Privacy

1. Controller

Email: anfrage@mager-digital.de
Telephone: 0202 759 55 191

This policy applies to transmitdata.de, the still-accessible address sensors.mager-digital.de, and the TransmitData functions we provide. The operators of linked third-party services are responsible for their own services.

2. Our data storage and hosting

We store accounts and sensor readings in our own TransmitData application and database hosted by ALL-INKL in Germany. No additional external IoT cloud is required for this storage and analysis. Hosting is provided by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.

“Our own data storage” does not mean that no service providers are involved: the host provides servers, database operation and technical backups. Wireless networks and network servers transport sensor data; maps, weather and push notifications may use the external services described below. Forwarding to other platforms additionally configured by customers is outside our own data storage.

Hosting serves to provide contractual services (Article 6(1)(b) GDPR) and our legitimate interest in a secure, reliable online service (Article 6(1)(f) GDPR). Host information: ALL-INKL privacy information.

3. Website, security and local storage

When accessing the service, your device transmits technically necessary connection data, particularly your IP address, time, requested address, browser and operating system information and, where applicable, the referring page. Server logs and error messages support operation, troubleshooting and prevention of abuse. The legal basis is Article 6(1)(f) GDPR; our interest is availability and security. To limit login attempts, the application also processes a hash of the IP address and the time of the attempt.

We use the mager_sensors session cookie for login, sessions and form protection. It is not an advertising cookie and is set as a session cookie without a fixed expiry date; its actual local duration also depends on your browser’s session restoration. A selected light/dark appearance is stored by the browser under transmitdata-theme until you delete this setting or the website data. The app also stores session and display settings needed for its use on your device.

This storage supports functions you expressly request (section 25(2), no. 2 TDDDG); subsequent processing of personal data is based on Article 6(1)(b) or (f) GDPR, depending on the function. The ordinary public terms, privacy, legal notice and information pages do not require login. In the native app, the existing session may continue to be used for navigation.

We do not use advertising trackers or build cross-visitor analytics profiles on the website. Fonts, scripts and sensor images are loaded from our own website. Embedded map and weather data are considered separately.

4. Account and contact

When you register, we process your name, email address, a password hash, creation time and account settings. This also includes assigned sensors, setup requests and information you submit. Your password is not stored as plain text in the account database. When you contact us, we process your contact details and the message content to handle your enquiry.

The legal basis is Article 6(1)(b) GDPR for steps before entering into a contract and contract performance, otherwise Article 6(1)(f) GDPR based on our interest in handling enquiries. Required information is necessary for the respective function; without it, for example, we cannot provide a personal account. Simply visiting the website does not require registration.

5. Sensors, locations and parking areas

We process device identifiers, manufacturer and model, sensor names, account assignments, setup information and, where applicable, device keys submitted for setup. During operation, this includes readings, timestamps, reception and status information, histories, alarm thresholds, notifications, and sharing and interface settings. Device keys and access tokens are confidential credentials.

Stored locations come from your entries, a location import initiated by you, or appropriately configured GPS sensors. GPS sensors can provide location histories over time. Importing a location from your phone is a separate function: it requires device permission and serves the selected function; the app is not configured for continuous background tracking of the phone.

For parking areas, this includes area and space names, site plans, sensor assignments, occupied/free/unknown states, times and occupancy rates calculated from them. The standard parking area module does not require number plates, driver profiles, photographs or payment details of people parking. Occupancy data are nevertheless not automatically anonymous: a link to a person may arise, for example, where a space is assigned to that person. Personal information in free-text fields and such assignments should therefore be limited to what is necessary.

Processing for our own customer accounts and agreed functions is based on Article 6(1)(b) GDPR. Where we process data about employees, people parking or others solely on a customer’s instructions, the customer is generally responsible for the purpose and legal basis; processing on behalf of the customer must be separately agreed under Article 28 GDPR. This policy does not replace information the parking area operator must provide to data subjects.

Automatic threshold checks and occupancy statistics produce technical displays and notifications. We do not use them to make solely automated decisions about individuals with legal or similarly significant effects, nor to create advertising profiles.

