Privacy policy relating to the Q app
for metering services

in accordance with Art. 13 of the GDPR. 

1. General

Thank you for your interest in our Q app. This privacy policy is to inform you about our recording and processing of your personal data when you use our Q app for metering services, who is the controller responsible for the data processing, what rights you have and who to contact if you have any questions. We are providing you with this privacy policy on the basis of Article 13 of the GDPR.

2. The controller responsible for the data processing

QUNDIS GmbH, Sonnentor 2, 99098 Erfurt, is the controller responsible for the processing of your data. You can contact us by email at info@qundis.com, and by telephone on +49 361 26280-0.

3. Data protection officer

You can contact our data protection officer at datenschutz@qundis.com or at our postal address with the addition “Data protection”.

4. Processing

The following general provisions always apply independently of or in addition to the provisions set out for the individual types of processing: 

• Personal data will be disclosed if we are legally obliged to do so by law or by a court order. Any further disclosure will only take place with your consent. 
• Personal data may be stored beyond the periods mentioned if we are legally entitled or obliged to do so by contract, by law or by a court order. 
• Your personal data will be deleted if it is no longer required for the purpose for which it was processed, if the consent you have given is revoked, or if other permissions no longer apply. If data is still required for the assertion, exercise or defence of legal claims, we will delete it as soon as this is no longer the case. If we store personal data due to legally prescribed retention periods, we delete the data after the retention period has expired.

4.1 Downloading the Q app from the QUNDIS app store

4.1.1 Content of the processing

The following data is processed when you download the Q app from the QUNDIS app store. This data is necessary to enable the download and to make the app available to you.

4.1.2 Categories of data subject

The following groups of persons are affected by the processing: 

• All users of the Q app.

4.1.3 Categories of processed personal data

The following personal data is recorded and stored:

• The user name in the app store, the email address stored in the app store, and the customer number of your app store account.

4.1.4 Recipients of the data

The following parties are recipients of the processed data:

• The department at QUNDIS responsible for operating the app store.

4.1.5 Legal basis and purpose

The legal basis is Art. 6 Para. 1 lit. f of the GDPR, in this case our legitimate interest in providing you with the app.

4.1.6 Duration of the storage

The storage period for telemetry data, cookies and locally stored data is usually one year, or until you request us to delete it or delete the data in your browser yourself. 

4.2 Downloading the Q app from the Google Play Store

4.2.1 Content of the processing

When downloading the Q app from the Google Play Store and the associated data processing, Google is the controller. We have no influence on this processing as part of the distribution of the app via the above-mentioned app store. Further information on this data processing can be found in the Privacy policy of the Play Store’s operator.

4.3 Processing in the Q app

4.3.1 Content of the processing

The Q app is used by metering services to read out metering data from remotely readable metering devices in walk-by or drive-by operations. Q app supports you in configuring the device parameters and in AMR installation processes. No personal reference is created when the metering data is processed. The transmission can be encrypted using AES. This means that the data you transmit to us cannot be read by third parties.
QUNDIS does not act as the final recipient of the data, but merely provides the software and hardware infrastructure for you as a metering service.

Registration

The use of Q app requires registration in the QUNDIS customer portal at https://qundis.microsoftcrmportals.com/ together with the use of the Q tool interface, which provides the necessary radio interfaces for communication between the devices and systems via IrDA, BLE & W-MBUS. Use of the Q app is only possible for activated users and after opening a user account and appropriate authentication. As part of the registration process, we process the following personal data that you provide when registering: email address, user name, password.  You can delete your user account and all data stored locally by the Q app at any time via your customer administrator.

When using Q app, you need to log in using the login details (user name and password) provided during the registration process. You can save this access data on your smartphone. The storage period is for as long as you use the app. Your data will be deleted at regular intervals after you stop using it. 

Further information on data processing during the registration process can be found at https://portal.qundis.com/privacy-policy-portal/.

Use of Q app

Access to various functions and data on the smartphone is required for the Q app to function fully. During registration or when using the relevant function, you will be asked to grant the corresponding access authorisations. Technical access to the following functions is required for the Q app to function fully:

• Bluetooth: for the read-out of the metering data.
• Location: necessary for the Bluetooth interface of your device to work, and for nearby Bluetooth low energy devices to be displayed. Your location will not be processed further. 
• Storage: to store the read-out metering data.

Assigning the following permissions is optional:

• Camera: for reading the barcodes/data matrix codes on the metering devices. 

There is no access to device IDs such as IMEI, UDID or your mobile phone number. You can revoke your authorisation at any time by accessing the settings of your mobile device and deactivating individual functions there. However, this may also restrict or prevent the use of the app. Network access (e.g. your mobile device's Wi-Fi connection) is required to connect to the internet.

