In short
- No tracking on this website. It sets no cookies, runs no analytics and loads nothing from other companies.
- You decide when to share your location. The mobile app sends it only while Live Tracking is on, or with a check-in, picture or SOS you send.
- Location points are deleted after 30 days. Automatically, every day.
- Your team sees what you share. People in your organization's OPSMAPIA channel, and those your organization shares its live feed with.
- We never sell your information or use it for advertising.
- You can ask to see, correct or delete it at any time.
The rest of this policy explains each of these in full.
Who we are
OPSMAPIA, Königstraße 18, 33330 Gütersloh, Germany ("OPSMAPIA", "we", "us"), runs the website at opsmapia.com, the OPSMAPIA web app and the OPSMAPIA mobile app for iPhone and Android. This policy covers all three.
We are responsible, as the "controller" under the EU General Data Protection Regulation (GDPR), for this website, for the enquiries you send us and for the records we keep to run the service securely.
We provide OPSMAPIA to organizations, which give accounts to their people. For what you and your team share in the apps, such as your location, messages and reports, your organization decides who has an account and who can see what, and we handle that information on its behalf under our agreement with it (Art. 28 GDPR). You can ask your organization about this, or ask us and we will help.
To contact us about privacy, send us a message through our contact form with "Privacy or account deletion" as the subject, or write to us at the address above.
Visiting this website
This website sets no cookies, uses no analytics or tracking, shows no advertising and loads no fonts, scripts or maps from other companies. If you have signed in to the web app, your browser also sends the app's sign-in cookie (see The web app) when you open pages of this website, since both are at opsmapia.com, but the website doesn't use it.
Like every web server, ours receives the technical details it needs to send you a page: your IP address, the time, the page you ask for, the page you came from, and your browser's name and version. It keeps them in a technical log only as long as needed to find faults and fend off attacks.
The links to the App Store, Google Play, LinkedIn and X are plain links. Those companies learn nothing from this site unless you follow one, and then their own privacy policies apply.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a website that works and is safe.
When you contact us
When you send the contact form, we receive your name, email address and organization, your phone number if you give one, the subject and your message, together with your IP address and the time. They reach us as an email. The website itself doesn't store them.
To stop abuse, the server counts how many messages each IP address sends, allows five an hour, and forgets the count within the hour.
We use what you send to answer you and, if you become a customer, to prepare and carry out our agreement. We keep it as long as we need it for that. Where German commercial or tax law requires us to keep business letters, we keep them as long as it requires, usually six years.
Legal basis: Art. 6(1)(b) GDPR, steps you ask for before an agreement; Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries and stopping spam; Art. 6(1)(c) GDPR, where the law requires us to keep business letters.
Your account
There is no public sign-up. Accounts are set up for an organization's people, and each holds a user name, a password, the person's name, the organization's channel and what the account may see and do. It also holds the settings saved as you use the app, such as the map's position, its layers and your widgets. Your password is stored only as a one-way hash, so no one can read it, including us.
To keep accounts secure, we keep these records:
- Sign-ins. Each sign-in, on the web or in the app, is recorded with the user name, the IP address, the app used and the time. We also receive an email about each sign-in, with the user name, the time and the IP address, so that we can spot misuse quickly. Sign-in records are deleted automatically after 180 days.
- Wrong passwords. After four wrong passwords from one IP address, the account can't be signed in to from that address for 15 minutes. The server keeps these attempts in its memory only.
- Changes. Each change in your organization's channel, such as adding, editing or deleting a report, is recorded with who made it, their IP address and the time, in an activity log your organization can see. The log is kept as long as the channel exists.
Legal basis: Art. 6(1)(b) GDPR, to provide the accounts agreed with your organization; Art. 6(1)(f) GDPR, our and your organization's legitimate interest in keeping accounts secure.
Location in the mobile app
The mobile app uses your phone's location only after you allow it, and sends it to OPSMAPIA only at these times:
- While Live Tracking is on, from when you tap Start until you tap Stop, including while the app is in the background or the screen is off.
