1
Controller & Data Protection Officer
Controller
Ferdinand-Steinbeis-Gesellschaft für transferorientierte Forschung gGmbH der Steinbeis-Stiftung (FSG)
Filderhauptstraße 142, 70599 Stuttgart, Germany
Legal
Privacy Policy
Information on the processing of personal data within the track4science research project.
2
Website Data Processing
When you visit our website, the web server automatically collects the following information:
- IP address of the accessing device
- Browser type and version
- Operating system
- Referrer URL
- Hostname of the accessing device
- Time of the server request
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical provision of the website).
Web Analytics with Independent Analytics
We use Independent Analytics – a cookie-free, GDPR-compliant analytics tool. No personal data is shared with third parties.
3
Email Contact
If you contact us by email, your details will be stored to process your inquiry. The data will be deleted once it is no longer needed for its intended purpose, but no later than one year after the inquiry or upon expiration of the account usage period.
4
Newsletter
To receive our newsletter, you must provide your email address. In addition, your IP address and a timestamp of your registration are logged for abuse protection purposes.
Legal basis: Art. 6(1)(a) GDPR (consent). You can unsubscribe from the newsletter at any time.
5
User Profile in the App
When registering in the track4science app, we collect the following data:
- Email address – for communication purposes (prize notifications, surveys)
- Vehicle information – for personalized CO₂ and cost calculations
6
App Data Collection
The app was developed following the principles of Privacy by Design and Privacy by Default. All collected data is processed in pseudonymized form.
Identification
Users are identified via a UUID (Universally Unique Identifier). No real names, phone numbers, or similar direct identifiers are stored.
Data Collected
- Device information (type, OS version)
- App version
- Mobility raw data (GPS coordinates, timestamps)
Third-Party Processing
- MotionTag GmbH – creation of movement profiles (transport modes, routes, duration)
- Smartlook – user interaction analysis for app improvement
In-App Feedback
Based on the collected data, users receive personalized feedback on: mobility patterns, CO₂ footprint, costs, and calorie expenditure.
7
Surveys via LimeSurvey
As part of the project, voluntary surveys may be conducted through the LimeSurvey platform. Participation is voluntary. The collected data is stored in pseudonymized form and used exclusively for research purposes.
8
Pseudonymization & Anonymization
- The UUID is stored strictly separate from personal data (e.g., email address).
- Access to the pseudonym mapping is subject to a four-eyes principle.
- After project completion, email addresses will be deleted and remaining data will be fully anonymized.
GPS Data Anonymization
Start and end points of journeys are removed. Additionally, GPS data points are randomized within a 100-meter grid to prevent tracing back to home or work locations.
9
External Service Providers
Personal data is only transferred to countries outside the EU/EEA where adequate safeguards are in place.
cosee GmbH – App Development
Smartlook – User Analytics
Schwarz IT – Hosting
MotionTag GmbH – Mobility Calculations
LimeSurvey – Surveys
Google Maps API – Map Display
10
Research Cooperations
As part of the project, we collaborate with Prof. Christoph Ungemach (TUM School of Management) on behavioral economics research questions.
The goal is to build an open data infrastructure for sharing anonymized mobility data with the research community.
11
Your Rights
You have the following rights regarding your personal data vis-à-vis the controller:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent – at any time with effect for the future
Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information, Baden-Württemberg).
