Privacy Policy for the “BOMAP” App

A. Name and contact details of the Data Controller
 
B. Name and contact details of the Data Protection Officer
 
C. Scope of processing of the personal data 

    1.   Downloading the app
    2.   Using the app
    3.   Contact details for the user / BOMAG GmbH support services
    4.   Using the Google Play Store statistics feature
    5.   Direct mail advertising

 
D. Rights of data subjects

A. Name and contact details of the Data Controller
 

In accordance with the General Data Processing Regulation and additional data protection regulations governing data processing, the Data Controller is:

BOMAG GmbH
Hellerwald, 56154 Boppard, Germany
Tel.: 06742 / 100-0
Fax: 06742 / 100 3090
Email: info@bomag.com 
Website: www.bomag.com 

Legal representatives: Ralf Junker, Dirk Woll, Dr. Ingo Ettischer

Contact details: see above

B. Name and contact details of the Data Protection Officer


The Data Protection Officer for the Data Controller is

Andreas Mallmann

Andreas Mallmann,
c/o BOMAG GmbH, Hellerwald, 56154 Boppard, Germany
Tel.: 06742 / 100-0
Fax: 06742 / 3090
Email: datenschutz.de@bomag.com

C. Scope of processing of the personal data


1. Downloading the app

We do not collect personal data when users download the app. Data is collected by the operator of the App Store where you created a user account, and transfers the app to your device.


2. Using the app

The app logs the current location of the mobile device using the GPS signal and a precision antenna connected via Bluetooth (optional).

The app is connected to the relevant BOMAG compactor via interface measuring technology and records the following values measured via the compactor. These include:

  • EVIB compaction measurement value at the relevant position
  • Number of crossings over a location
  • Temperature
  • Speed
  • Amplitude selected
  • Frequency
  • Compactor serial number
     

This data is stored exclusively on the user's device locally, and is not transmitted to BOMAG GmbH. The app therefore requires access to the memory of your device to store the data.

Operators wishing to use a precision antenna for measurements will need the previous reading of the QR code to activate it. The serial numbers of the compatible antennas are stored in the app and are regularly updated. After reading the QR code required by the app to authorize access to the camera on the mobile device, a compatibility check is carried out. The activation is stored in the app settings. The image data is never transmitted to BOMAG.

The app contains no integrated analysis tools (which log the use of the app), and we do not therefore collect any personal data when the app is used.


3. Contact details for the user / BOMAG GmbH support services

Should errors occur when using the app or should you contact BOMAG GmbH as the manufacturer of the app for other reasons, we process the data submitted by you to respond to/fulfil your request. If you provide us with your name and postal address, we process this information in accordance with no. C 5 (direct mail advertising).

The information we collect will be deleted when it is no longer necessary to fulfil the purpose for which it was collected. If the request relates to a contract that has been concluded or negotiated, the content and dates of such communication will be stored until any claims thereon have expired.

In all other cases, personal information contained in your email request will be restricted for further processing and will only be used to defend potential legal claims once the conversation with you has ended. The conversation ends when it can be inferred from the circumstances that the facts are finally clarified. The data will be deleted upon expiry of the limitation period.

The legal basis for this is art. 6 para 1 letter f GDPR. If the purpose of the contact is to conclude a contract, the additional legal basis for processing is Art. 6 para 1 letter b GDPR.

No data is disclosed to third parties in this context. The data is used exclusively for processing and responding to contact requests. We use our own web server and our own IT system to transmit and process contact requests.

Right to object
You may object to the use of your personal data at any time insofar as the legal basis for processing is Art. 6 para1 letter f GDPR. In this case, the conversation cannot continue. Section D also applies.


