Data Protection Information

All information according to GDPR and BDSG

In the context of using this website, your personal data is processed by us as the data controller and stored for the duration necessary to fulfill the defined purposes and legal obligations. Below, we inform you about which data this involves, how they will be processed, and what rights you have in this regard.

Personal data, as defined by Article 4 (1) General Data Protection Regulation (GDPR), includes all information related to an identified or identifiable natural person.

Scope of Application

This data protection information applies to the data processing of the project Testfeld-Berlin-Apps as well as all services offered in connection with the project as a web service or mobile app (hereinafter: website for better readability), whenever reference is made to this data protection information.

Name and Contact Information of the Controller and Corporate Data Protection Officer

Fraunhofer Society for the Advancement of Applied Research e.V.

Hansastraße 27 c
80686 Munich

on behalf of its

Fraunhofer Institute for Open Communication Systems FOKUS

Kaiserin-Augusta-Allee 31
10589 Berlin

(hereinafter referred to as Fraunhofer FOKUS)

The data protection officer of Fraunhofer can be reached at the above-mentioned address in Munich, c/o Data Protection Officer. You can contact our data protection officer directly at any time with questions regarding data protection law or your rights as a data subject via email at datenschutz@fokus.fraunhofer.de.

Additionally, you can reach out to our contact person Dr. Ilja Radusch at ilja.radusch@fokus.fraunhofer.de for inquiries.

For general questions about this website or the project, you can contact hello@testfeld-berlin.de at any time.

Personal Data Processing and Purposes of Data Processing

When visiting the website

You can access our website without having to disclose any details about your identity. The browser installed on your device merely transmits information automatically to the server of our website (e.g., browser type and version, date and time of access) to enable a connection with the website. This includes the IP address of your requesting device. This information is temporarily stored in a so-called log file and will be deleted after 30 days.

The IP address is stored anonymously by removing the last block of characters.

We cannot draw any direct conclusions about your identity from processing the IP address and other information in the log file.

Moreover, we use cookies and analytics services when you visit our website. Further details can be found below in this data protection information.

When using the Bike­Navi App

The Bike­Navi App (available in the Google Play Store and as an iOS public beta via TestFlight) processes personal data primarily on your device. Data is only transmitted to a server when necessary for a function you have requested or if you have explicitly consented to an optional function. Raw location and sensor data are only temporarily (for a few minutes) held in memory, not stored permanently, and do not leave the device.

Location Data and Navigation

For route calculation and navigation, the app processes your location (GPS). To calculate a route, we transmit the starting and destination points, the chosen mode of transport, and the language to our routing service (Fraunhofer FOKUS, server within the scope of the GDPR). During navigation, your location is continuously evaluated – even with the display turned off or in the background – to guide you along the route and provide speed recommendations. The legal basis is Article 6 (1) sentence 1 lit. b GDPR (provision of the navigation function requested by you).

Motion Sensors

To determine direction, speed, and position, the app evaluates the motion sensors of your device (accelerometer, gyroscope, magnetometer/compass). These sensor data are processed exclusively on the device and not transmitted.

Map Display

To display the map, the app uses – depending on your selection – Google Maps (Google Ireland Ltd.), Apple Maps (Apple Inc., only iOS), or a MapLibre map display. When using Google Maps or Apple Maps, technically required data (including IP address and the displayed map section) is transmitted to the respective provider to load the map material. Additionally, their privacy policies apply.

Login and Access

To access the services of the test field, the app logs in with access credentials; the issued access token is encrypted in the secure key storage of your device. An optional personal login (BACS/email) is possible, but not required for normal use. Access credentials and tokens are not shared with third parties.

Traffic Light Phase Assistant and Trip Counting

The traffic light phase assistant provides you with speed recommendations for a comfortable green wave. For this purpose, the app retrieves second-accurate phase information for traffic lights along your route from our server. Additionally, the app counts on the device how many traffic lights you have passed (gamification / “collected traffic lights”). This counting occurs locally and without storing locations.

Signal Phase Observations (Research)

To improve traffic light phase prediction and the green wave, the app derives coordinate-free observations from your starting and stopping behavior at traffic lights (including identification of the traffic light or signal group, temporal reference of the stopping or starting process, and the alignment with the published switching plan). These observations do not contain coordinates or a movement track and do not allow conclusions about your driving route or your person. The derivation occurs on the device.

Transmission of these coordinate-free observations to our servers (Fraunhofer FOKUS, EU) occurs without separate consent, as the data is not personally identifiable; the legal basis is our legitimate interest in improving the traffic service (Article 6 (1) sentence 1 lit. f GDPR). Currently, no transmission takes place – the observations remain entirely on the device until server-side collection is activated. You can exercise your right to object under Article 21 GDPR (see below) at any time.

Group Competition (optional, default off)

If you activate the Group Competition, the app transmits a content-based, cryptographically derived hash value (HMAC) along with a rough timestamp for counted traffic light passes to the competition server. No coordinates and no movement track are transmitted. The legal basis is your consent (Article 6 (1) sentence 1 lit. a GDPR), which you can revoke at any time in the settings with effect for the future.

Cross-Device Synchronization of Counts (optional, default off)

Optionally, you can synchronize your traffic light counts across your own devices via your device’s cloud service (iCloud for iOS, backup for Android). Only the aggregated count values leave the device – no raw data and no coordinates. The legal basis is your consent (Article 6 (1) sentence 1 lit. a GDPR).