6. Sharing links, partners and Home Assistant

Sensor pages become accessible through a link when the customer enables sharing. Depending on the selection, sensor names, readings, timestamps, histories and precise locations may become visible. Anyone possessing the link can access the shared content and pass the link on. Not being publicly listed does not prevent access by people who already know the link.

When a page is embedded in a third-party website, the browser connects to our server; the connection data described in section 3 are generated. Enabled map and weather views may also connect to the providers listed in section 7.

Home Assistant connections and parking area partner access allow the intended data scope to be retrieved with an authorised read key. Besides current readings, this may include site plans and history. Access can be revoked; this does not automatically delete data already exported or copies held by recipients. We do not share or market data on a blanket basis, but only under an appropriate agreement and data protection basis.

Technically providing sharing requested by a customer serves contract performance (Article 6(1)(b) GDPR). Where other people’s data are affected, the controller enabling sharing must ensure the necessary legal basis and information. A sharing function does not replace this assessment.

7. Wireless networks, maps, weather and push

LoRaWAN and Helium

Depending on the setup, data are transmitted through LoRaWAN gateways, the Helium network and a network server. Participating operators process the device and radio metadata needed for transport; depending on configuration, the network server also processes the payload. The actual reception path depends on the sensor connection. Where a customer uses their own Console, the chosen provider’s privacy information and contracts also apply. Our processing necessary for agreed transmission is based on Article 6(1)(b) GDPR.

Maps and weather

Maps load tiles from the OpenStreetMap Foundation (United Kingdom) or, for satellite views, EOX IT Services GmbH (Austria). Weather displays and point queries use services of Deutscher Wetterdienst, the German Meteorological Service (Germany). In particular, the IP address, technical request data, map area and, for weather queries, selected position are transmitted to the respective provider. Sensor names and readings are not specifically sent with these map and weather queries; however, the map area may allow conclusions about the location being viewed.

Requests may begin immediately when opening a map view or a shared page with the map enabled. Not every map view has a prior confirmation step. The integration provides the requested geographical display and weather information; the legal basis is Article 6(1)(f) GDPR, reflecting our interest in a clear location-based display. Where consent is required for access to your device, it must be obtained separately; the privacy policy itself is not consent.

Further information: OpenStreetMap, EOX and Deutscher Wetterdienst.

Push notifications

When notifications are enabled, we store the account assignment, delivery endpoint or device token, required keys, activation status, and notification and delivery status. Browser push uses the relevant browser provider’s service, such as Apple, Google or Mozilla. The native app uses Google Firebase Cloud Messaging (FCM) and, on Apple devices, additionally Apple Push Notification service (APNs).

For delivery, Google or Apple may process device tokens, connection information and the notification text. The text may contain a sensor name, reading and threshold violation. It may also appear on the lock screen. Browser push content is encrypted in transit; this does not imply a blanket statement about end-to-end encryption of native FCM/APNs messages.

Sending optional alerts is based on your activation and consent (Article 6(1)(a) GDPR). You can disable future delivery in notification settings or through your device permission. The Firebase SDK is initialised when the native app starts; technical installation and connection data may therefore arise even before alerts are enabled. This technical connection provides the app’s messaging function (Article 6(1)(f) GDPR). A system permission alone does not automatically constitute consent to all SDK processing. We do not integrate Firebase Analytics.

Further information: Firebase privacy information, Apple privacy information and your browser provider’s privacy information. Camera and photo access for scanning uses your device permission; QR recognition takes place on the device. The fields adopted for setup are transmitted to the platform.

8. Recipients and processing outside the EU

We, necessary technical service providers acting within their tasks, and recipients you authorise receive access. Legal obligations may require disclosure to competent authorities (Article 6(1)(c) GDPR). Data necessary to establish or defend claims may be disclosed to legal advisers and courts (Article 6(1)(f) GDPR).

Our own application database is in Germany. This does not exclude international processing by wireless, map and push providers, particularly in the United Kingdom and the USA. Such transfers are subject to Articles 44 et seq. GDPR, for example an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses. On request, we explain the mechanism applicable to the specific connection and provide information about the relevant safeguards. Merely naming a provider or publishing this policy does not confirm any particular certification or completed contractual review.

