This privacy policy explains how personal data is processed when you use the Smart Business Plattform app ("SBP", "the app") on iPhone, iPad and Mac. It covers the app only. The SBP web portal is covered by its own documents.
01Who is responsible
SBP is business software that Software Network + Communication GmbH (SNC GmbH) operates for its own business. SNC GmbH gives you an account and alone decides on the purposes and means of processing. It is therefore the sole controller for all data processed in the app and the portal:
| Data | Controller (Art. 4(7) GDPR) |
|---|---|
| Everything you and your colleagues enter or record in the app: companies, contacts, assignments, service reports, time entries, parts, expenses, photos, files, signatures and work-site locations | SNC GmbH |
| Your user account (name, email address, role) and how it is used to run the service, including security, support and billing purposes listed in section 4 | SNC GmbH |
| Technical server logs needed to operate and secure the service | SNC GmbH |
Controller and provider of the app (us):
Software Network + Communication GmbH
Am Breiten Graben 31
31558 Hagenburg, Germany
Email: info@snc-it.com
Website: https://snc-it.com
Data protection officer: Bastian Pawlik (SNC GmbH), bastian.pawlik@snc-it.com
If you have a question about your data, contact us at the address above or our data protection officer.
02What the app does not do
- No tracking. The app does not track you across apps or websites owned by other companies, and it does not use the advertising identifier (IDFA).
- No advertising and no advertising SDKs.
- No third-party analytics or crash-reporting SDKs. The app does not send usage statistics to us or to anyone else. Apple may share crash reports with us if you turned on "Share with App Developers" in your device settings (see section 6).
- No selling of personal data.
- No background location. Your location is read only when you tap "Use current location" (see section 3.5).
03Data processed when you use the app
3.1 Server connection
When you first set up the app, you enter or scan (QR code) the address of the SBP portal. That address is stored on your device only. All data the app sends goes only to that portal, over an encrypted connection (HTTPS).
3.2 Signing in and your account
- What: your email address and password when you sign in, plus the profile the portal returns: name, email address, role, team and organisation.
- Stored on the device: a sign-in token in the device's Keychain. Your password is not stored on the device.
- Password reset: if you use "Forgot password", your email address is sent to the portal, which emails you a verification code.
- Purpose: authenticating you and showing data you are allowed to see.
- Deleted from the device when you log out, change server or your session ends.
3.3 Business data you enter or view
The app is a front end to the SBP portal operated by SNC GmbH. You can view, create and edit:
- CRM records: companies and contact persons, including names, job titles, phone numbers, email addresses, postal addresses, notes and, if SNC GmbH records them, details such as date of birth.
- Service assignments: customer, work site, schedule, status, assigned technicians, team qualifications, opening hours.
- Service reports: form contents, time entries (technician, date, start and end times, breaks, travel), parts, serial numbers, expenses and receipts.
- Signatures: a signature drawn on the screen (for example by the customer's representative) is sent to the portal as an image and attached to the report. It is not used for biometric identification.
This data is processed by SNC GmbH as controller (section 1). It concerns you, your colleagues and SNC GmbH's customers and their contact people. SNC GmbH is responsible for having a legal basis to record it and for informing the people concerned.
The app keeps this data in memory while you work and loads it again from the portal as needed. Some state is stored on the device so the app can keep working after it is closed. That includes a running report timer (report, start time, pauses) and the work-day timer.
3.4 Camera, photos and files
The app asks for camera access only when you use a camera feature. Access to your photo library and files goes through the system picker. The app sees only the items you choose.
- QR code scanning: used to read the portal address. The camera image is processed on the device only. Nothing is stored or transmitted except the scanned address, which fills the server field.
- Report photos, receipts and attachments: photos you take or choose, and files you select, are re-encoded on the device (JPEG) and uploaded to the portal as part of the service report. Photos may contain people, licence plates or other personal data. Only capture what the report needs.
You can withdraw camera access at any time in Settings → Privacy & Security → Camera.
3.5 Location
- When: only when you tap "Use current location" on an assignment. The app then asks for permission ("While Using the App") and reads your precise location once.