Export as Training Session / Health Data (optional, default off)

At your request, the app can write a completed trip as a training session in Apple Health or Health Connect (Android). This only occurs after explicit activation and granting of the corresponding system permission. The legal basis is your consent (Article 6 (1) sentence 1 lit. a GDPR).

Local Recording of Trip Data (only test versions)

In separate development and test versions, a local recording of detailed trip data can be activated. This function is not included in the public app versions, is turned off by default, remains on the device (automatically deleted after a maximum of 7 days), and is only shared if you actively share a file.

Permissions

The app requests the system permissions required for the aforementioned purposes – in particular location (for navigation even in the background), optional health / Health Connect (workout export), and activity/movement. Granted permissions can be revoked at any time in the system settings; individual functions may then no longer be available.

Transfer of Data

If we transfer personal data collected through the website to processors, we will inform you in this data protection information regarding the respective data processing operation, citing the specific recipient.

Aside from that, we will transfer your personal data only if

  • you have given explicit consent pursuant to Article 6 (1) sentence 1 lit. a GDPR;

  • this is necessary pursuant to Article 6 (1) sentence 1 lit. b GDPR for the performance of a contract with you (for example, transfer to shipping companies for the purpose of delivering goods ordered by you, or transmitting payment information to payment service providers or credit institutions in order to process a payment transaction);

  • there is a legal obligation for transfer pursuant to Article 6 (1) sentence 1 lit. c GDPR.

The recipients must not use the transferred data for any purposes other than the above-mentioned ones.

Web Analysis/Tracking

Matomo

We use the open-source software Matomo by InnoCraft Ltd from New Zealand on our website to analyze user behavior during visits to our site and to optimize our site and its content based on this analysis. In doing so, we do not obtain any information that identifies you directly.

In the version of Matomo we use, precautions are taken based on DoNotTrack technology (see www.donottrack.us) to ensure that your website visit is not captured if you have indicated in your internet browser settings that you do not wish to be tracked.

In connection with the use of Matomo, cookies are used that allow statistical analysis of the use of this website based on your visits. The cookie stores information – including personal information – about your visitor behavior on our website, and Matomo then processes this data under a pseudonym in a user profile for analytical purposes. Since we host Matomo on our own servers, the analysis does not require data processing by third parties.

Without your specific permission, we neither use the data collected to identify you personally nor will we combine the data with personal data pertaining to the pseudonym associated with you.

If IP addresses are collected, they are immediately anonymized after collection by deleting the last number block.

The processing of the data obtained through cookies and other web analysis/tracking methods is based on our legitimate interest in optimizing our online offering and our website, e.g., in the form of an adaptation to frequently used devices and browsers, more publications on particularly popular topics (Article 6 (1) sentence 1 lit. f GDPR). Processing takes place within the scope of the GDPR (EU/EEA). There is no transfer to third countries.

You can find the type and scope of the data processed and the providers that provide these cookies in the list of cookies we set.

Rights of the Data Subject

You have the right:

  • pursuant to Article 7 (3) GDPR, to withdraw your consent at any time. This means that we may not continue the data processing based on this consent in the future;

  • pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom the personal data have been or will be disclosed, and the envisaged period for which the data will be stored. Moreover, you have the right to request rectification, erasure, or restriction of processing, to object to processing, the right to lodge a complaint, and to obtain information about the source of your data if they were not collected by us as well as about the existence of automated decision-making, including profiling, and, if applicable, meaningful information about the details involved;

  • pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate data or the completion of your personal data stored by us;

  • pursuant to Article 17 GDPR, to obtain the erasure of personal data stored by us unless processing is necessary to exercise the right of freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to establish, exercise or defend legal claims;

  • pursuant to Article 18 GDPR, to obtain restriction of processing of your personal data if you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the personal data, or if we no longer need the personal data while you still require it for establishing, exercising or defending legal claims, or if you have filed an objection to the processing pursuant to Article 21 GDPR;

  • pursuant to Article 20 GDPR, to receive your personal data that you have provided to us, in a structured, commonly used and machine-readable format or to demand the transfer of those data to another controller and

  • pursuant to Article 77 GDPR, the right to lodge a complaint with a supervisory authority. Generally, you may contact the supervisory authority of your usual residence, place of work or the registered offices of our organization.

Information on your right to object pursuant to Article 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data pursuant to Article 6 (1) lit. e GDPR (data processing carried out in the public interest) and Article 6 (1) lit. f GDPR (data processing for purposes of legitimate interests). This also applies to any profiling as defined in Article 4 (4) GDPR that is based on said provision in Article 6.

If you file an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defense of legal claims.

If your objection is directed against the processing of data for the purpose of direct advertising, we will stop the processing immediately. In this case, citing a special situation is not necessary. This includes profiling to the extent that it is related to such direct advertising.

If you would like to assert your right to object, simply send an email to datenschutz@fokus.fraunhofer.de.

Data Security

All your personal data are transmitted in encrypted format, using the widely used and secure TLS (Transport Layer Security) standard. TLS is a secure and proven standard that is also used, for instance, in online banking. You will recognize a secure TLS connection by the additional s after http (i.e., https://…) in the address bar of your browser or by the lock icon in the bottom part of your browser window.

In all other regards, we use suitable technical and organizational security measures to protect your data against accidental or intentional manipulations, partial or complete loss, destruction, or the unauthorized access of third parties. We continuously improve our security measures in accordance with the state of the art.

Timeliness and Amendments to this Data Protection Information

The further development of our website and the products and services offered or changed due to statutory or regulatory requirements, respectively, may make it necessary to amend this data protection information. You may access and print out the latest data protection information at any time from our website.