Privacy Policy
PartikelLens App — Last updated: 13 October 2026, Version 2.0
Changes compared to version 1.0: sign-in with customer account, cloud synchronisation of reports, licence verification and service providers added; address updated; legal bases pursuant to Art. 13 GDPR added.
This is a convenience translation. In case of discrepancies, the German version prevails.
1. General
This privacy policy applies exclusively to the "PartikelLens" app (hereinafter "app"). It informs you about the nature, scope and purpose of the processing of personal data by the app operator.
We treat your personal data confidentially and in accordance with statutory provisions. Definitions of the terms used (e.g. "personal data", "processing") can be found in Art. 4 GDPR.
As the app is continuously developed, this policy may be amended. We announce material changes in the app's release notes. Please re-read this policy at regular intervals.
2. Controller
The controller within the meaning of Art. 4 No. 7 GDPR is:
PartikelART Solution GmbH
Carlo-Schmid-Allee 3
44263 Dortmund
Germany
Phone: +49 231 58682490
Email: info@partikel-art.de
Web: www.partikel-art.de
3. Data Protection Officer
Roman Möhle
Email: privacy@partikel-art.de
Post: address of the controller, marked "Data Protection Officer"
4. What data the app processes
4.1 Particle measurement (local)
The app measures particles in images taken with the device camera together with the PartikelART reference (square or similar). Captures, measurement data and generated reports are stored exclusively on your device as long as you do not use any cloud function. Without signing in, no personal data is transmitted to us.
4.2 Sign-in and account
Sign-in is performed with your email address, routed either through your company's identity provider (IdP) or through Microsoft Entra External ID, depending on configuration.
Data processed: email address, name, profile information, company account, site assignment, roles and permissions.
Legal basis: Art. 6(1)(b) GDPR (contract governing use of the cloud functions).
Retention: for the duration of the contractual relationship; deleted thereafter unless statutory retention obligations apply.
4.3 Cloud synchronisation of reports (opt-in)
After signing in, you can store analysis reports on PartikelART servers. This function is optional and only executed at your request.
The following is transmitted and stored:
- report data (analysis number, examiner, dates, comment, tags, particle measurement data, size classes, test specification),
- the associated captures (polarised / non-polarised) and the generated PDF report,
- your email address as an association attribute, your account and site assignment, and the time of upload.
Reports created or edited without an internet connection are held on the device and transferred automatically as soon as a connection is re-established. Signing out stops the transfer. Reports already stored can be deleted in the customer portal or through our Data Protection Officer.
Purpose: cloud storage of your reports with cross-device access and team access via the customer portal.
Legal basis: Art. 6(1)(a) GDPR (consent), in conjunction with Art. 6(1)(b) GDPR for account management. You may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), e.g. by signing out or deleting the data.
Retention: until deleted by you or your organisation, at the latest 90 days after the end of the contractual relationship. The handling of confidential data in relation to your organisation is governed by a separate data processing agreement.
4.4 Licence and purchase verification
To verify in-app purchases and licences, the app uses the RevenueCat service. Data processed: purchase data of the respective app store and an app account identifier.
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (prevention of misuse).
4.5 Contact
If you contact us by email, we store the data you provide (company, email address, name, phone number, content of the enquiry) to answer your request. Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR. We delete the data as soon as it is no longer required for handling the request and no statutory retention obligations apply.
5. Recipients — service providers and processors
We use the following service providers as processors (Art. 28 GDPR) to operate the app and its cloud functions:
| Purpose | Provider |
|---|---|
| Hosting and operations | Hetzner Online GmbH, Gunzenhausen, Germany |
| Database | Neon Inc. (PostgreSQL, EU region) |
| Content delivery, DDoS protection | Cloudflare Inc. |
| Authentication | Microsoft Corporation (Microsoft Entra External ID) |
| Licence and purchase verification | RevenueCat Inc., USA |
| Customer-specific deployment (on request) | Microsoft Corporation (Azure PostgreSQL, Azure Blob Storage) |
Data processing agreements or equivalent guarantees are in place with all providers. No data is passed on for advertising or other commercial purposes.
Beyond this, we transfer data to third parties only where we are legally obliged to do so, by court order, or where this is necessary for legal or criminal prosecution in the event of attacks on our infrastructure.
6. Transfers to third countries
Licence verification data (RevenueCat) is transmitted to servers in the United States. The transfer is based on the provider's certification under the EU-US Data Privacy Framework (Art. 45(1) GDPR), alternatively on Standard Contractual Clauses (Art. 46(2)(c) GDPR).
7. Data security
We take state-of-the-art technical and organisational measures to protect your data against manipulation, loss, destruction and unauthorised access. Transmission between the app and our servers is encrypted (TLS).
8. Your rights
With regard to your personal data, you have the following rights against us:
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
- withdrawal of consent with effect for the future (Art. 7(3) GDPR).
To exercise your rights, contact: privacy@partikel-art.de
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
9. Deletion of data
We delete personal data as soon as it is no longer required for the respective purpose and no statutory retention periods apply. Where a statutory obligation prevents deletion, we restrict processing; the data is then blocked and not processed for any other purpose.
10. Automated decision-making, minors
No automated decision-making within the meaning of Art. 22 GDPR takes place. The app is intended for commercial users; use by minors is not intended.
11. Liability for content and links
As a service provider we are responsible under § 3(1) DDG (German Digital Services Act) for our own content in this app in accordance with general law. Under § 3(2) DDG we are not obliged to monitor transmitted or stored third-party information or to investigate circumstances indicating unlawful activity. Obligations to remove or block information under general law remain unaffected; liability is only possible from the time we become aware of a specific infringement.
The respective provider is responsible for the content of linked external websites. Linked pages were checked for possible legal violations at the time of linking. Upon becoming aware of infringements, we will remove the affected content and links immediately.
12. Copyright
Content and works created by the app operator in this app are subject to German copyright law. Reproduction, editing, distribution and any kind of use beyond the limits of copyright law require the written consent of the respective author. Third-party content is marked as such. Should you become aware of a copyright infringement, please notify us.