- When you send a check-in, a picture or an SOS, each of which carries the position you sent it from.
To keep tracking in the background, the app asks for location access "all the time" on Android and "always" on iPhone. Your phone shows when location is in use, and you can take the permission back in your phone's settings at any time, which stops tracking. Without it you can still read and send messages.
What is sent
Your latitude and longitude, speed, direction of travel and how accurate the position is, with the time. While Live Tracking is on, your position is sent all the time, but it is only stored while you are moving.
Who sees it
The people in your organization's OPSMAPIA channel, on the live map, in the tracking history and in alerts. Also people in other organizations that your organization has chosen to share its live feed with. OPSMAPIA staff can see it where needed to run and support the service.
What it is used for
To show your team where you are and where you have been, to alert them when you enter or leave an area your organization has marked (a geofence), and to get help to you when you send an SOS. We don't use it for anything else, and we never sell it or use it for advertising.
How long it is kept
Live Tracking positions are deleted automatically 30 days after they were recorded. Check-ins, pictures and SOS messages stay in your organization's messages until they are deleted, as do alerts that someone entered or left a marked area.
Legal basis: Art. 6(1)(b) GDPR, the service agreed with your organization; Art. 6(1)(f) GDPR, your organization's legitimate interest in the safety of its people. Whether the app may use your location is always your choice, in your phone's settings.
More about the mobile app
- Messages and pictures. Messages, check-ins and pictures you send go to your organization's channel with your name and the time. The app takes pictures with the camera, after asking you for permission. Each picture is stamped with your name, the position and the time, and is stored with the message.
- SOS. Sliding to SOS sends an alert with your position to your team straight away, without asking you to confirm.
- Notifications. To send you alerts, the app gets a notification ID from Google's Firebase Cloud Messaging, which we keep with your account. Notifications reach your phone through Google and, on iPhone, Apple.
- Map. The app's map comes from Google Maps, so your phone connects to Google to load it.
- Staying signed in. Your sign-in is kept in your phone's secure storage until you sign out, which removes it.
- App statistics. The app includes Google Analytics for Firebase, which may record general statistics about how the app is used, such as when it is opened, the app and system version, the device model and the country, under a random app ID. They aren't linked to your name or your account.
- The iPhone tracking question. On iPhone the app asks whether it may track you, using Apple's standard question. If you allow it, the statistics above may include your device's advertising identifier; if you don't, they can't. We show no advertising, and the app works the same whatever you choose.
Legal basis: Art. 6(1)(b) GDPR for messages, SOS, notifications and signing in; Art. 6(1)(f) GDPR, our legitimate interest in an app that works well, for the statistics; Art. 6(1)(a) GDPR, your consent, for the advertising identifier, which you can withdraw in iPhone Settings under Privacy & Security, Tracking.
The web app
Signing in to the web app sets one cookie, OPSMAPIA_SESSION, which keeps you signed in. Your browser deletes it when you close it, and the sign-in it holds stops working 24 hours after you sign in, unless the map is open, which renews it. The web app also uses your browser's storage to remember which folders you opened in the map's lists, and a report you copied so you can paste it elsewhere. That stays in your browser. Both are needed for what you ask the app to do, so it doesn't ask for consent (§ 25(2) no. 2 TDDDG, the German law on cookies and device storage).
Maps, place search, addresses, directions and weather come from Google Maps Platform. To show them, your browser, and for some requests our server, connects to Google. Google receives your IP address and what each request needs, such as the area of the map you are looking at or the place you search for.
Live positions and messages reach the web app as they happen through Pusher, a service that delivers live updates.
Legal basis: Art. 6(1)(b) GDPR, the service agreed with your organization; Art. 6(1)(f) GDPR, our legitimate interest in providing maps and live updates through specialist providers.