4. Using the Google Play Store statistic feature


The Google Play Store provides us with the following statistical information in the form of reports:

  • App installs per day/week/month
  • App uninstalls per day/week/month
  • Average rating of the app by the user
  • Number of ratings received
  • App crashes and “app is not responding” (ANR) error messages from Android devices, the users of which have agreed to automatically report usage and diagnostic information
  • App installs per country
  • Display of the top 5 countries for downloads
  • Number of Android devices online at least once in the last 30 days and on which the app is installed
  • Number of devices on which an app update was installed
  • Number of users who installed the app on at least 1 device for the first time
  • Number of users who uninstalled the app on all their devices
  • Number of app installs on devices, including devices on which the app was previously uninstalled and then reinstalled
  • Number of app updates
  • Number of app uninstalls
  • Number of devices on which the app was launched at least once a day
  • Number of times the app was opened per day
  • Version types of the Android operating system reported by the user’s device
  • Type and number of device names on which the app is installed
  • User language settings for the Android operating system
  • User’s network operator, if applicable
  • Number installed per app version


Der BOMAG GmbH can only access the listed, aggregated, i.e. summarized, collected data per category. No information per device/app used is made available to BOMAG GmbH. The information cannot be attributed to you personally as a user, i.e. username/account/email address/IP address/device ID no. of the compactor or other information.

This data is collected and evaluated for technical, development and marketing purposes.


5. Direct mail advertising

When you provide us with your name and postal address, we store this information for potential future direct mail advertising for our products. The data may be made available to external service providers when franking and sending the direct mail advertising, who are acting under our instructions and on our behalf, and who are based in the European Union. No further disclosure to third parties takes place. Data is deleted when it is no longer necessary to fulfil the purpose for which it was collected, or if you have objected to the processing of such data.

The legal basis for this data processing is Art. 6 para 1 letter f GDPR. The sending of product information via the post is in the legitimate interest of our company.

Right to object
You may object to the use of your personal data at any time, in which case we will cease sending direct mail advertising. Section D also applies.

D:     Rights as data subject

As the data subject, you have the right to obtain information free of charge about the personal data we have stored about you, as well as the right to rectification, restriction of processing, erasure, third-party notification, data portability, objection, withdrawal of data protection consent, prevention of automatic decision-making, and/or complaints to the responsible supervisory authority for data protection, if necessary. Further details can be found in the additional information below.

If you have any questions about data processing or to assert your rights, please contact us, as the Controller, or our Data Protection Officer; see the contact information provided in A and B of this text.

 

1. Right to information

If we process your personal data, you have the right to request information from us as the Controller, free of charge, about whether we are processing your personal data. If this is the case, you as the data subject have the right to obtain information about this personal data, including the following:

  • the purposes for which the personal data is processed;
  • the categories of personal data being processed;
  • the recipients or categories of recipients to whom your personal data is disclosed or will be disclosed;
  • the period for which your personal data will be stored or, if specific information cannot be provided here, the criteria used to determine this period;
  • the existence of the right to request the rectification or erasure of your personal data, the right to restrict processing by the Controller, or the right to object to such processing;
  • the existence of the right to lodge a complaint with a supervisory authority;
  • all available information about the origin of the data if the personal data is not collected from you as the data subject;
  • the existence of automated decision-making, including profiling, pursuant to Art. 22 Sec. 1 and 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you as the data subject.
     

You have the right to request information about whether your personal data is transmitted to a third country or to an international organization. In this context, you can ask to be informed of the appropriate guarantees pursuant to Art. 46 GDPR in conjunction with this transmission.



2. Right to rectification

You have the right to obtain rectification and/or completion from us as the Controller if your processed personal data is inaccurate or incomplete.
 
 
3. Right to restriction of processing

You can request the restriction of processing for your personal data where one of the following requirements applies:

  • if you contest the accuracy of your personal data, data processing will be restricted for a period enabling us as the Controller to verify the accuracy of the personal data;
  • if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
  • if we as the Controller no longer need the personal data for the purpose of the processing, but you need it in order to establish, exercise or defend legal claims; or
  • if you object to processing pursuant to Art. 21 Sec. 1 GDPR and we as the Controller are reviewing the lawfulness of the matter. If it has not yet been determined whether the Controller’s legitimate interests override your interests, data processing will be restricted.
     