9. Retention and deletion

The relevant purpose, duration of the agreed service, necessary evidence and statutory retention obligations determine retention. We need account and configuration data during use. Readings and occupancy histories serve the agreed history and analysis functions; general automatic deletion after a fixed number of days is not currently configured.

The application cleans up login attempts older than 24 hours and expired email verification, password reset and email change links. Link records remain at least until the one-hour request window has ended, so abuse limits remain effective. Private session files are cleaned up when they have not been written for more than 30 days and are not currently in use. Login validity is determined separately by the applicable session rules.

Completed technical push delivery records are generally cleaned up after 30 days, and incidents marked as resolved after 90 days, measured from completion or resolution. Open incidents, unresolved delivery failures and pending deliveries remain until clarified. This history cleanup does not remove messages in your customer account or push subscriptions. Older records without a reliable completion date initially receive a full new retention window. Cleanup runs in limited background batches; outages, locked files or backlogs may delay actual removal.

Additional local release and deployment backups are assessed for deletion after 90 days. At least two complete, verified recovery points and their required base backups are retained. Backups with incomplete verification records or that are still needed may therefore be retained longer; not all backups are automatically removed after 90 days. The hosting provider's backup cycles are separate.

Delete your TransmitData account

You can request deletion under Account → Security → Delete account or through the account deletion page on the web. You do not need to have the app installed. If you are not signed in, the sign-in link takes you directly to the deletion form after sign-in. Deletion requires your current password and explicit confirmation; merely opening the page or signing in does not delete any data.

Once the deletion request is accepted, your account access, existing sessions and data-sharing access are revoked, and further push delivery is disabled. This includes shared links and the Home Assistant and partner access associated with your account. The deletion process removes the account, sensor assignments, stored readings, settings, notifications and model requests including their attachments from the running application.

If TransmitData provisioned devices in the network for you, their deregistration must be confirmed before account deletion can finish. While this confirmation is pending or processing has failed, the deletion request remains open; the affected data has not yet been fully deleted. Account and data-sharing access remain blocked. If you encounter problems or no longer have access to your account, you can contact us at anfrage@mager-digital.de.

To prevent deleted accounts from being reactivated during recovery, we maintain a separate deletion journal containing random account identifiers, deletion status and timestamps. An independent copy is stored on our own backup infrastructure, with the additional archive copy encrypted. Deletion requests wait for confirmed independent storage. The necessary deletion and recovery evidence is retained while corresponding older backups could still be restored; it is not subject to general history cleanup.

Account deletion does not remove copies already transferred to other systems, such as your own Home Assistant instance. You or the respective recipient manage their continued storage there. The following information on statutory retention obligations and backup copies continues to apply.

When the purpose no longer applies or a justified deletion request is made, we delete personal data unless legal obligations or necessary legal evidence require otherwise. In the latter case, use is restricted to those purposes. Business and tax records subject to retention requirements are kept for the applicable statutory periods; these do not justify blanket retention of all sensor data.

Log and security data are needed only for the necessary operational and investigation period. Host logs and technical backups are also subject to the respective backup and deletion cycles. Immediate removal from all backup copies therefore cannot be promised. Backups serve recovery, not continued ordinary use of deleted data.

Disabling push access stops delivery but does not automatically delete all previous notifications or stored subscription records. Revoking a sharing link likewise does not delete copies held by previous recipients. You can remove local display settings by deleting website or app data.

10. Your rights

Subject to the applicable statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). You may withdraw consent at any time with future effect; this does not affect the lawfulness of prior processing.

Objection: Where we process data on the basis of a legitimate interest, you may object on grounds relating to your particular situation (Article 21 GDPR). For direct marketing, an objection would be possible at any time without specific grounds. Please send requests to anfrage@mager-digital.de. We may need reasonable proof of identity to prevent unauthorised disclosure.

You may complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. The authority responsible for our registered location is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

If we process data on a customer’s behalf, we assist the responsible controller in handling your request. We update this policy when our processing changes; the stated version date identifies the current version.