PRIVACY POLICY

PRIVACY POLICY – Leon's Lager

1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is the operator of this app.

Contact:
Greendott ltd.
Great Ancoats Street 132-134
Unit 620
Manchester
England
M4 6DE

The app is used by the respective company (employer/client), which creates and manages its own users. The company bears independent or joint responsibility for the processing it initiates (see Section 13).

2. Overview and Purpose
Leon's Lager is an app for managing devices, tools, and equipment—from the warehouse to the construction site. Devices are checked into storage, issued, transferred from person to person, and returned using QR codes.

Leon's Lager is explicitly a documentation and tracking system: it processes personal data and firmly links user identities (specifically names) to devices, transfers, confirmations, and log entries. The purpose is to ensure traceability at all times regarding which person received, passed on, or returned a specific device and when. Anonymous or purely pseudonymous use is incompatible with this purpose.

3. Categories of personal data processed
In particular, the following are processed:

a) Identity and master data:
- User name
- Role/function (e.g., administrator, office, operations management, warehouse, personnel)
- If provided: e-mail address and contact details (e.g., WhatsApp/Telegram ID)
- Active/inactive status
- Company affiliation via company ID (company key)

b) Login and access data:
- Setup/invitation code and company key
- Technical access token (app or web token)
- Activation status, time of last login, login events

c) Transaction and inventory data:
- Recorded devices (ID, type, serial number, condition), boxes/groups, assigned warehouse
- Check-ins and check-outs, handovers, returns, and cancellations
- Persons involved in a transaction (handing-over and receiving persons, identified by name)
- Construction site/operation, optional return date, notes, timestamps, and transaction status

d) Confirmation and signature data (Face ID):
- Proof of transactions confirmed via Face ID, including names of the parties involved (acting person, handing-over person, and receiving person), associated transaction, timestamp, company key, and a tamper-proof signature
- Approximate battery level of the device transmitted at the time of confirmation

e) Log and security data (see Sections 9 and 10):
- Logged actions including the name of the acting user, timestamp, and IP address
- technical device context
- login, logout, connection, and error events

f) Notification data:
- device-specific push identifier (push token)
- content, recipient, sender, and status of delivered notifications

4. Purposes and legal bases
Processing takes place for the provision and use of the app, for the management and seamless traceability of device handovers, for rights and role management, for the delivery of operational notifications, and for system security and error analysis.

The legal bases are Art. 6(1)(b) GDPR (use of the app / performance of the underlying relationship) and Art. 6(1)(f) GDPR (legitimate interest in secure operation and in audit-proof documentation of device responsibility). In the context of an employment relationship, Art. 88 GDPR or national employee data protection law may also apply.

5. Linking of identity and processes
User names and identities are deliberately linked to devices, handovers, Face ID confirmations, and log entries so that it is possible to trace at any time who is responsible for which device. This linking is a core function of the app.

6. Login, company key, and access token
The app is connected to the respective company's user account via a company key and a personal setup code. After setup, communication takes place via a technical access token that identifies the account and the company. This token is assigned to a specific user account associated with a name.

7. Camera / QR Code
For checking items in and out as well as for handovers, the app uses the device's camera to scan QR codes. Only the content of the respective QR code is processed (e.g., device or crate ID). No images or videos are captured or stored.

8. Face ID and digital proof of confirmation
Handovers and...