If processing of your personal data has been restricted, such data shall, with the exception of storage, only be processed with your consent or in order to establish, exercise or defend legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or a member state.

If processing has been restricted as per the above requirements, you will be notified by us as the Controller before this restriction is lifted.



4.    Right to erasure
 

a) Erasure obligation

You can ask us as the Controller to immediately erase your personal data, and we as the Controller are obligated to erase this data immediately where one of the following grounds applies:

  • Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
  • You withdraw your consent upon which the processing was based pursuant to Art. 6 Sec. 1 lt. a or Art. 9 Sec. 2 lt. a, and there is no other legal basis for the processing.
  • You object to processing pursuant to Art. 21 Sec. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. Sec. 2 GDPR.
  • Your personal data was unlawfully processed.
  • Your personal data must be erased in order to comply with a legal obligation under Union or member-state law to which the Controller is subject.
  • Your personal data was collected in relation to the offer of information security services pursuant to Art. 8 Sec. 1 GDPR.
     

b) Notification of third parties

Where we as the Controller have made your relevant personal data public and are obliged pursuant to Art. 17 Sec. 1 GDPR to erase this personal data, we as the Controller, taking into account the available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform third parties that you as the data subject have requested the erasure by these parties of any links to, or copy or replication of, this personal data.

c) Exceptions

The right to erasure and to third-party notification shall not apply to the extent that processing is necessary:

  • to exercise the right of freedom of expression and information;
  • to comply with a legal obligation that requires processing under Union or member-state law to which we as the Controller are subject; or
  • to perform a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  • for reasons of public interest in the area of public health pursuant to Art. 9 Sec. 2 lt. h and i as well as Art. 9 Sec. 3 GDPR;
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 Sec. 1 GDPR, in so far as the right referred to in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  • to establish, exercise or defend legal claims.
     


5. Right to notification

We will notify all recipients of your personal data about any rectification, erasure or restriction of processing unless this is impossible or requires unreasonable effort.
You have the right to be notified by us as the Controller about these recipients.


6. Right to data portability

You have the right to receive your personal data, which you have provided to us as the Controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us as the Controller to which the personal data was provided, where:

  • the processing is based on consent pursuant to Art. 6 Sec. 1 lt. a GDPR or Art. 9 Sec. 2 lt. a GDPR or on a contract pursuant to Art. 6 Sec. 1 lt. b GDPR; and
  • the processing is carried out by automated means.
     

In exercising this right, you also have the right to have your personal data transmitted directly by us as the Controller to another controller, where technically feasible. This shall not impair the freedoms or rights of other persons.

The right to data portability does not apply to the processing of personal data that is necessary in order to perform a task carried out in the public interest or in the exercise of official authority vested in us as the Controller.


7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on Art. 6 Sec. 1 lt. e or t GDPR, including profiling based on those provisions.

We as the Controller shall no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or unless the processing serves to establish, exercise or defend legal claims.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.


8. Right to withdraw data protection-related consent

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
 

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automatic processing, including profiling, that produces legal effects for you or similarly significantly affects you.

This shall not apply if the decision:

a) is necessary for entering into or performing a contract between you and us as the Controller;

b) is authorized by Union or member-state law to which we as the Controller are subject and also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or

c) is based on your explicit consent.


However, these decisions may not be based on special categories of personal data pursuant to Art. 9 Sec. 1 GDPR, unless Art. 9 Sec. 2 lt. a or g applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in a) or c), we as the Controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.


10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or legal remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, at your place of work or the location of the alleged infringement, if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority with which the complaint is lodged shall inform the complainant about the status and outcome of the complaint, including the possibility of a legal remedy pursuant to Art. 78 GDPR.