Mandatory information:

• Email address
• User name

Voluntary information:

• Password hash
• Address
• Telephone number

 

3.4 Identifiers

In connection with your use of the app, “identifiers” are processed that enable ETOSPHERES to recognise you as a user, the end device you are using or a caritag you have connected to the app or displayed in the app. The identifiers include the following information in particular:

• User ID
• Device IDs:
  • IP address of the end device used
  • caritag ID

 

3.5 Location data

In connection with your use of the app (display of the route in real time), ETOSPHERES processes “location data” transmitted from your end device to the app’s servers, which includes the following information in particular:

• Information about your geographical location as well as the geographical location of the caritag if you have selected the route display in the app.

Furthermore, in connection with your use of the app, ETOSPHERES only processes fully end-to-end encrypted “location data” from your mobile device to the app’s servers, which includes the following information in particular

• Information on the geographical location of your caritags
• Information on the geographical location including time (for a track)

 

3.6 Usage data

In connection with your use of the app, ETOSPHERES may process “usage data”, which includes the following information in particular:

• Information on your use of individual functions of the app
• Information about crashes of the app

 

3.7 Correspondence data

Furthermore, the content of your correspondence with ETOSPHERES in writing or by e-mail (“correspondence data”) will be processed.

4 For what purposes, and on what legal basis does ETOSPHERES process my personal data?

 

4.1 Provision of the app and free functions

In order to make it possible for you to use the app and the free online functions available there, in particular the

• Functions for collecting and displaying location data
• Function for displaying a route
• Functions for sharing location data in a group
• Function for calibrating and configuring the caritag
• Function for displaying distances to other caritags and to the app user as well as compliance with any search zones assigned by the app user
• Alarm function when a defined search zone is exceeded by a caritag
• Search function for caritags
• Function for displaying, recording and saving tracks
•  

ETOSPHERES processes the following categories of personal data:

• Log data (section 3.1.)
• Setting data (section 3.2.)
• Account data (section 3.3.)
• Identifiers (section 3.4.)
• Location data (section 3.5.)

When you start processing your location data (opening the app and displaying your location on the map in the app), you will be asked for your consent to the processing of your location data. You can cancel this at any time in the settings of your mobile device (menu Settings/caritag App/Location/Never) and stop access to your location. ETOSPHERES only processes your location if you use the route function. ETOSPHERES never transmits location data from your mobile device to other users or third parties without your authorisation. Therefore, if you wish to share location data with other people, this is only possible via the share function in a caritag group if you actively select this and have consented to the transmission of location data (Section 13 (1) TDDDG).

Note: Information about your geographical location when you use the app (location data of the mobile device and the caritags, which are displayed on the map via the app) will not be viewed by ETOSPHERES or other recipients. The caritags and the app have been developed in such a way that the locations of the caritag devices can only be displayed in your app on your mobile device. There is no technical possibility or necessity for ETOSPHERES as the operator to localise your caritag devices or to view data. The location data exchanged between the app, the caritags and with the ETOSPHERES servers is only transmitted and stored completely end-to-end encrypted.

Exception: If you display the route in real time in the app, your mobile device sends the location data of your mobile device and your caritags to the ETOSPHERES servers in non-end-to-end encrypted form. This data processing is strictly limited in time to the duration of your use of the route function (deletion at the end of the usage session).

 

4.2 Guaranteeing security for the IT infrastructure used to provide the app

ETOSPHERES may process the following categories of personal data to ensure the IT security and availability of the IT infrastructure used to provide the app:

• Log data (section 3.1.)
• Account data (section 3.3.)
• Identifiers (section 3.4.)

The legal basis for this is Art. 6 para. 1 subpara. 1 lit. f) GDPR (balancing of interests). ETOSPHERES has a legitimate economic interest in ensuring the security of the app’s IT infrastructure, in particular for the detection, elimination and conclusive documentation of malfunctions (e.g. DDoS attacks) and troubleshooting in the app.

 

4.3 Fulfilment of statutory retention obligations

ETOSPHERES processes the following categories of personal data for the fulfilment of statutory retention obligations:

• Account data (section 3.3.)

The legal basis for this is Art. 6 para. 1 subpara. 1 lit. c) GDPR (legal obligation) insofar as the processing serves to fulfil ETOSPHERES‘ retention obligations under the law of the European Union or the member states.

Insofar as the processing serves the fulfilment of storage obligations in countries outside the European Union, the legal basis is Art. 6 para. 1 subpara. 1 lit. f) GDPR (balancing of interests). ETOSPHERES has a legitimate legal interest in fulfilling its legal obligations in third countries.

 

4.4 Cooperation with authorities and courts

In order to cooperate with authorities or courts, in particular to fulfil statutory disclosure obligations, ETOSPHERES may process all categories of personal data listed in section 3.