- What happens: the coordinates are filled into the assignment's latitude/longitude fields. They are sent to the portal only when you tap Save, and then they are stored as the work site's coordinates, not as a record of where you were.
- No tracking: the app never reads your location in the background and does not record location history.
You can withdraw location access at any time in Settings → Privacy & Security → Location Services.
3.6 Maps (Apple Maps)
Assignment, company and work-site maps are displayed with Apple MapKit. To draw a map, your device requests map data from Apple for the area shown. Apple's handling of that data is described in the Apple Maps & Privacy notice. We do not receive data from Apple Maps.
3.7 Settings stored on the device only
The following stay on your device and are never sent to us: appearance (light/dark), notification, Wi-Fi-only and auto-sync preferences, the dashboard widget layout, the list/map and table/card views you chose, the position of the timer widget, whether you have seen the onboarding, and the portal address. They are deleted when you delete the app.
3.8 Server logs
When the app talks to the portal, the server records technical data needed to deliver and secure the service: IP address, date and time, requested endpoint, status code, app version and device type (user agent). These logs are kept for 30 days and then deleted, unless a security incident requires keeping them longer.
04Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the app and the portal for SNC GmbH's business operations (all data in 3.2–3.5) | Typically Art. 6(1)(b) or (f) GDPR and, for employees, § 26 BDSG. |
| Storing the sign-in token, settings and timer state on your device | § 25(2) No. 2 TDDDG (strictly necessary for the service you requested) |
| Operating and securing the servers (server logs, 3.8) | Our legitimate interest in a secure, working service, Art. 6(1)(f) GDPR |
| Answering support requests you send us | Art. 6(1)(b) or (f) GDPR |
| Complying with legal obligations (for example retention under tax law) | Art. 6(1)(c) GDPR |
Where we rely on legitimate interest, you may object (section 8).
05Recipients
- Within SNC GmbH: authorised users of the SBP portal see the data according to the roles and permissions set in the portal.
- Hosting: the portal runs on servers operated by Host Europe GmbH in Germany, under a data processing agreement.
- Email delivery: password-reset and notification emails are sent through the SMTP mail server defined in the MX record of our email domain.
- Apple: as distributor of the app (App Store), as provider of the operating system, and for map display (section 3.6).
- Authorities: only where we are legally obliged to disclose data.
We do not transfer personal data to countries outside the EU/EEA, unless this is stated above. Where a transfer does happen, it relies on an adequacy decision or the EU Standard Contractual Clauses (Art. 44 ff. GDPR).
06Crash reports from Apple
If you have turned on Settings → Privacy & Security → Analytics & Improvements → Share with App Developers, Apple may share anonymised crash and diagnostic reports with us. We use them only to fix errors. You control this setting, and the app itself does not collect such data.
07Retention
- On the device: the sign-in token until you log out; other local data until you delete the app.
- On the portal: we decide how long business data is kept and delete it when it is no longer needed, unless we are legally required to retain it.
- Server logs: see section 3.8.
08Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15),
- rectification (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interest (Art. 21),
- withdraw consent at any time, with effect for the future (Art. 7(3)), for example by turning off camera or location access in your device settings.
To exercise these rights, contact us or our data protection officer (section 1). You can reach us at info@snc-it.com.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen (LfD), Prinzenstraße 5, 30159 Hannover.
09Your account
Accounts are created and removed by SNC GmbH's SBP administrators, not in the app. To have your account deleted, ask your SBP administrator or contact us at info@snc-it.com.
10Security
Data is transmitted over HTTPS only. The sign-in token is kept in the device Keychain. Access on the portal is limited by user roles. Signed reports are locked against changes. We use technical and organisational measures appropriate to the risk (Art. 32 GDPR).
11Children
SBP is business software for professional use. It is not intended for children, and we do not knowingly process data of children under 16 as users.
12Changes
We will update this policy when the app or the law changes. The current version is always available at https://microsites.snc-it.com/sbp/privacy-policy.html and from within the app (Profile → Privacy Policy). The effective date at the top shows when it was last changed.