Outside the EU
Some of these providers, such as Google, may process information outside the European Union, including in the United States. Where they do, the transfer is protected as the GDPR requires: by a European Commission decision that the country's protection is adequate, such as the EU-U.S. Data Privacy Framework for companies certified under it, or by the European Commission's standard contractual clauses.
How long we keep it
| Information | How long |
|---|---|
| Live Tracking positions | 30 days after they were recorded, then deleted automatically |
| Sign-in records: user name, IP address, web or app, and time | 180 days, then deleted automatically |
| Wrong-password attempts | 15 minutes, in the server's memory only |
| How many messages an IP address sent through the contact form | Up to an hour, in the server's memory only |
| Contact enquiries | As long as we need them to deal with your enquiry and any business that follows. Business letters as long as German law requires, usually six years |
| Account details and settings | As long as the account exists |
| Messages, check-ins, pictures, SOS messages, area alerts, reports and drawings | Until they are deleted in the app, or the account or the organization's channel is deleted |
| Activity log of changes in a channel, with IP addresses | As long as the organization's channel exists |
| The web app's sign-in cookie | Until you close your browser. The sign-in in it lasts 24 hours, renewed while the map is open |
| The mobile app's sign-in, on your phone | Until you sign out or remove the app |
| The web server's technical log | Only as long as needed to find faults and fend off attacks |
When an account or a channel is deleted, what is kept with it is deleted too, except where the table above says otherwise.
Deleting your account
You can ask us to delete your OPSMAPIA account, and the information linked to it, at any time:
- Send us a message through our contact form with "Privacy or account deletion" as the subject, and include your user name and your organization.
- We confirm the request with you and, as the account was set up for your organization, let your organization know.
- We delete the account within one month and tell you when it's done.
What is deleted: the account and its settings, your notification ID, the messages, check-ins, pictures and SOS messages you sent, and your Live Tracking positions. Reports, drawings and other map items you added are deleted too, unless your organization needs to keep them as part of its operations picture, in which case we tell you.
What stays for a while: sign-in records, until their 180 days are over, and the activity log of changes in your organization's channel, for as long as the channel exists.
Signing out of the app removes your sign-in from your phone, and removing the app removes everything it keeps on the phone.
Your rights
Under the GDPR you have the right to:
- get a copy of the information we hold about you (Art. 15);
- have it corrected (Art. 16);
- have it deleted (Art. 17);
- have its use restricted (Art. 18);
- receive it in a common, machine-readable format (Art. 20);
- object to its use where we rely on legitimate interests (Art. 21);
- withdraw a consent at any time, without affecting what was done before (Art. 7(3)), such as the location or tracking permission in your phone's settings.
To use these rights, send us a message through our contact form or write to us at Königstraße 18, 33330 Gütersloh, Germany. It costs nothing, and we answer within one month. Where we handle the information for your organization, we pass your request on to it and help it answer.
You can also complain to a data protection authority, in particular where you live or work, or to the one responsible for us: the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.
Keeping it safe
- Everything between your browser or phone and our servers travels encrypted.
- Passwords are stored only as one-way hashes.
- Repeated wrong passwords block sign-in for a while, and we are told about every sign-in.
- What you share is visible only in your organization's channel and to those it allows.
- On your phone, your sign-in is kept in the phone's secure storage.
No system is completely secure. If a breach puts your information at risk, we will tell you and the authorities as the law requires.
Also good to know
- Children. OPSMAPIA is a professional service for organizations and isn't meant for children under 16.
- No automated decisions. We don't make decisions about you based solely on automated processing.
- Giving information. You don't have to give us any information. Without an account you can't use the apps, and without your location their location features don't work.
Changes to this policy
We update this policy when our apps or the law change, and the date at the top shows when it last changed. If a change affects how your information is used, we also tell the organizations we work with.
Questions about this policy? Send us a message through our contact form or write to OPSMAPIA, Königstraße 18, 33330 Gütersloh, Germany.