The legal basis for this is Art. 6 para. 1 subpara. 1 lit. c) GDPR (legal obligation) insofar as ETOSPHERES is obliged to disclose certain information to authorities or courts under the law of the European Union or the member states.

Insofar as the processing serves the fulfilment of legal obligations in countries outside the European Union, the legal basis is Art. 6 para. 1 subpara. 1 lit. f) GDPR (balancing of interests). ETOSPHERES has a legitimate legal interest in fulfilling its legal obligations in third countries.

 

4.5 Fulfilling legal obligations towards other users and third parties

ETOSPHERES may process all of the categories of personal data listed in section 3 in order to fulfil legal obligations it has towards other users and third parties, in particular obligations to provide information.

The legal basis for said processing is Art. 6 para. 1 subpara. 1 lit. c) GDPR (legal obligation) if ETO DYNAMIC is obligated to undertake certain types of processing in the interest of other users or third parties under the law of the European Union or the member states.

Insofar as the processing serves the fulfilment of legal obligations in countries outside the European Union, the legal basis is Art. 6 para. 1 subpara. 1 lit. f) GDPR (balancing of interests). ETOSPHERES has a legitimate legal interest in fulfilling its legal obligations in third countries.

 

4.6 ETOSPHERES asserting, exercising or defending legal claims

ETOSPHERES may process all categories of personal data listed in section 3 for the assertion, exercise or defence of its own legal claims against you, other users and/or third parties.

The legal basis for this is Art. 6 para. 1 subpara. 1 lit. f) GDPR (balancing of interests). ETOSPHERES has a legitimate legal interest in the assertion, exercise or defence of its own legal claims.

 

5 Am I obligated to provide my personal data to ETOSPHERES, and what will the consequences be if I do not do so?

Categories of data	Obligation to provide / necessity to conclude a contract	Consequences of not providing data
Log data (section 3.1)	Providing this data is not required by law or contract.	If the data is not provided, you will not be able to use the app.
Setting data (section 3.2)	Providing this data is not required by law or contract.	If the data is not provided, you will not be able to use the app.
Account data (section 3.3)	Providing this data is not required by law or contract, however the data is necessary to conclude a usage agreement for the app between yourself and ETOSPHERES.	If the data is not provided, you will not be able to use the app.
Identifiers  (section 3.4)	Providing this data is not required by law or contract.	If the data is not provided, you will not be able to use the app.
Location data (section 3.5)	Providing this data is not required by law or contract.	If the data is not provided, you will only be able to use the app with restrictions.
Usage data (section 3.6)	Providing this data is not required by law or contract.	None
Correspondence data (section 3.7)	Providing this data is not required by law or contract.	None

 

6 To whom, and to which third countries is my personal data transmitted?

 

6.1 Transmission from ETOSPHERES to ETO DYNAMIC Connect GmbH

6.4 Transmission from ETO GRUPPE TECHNOLOGIES GmbH to further contract processors

 

Purpose of transmission:	Provision of ticket system for user enquiries and complaints
Recipient:	SAP Deutschland SE & Co. KG
Role of the recipient:	Further contract processor
Location of data processing:	European Union

 

6.5 Transmission to further recipients

 

Purpose of transmission:	Cooperation with authorities and courts, fulfilling legal obligations towards authorities and courts and exercising the rights of ETOSPHERES
Recipient:	Courts and authorities
Role of the recipient:	Controller