The metering data you read out is stored locally on your smartphone and can be exported from there in various formats to the target system you use.

When you use our Q app (Android), the type of device you use to start our app, a device registration token and the date and time of access to our servers are transmitted to our servers and temporarily stored in a so-called log file for the following purposes:

• protection of our systems,
• fault analysis,
• prevention of misuse or fraudulent behaviour.

The storage period for log files is a maximum of 90 days.

The recording of data during use of the Q app and the storage of data in log files is essential for the operation of the Q app. The legal basis for the processing is our legitimate interest (Art. 6 Para. 1 S.1 lit. f of the GDPR) in the protection of our systems and the improvement of our app.

Processing your data for fault elimination

If you experience any problems while using the app, data related to the fault, known as crash reports, will be saved and transmitted to Microsoft. This data is processed for the purpose of troubleshooting, optimising the app and ensuring system security.

The following data is recorded and transmitted: the device IP, manufacturer of the end device, Android version, the line of code at which the crash is triggered. The crash reports can be viewed by QUNDIS on a Microsoft dashboard.

The data processing is carried out on the basis of our legitimate interest in ensuring the stability and security of the app and our information technology systems. 

The storage period for this data is 90 days and it is automatically deleted at regular intervals.

4.3.2 Categories of data subject

The following groups of people are affected by the processing: 

• All users of the Q app.

4.3.3 Categories of personal data processed

See 4.3.1 above.

4.3.4 Recipients of the data

The following parties receive the processed data: 

• the department at QUNDIS responsible for the operation of the website. 
• the processor employed for the hosting of the portal in accordance with Art. 28 Para. 1 GDPR.

4.3.5 Legal basis and purpose

The legal basis is Art. 6 Para. 1 lit. f of the GDPR, in this case our legitimate interest in the technically flawless provision and maintenance of the app.

4.3.6 Duration of storage

See 4.3.1 above.

5. Transfer of data to non-EU countries or international organisations

We endeavour to carry out all data processing in the European Union (EU) or in countries which have been approved for data processing by the European Commission (Art. 45 GDPR). However, we may in some cases, for example when using external service providers, also transfer personal data to service providers in non-EU countries.

Subject to legal or contractual permissions, we process personal data through the use of service providers in a non-EU country only if the special requirements of Art. 44 and the following articles of the GDPR are met. The data will then be processed on the basis of suitable guarantees (Art. 46 GDPR), binding internal data protection regulations (Art. 47 GDPR), special guarantees, or your consent (Art. 49 Para. 1 a).

If we transfer data to service providers in non-EU countries, we will indicate this in the respective processing details.

To summarise, we carry out the following transfers to third countries:

USA, in the context of the use of Microsoft services as a processor. The necessary data protection contracts have been concluded with the service provider.

6. Rights of the data subject and right of appeal

As a data subject affected by the processing of personal data, you have the following rights, which arise from Articles 7 and 15 to 22 of the GDPR: 

• In accordance with Art. 7 GDPR: a right to revoke the processing, provided that this processing is carried out on the basis of your consent in accordance with Art. 6 Para. 1 Sentence 1 lit. a) of the GDPR. The revocation is free of charge and can be made informally, preferably by email to the above-mentioned address. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected. Please also note that we may have to store certain data for varying periods of time in order to comply with legal requirements, e.g. for retention obligations.
• In accordance with Art. 15 GDPR: a right to information about the data we process.
• In accordance with Art. 16 GDPR, a right to rectification if we process incorrect data about you.
• In accordance with Art. 17 GDPR, a right to deletion, unless exceptions still apply, in which case we will continue to store the data, for example, due to legal retention requirements or limitation periods.
• In accordance with Art. 18 GDPR, a right to the restriction of processing.
• In accordance with Art. 19 GDPR, the right to notification of rectification, deletion or restriction of processing of your personal data. We will notify you as the data subject if you request this.
• In accordance with Art. 20 GDPR, a right to data portability if we are to transfer your data to another controller and this is technically feasible. 
• In accordance with Art. 21 GDPR, a right to object to processing in the public or legitimate interest, i.e. on the basis of Art. 6 Para. 1 Sentence 1 lit. e) or f) of the GDPR. We will no longer process your data if we cannot demonstrate compelling legitimate grounds. In the case of direct marketing or profiling, you do not have to justify your objection (Art. 21 Para. 2 GDPR), otherwise a justification based on your personal circumstances is required.

You can contact a data protection supervisory authority in accordance with Art. 77 GDPR if you are of the opinion that we are not processing your data properly. The Thuringian State Commissioner for Data Protection and Freedom of Information (https://www.tlfdi.de/) is responsible for our company.