Privacy Statement
This statement describes which personal data the CitiObs PMScan iOS App processes, for which purposes, and for how long.
1. Controller
Controller for processing related to the App is:
Secure Dimensions GmbH
Waxensteinstr. 28, 81377 Munich, Germany
Tel.: +49 89 38151813
E-Mail: privacy@secure-dimensions.de
Data Protection Officer: Andreas Matheus, Waxensteinstr. 28, 81377 Munich, privacy@secure-dimensions.de.
2. Personal data processed by the App
| Category | Examples | Purpose |
|---|---|---|
| Account identity | OIDC subject (sub), display name / given name from the profile claim |
Authenticate you, create or link your Party on STAplus, show a welcome name |
| Authentication tokens | Access token, refresh token, ID token (stored in the iOS Keychain) | Maintain your signed-in session and call STAplus on your behalf |
| Location | GPS latitude / longitude (when you grant permission) | Attach location to air-quality observations and Tracks |
| Sensor observations | PM1, PM2.5, PM10, temperature, humidity and related device readings | Display live values and upload ObservationGroups to STAplus |
| Device identifiers | PMScan Bluetooth name / device id | Associate observations with the physical sensor |
| User choices | Track name, selected license, optional activity / environment metadata | Describe and license the uploaded dataset |
The App does not request or process your e-mail address. OIDC scopes used are limited to identity/profile and the STAplus create scope required for upload (plus offline access for token refresh).
3. Legal bases (GDPR)
- Art. 6 (1) lit. b GDPR — processing necessary to provide the App service you request (login, recording, upload).
- Art. 6 (1) lit. a GDPR — consent for device permissions you grant in iOS (Location, Bluetooth).
- Art. 6 (1) lit. f GDPR — legitimate interest in secure session handling and reliable operation of the App.
4. Where data is stored
- On your device: tokens in the Keychain; buffered Tracks / observations in local app storage until you upload or delete them.
- Identity provider: Authenix processes login according to its own privacy policy.
- STAplus backend: uploaded Parties, locations, Tracks and ObservationGroups are stored on the configured STAplus service under the license and privacy settings you choose in the App.
5. Retention
- Tokens: kept until you log out, or until the session is invalidated (for example after a revoked refresh token).
- Local Tracks / observations: kept on the device until you upload and/or delete them.
- Uploaded STAplus data: retained according to the policies of the STAplus / CitiObs service operator and the license you selected; contact the controller if you need erasure of server-side records linked to your account.
6. Recipients / processors
- Authenix (OIDC authentication)
- Operator of the configured STAplus endpoint (observation storage)
- Apple (App Store / iOS platform services as provided by Apple)
Data is not sold. Transfer outside the EU/EEA only occurs if a listed service provider requires it under appropriate safeguards.
7. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability and object to certain processing. You may withdraw consent for device permissions in iOS Settings at any time (this may limit App functionality). You may lodge a complaint with a supervisory authority (Art. 77 GDPR).
8. Children
The App is not directed at children under 16. Do not use it if you are below that age without appropriate parental consent where required.
9. Changes
This Privacy Statement may be updated. The footer date shows the latest revision.