7 How long is my personal data stored?

Categories of data	Storage duration
Log data (section 3.1)	Log data is generally stored on ETOSPHERES‘ servers from the time you start the app, and deleted or anonymised when you end the app (storage during each usage session). In deviation from this, the date (including time) of your last login to the app will continue to be stored even after you end your usage session. The data of your last login will generally be deleted one week after your account for the app is deleted. If you delete the app from your mobile device, the log data for the app will be deleted immediately, but no later than one week after the deletion of your account. It is not possible to restore the account. If an incident occurs that is relevant for security or legal reasons, ETOSPHERES shall store the log data relevant for this purpose in each individual case until the incident relevant for security or legal reasons is corrected and clarified in full, or, in case of a legal dispute, to the end of the dispute.
Setting data (section 3.2)	Your current setting data will be stored on the ETOSPHERES’ servers from the time you register as a user of the app and will be deleted from the app immediately, but no later than one week after deletion of your account. It is not possible to restore the account.
Account data (section 3.3)	Your current account data will generally be stored on ETOSPHERES’ servers from the time you register as an app user and will be deleted at the latest one week after you delete your account for the app. It is not possible to restore the account. If an incident occurs that is relevant for security or legal reasons, ETOSPHERES shall store the account data relevant for this purpose in each individual case until the incident relevant for security or legal reasons is corrected and clarified in full, or, in case of a legal dispute, to the end of the dispute.
Identifiers (section 3.4)	The IP address of the end device used, the user ID and the varitag ID will be stored on the ETOSPHERES servers from the time you start the app and use a caritag and will be deleted for the app immediately, but no later than one week after deletion of your account. It is not possible to restore the account. If an incident occurs that is relevant for security or legal reasons, ETOSPHERES shall store the identifiers relevant for this purpose in each individual case until the incident relevant for security or legal reasons is corrected and clarified in full, or, in case of a legal dispute, to the end of the dispute.
Location data (section 3.5)	Information on the geographical location of the caritags is generally transmitted to the ETOSPHERES servers exclusively in fully end-to-end encrypted form from the time you start the app and activate the caritags, stored and deleted after 24 hours at the latest. Tracks are only stored on the mobile device. When using the route display function, information about your geographical location while using the app, the location of the caritags and your route will be transmitted to the ETOSPHERES servers from the time you allow access to your location, select the route function and activate the caritags, stored and deleted when you stop using the app (storage per usage session). If you delete the app from your mobile device, the location data for the app will be deleted immediately. It is not possible to restore the account. In the event of a security / or legally relevant incident, ETO DYNAMIC stores the relevant location data in individual cases until the security / or legally relevant incident has been fully clarified and, in the event of any legal disputes, until their conclusion.
Usage data (section 3.6)	Your usage data is generally stored on the ETOSPHERES servers from the time you start the app (storage per usage session) and deleted or anonymised four weeks after the end of the respective usage session. If you delete the app from your mobile device, the usage data for the app will be deleted immediately, but no later than one week after the deletion of your account. It is not possible to restore the account.
Correspondence data (section 3.7)	The storage period of correspondence data depends on the content of the correspondence. If it has legally relevant content, ETOSPHERES will store it for three years from the end of the year in which the correspondence took place and, in the event of any legal disputes, until their conclusion. If the correspondence is categorised as a commercial letter, the storage period is six years from the end of the year in which the correspondence took place. In certain cases, however, the storage period may be up to thirty years.

8 What rights do I have with respect to the processing of my personal data?

As a data subject, you have the following rights with respect to the processing of your personal data described above. In order to exercise these rights, get in touch with ETOSPHERES using the contact information provided in section 1.

• Right to information, Art. 15 GDPR: You have the right to determine which of your personal data has been processed. This includes further information on data processing, such as the purpose, legal basis and recipient. You also have the right to request a copy of your personal data.
• Right to rectification, Art. 16 GDPR: You have the right to request rectification of your personal data if it is incorrect, and to request that incomplete personal data be supplemented.
• Right to deletion (“Right to be forgotten”), Art. 17 GDPR: In cases specified by law, you can request that your personal data be deleted. This is the case, for instance, if the data is no longer needed for the purpose for which it was originally collected, or if the data has been processed illegally.
• Right to restrict processing, Art. 18 GDPR: You can request that the processing of your personal data be restricted; in this case, processing may be carried out only in cases as required by law (such as with your consent or in order to exercise or defend our rights). You have the right to do so, for instance, if you dispute that the data is correct.
• You also have the right to data portability, Art. 20 GDPR: In particular, you have the right to receive your personal data which you have provided to ETO DYNAMIC in a structured, commonly used and machine-readable format, and the right to transmit this data to other controllers without being prevented from doing so by ETO DYNAMIC, if the processing is based on your consent or in order to perform the contract and carry out measures prior to entering into a contract, or based on Art. 6 para. 1 subpara. 1 lit. b) GDPR (performing a contract and steps prior to entering into a contract).
•  

In addition, of course, you always have the right to submit complaints to a supervisory authority, Art. 77 GDPR: You have the right to submit complaints to a data supervisory authority if you believe that the processing of your personal data violates the GDPR.

You can determine the full scope of your rights under the articles above, which you can access at the following link: http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679. Your rights may be restricted in individual cases in whole or in part under the law. 

 

Right of revocation

You have the right to revoke your consent at any time (Art. 7 para. 3 GDPR). In this case, your personal data covered by your consent will no longer be processed by the controller. Revocation of consent will not affect the legality of processing carried out until the consent was revoked.

 

Right to object

You have the right to object to the processing of your personal data as carried out in accordance with Art. 6 para. 1 subpara. 1 lit. f) GDPR (see section 4) at any time due to your personal situation (Art. 21 para. 1 GDPR). In this case, your personal data will no longer be processed by the controller unless the controller can verify that they have mandatory protected reasons for the processing that outweigh your interests, rights and freedoms, or if the processing is carried out for the purpose of asserting, exercising, or defending against legal claims.