Privacy policy for the app “Lagerbewegung”

As of 2 November 2026.

The key points in one paragraph: “Lagerbewegung” is a pure client app. It connects exclusively to the inventory server whose address you enter yourself when logging in. There is no server of the app provider, no user account with the app provider and no transmission of data to third parties. The app provider never receives any data from your use. Advertising, tracking and analytics services are not included.

1. Controller for the app

The controller for the provision of the app within the meaning of the General Data Protection Regulation (GDPR) is:

Geier-IT – Anton Geier, Untere Bergstraße 2, 55487 Sohren, Deutschland. Email: info@geier-it.eu. Telephone: +49 152 04202892.

Further information can be found in the Impressum (legal notice).

It is not the app provider who is responsible for the data processed on the inventory server you have chosen, but the operator of that server – as a rule, your employer. See section 7.

2. How the app works

“Lagerbewegung” is used to manage devices and inventory. The app is a standalone client for servers with a Snipe-IT API.

• When you first start the app, you enter the address of the server the app is to connect to, together with your user name and your personal API token.
• After that, the app communicates exclusively with that one server. There is no fixed address and no connection to systems of the app provider.
• A user account on the relevant server is a prerequisite. Without access, the app cannot be put to productive use.

Demo mode

On the login screen, “View demo” starts a demo with fictitious sample devices. No personal data whatsoever is processed in doing so:

• There is no connection to any server – neither to an inventory server nor to the provider.
• All data is entirely fictitious and is held exclusively in working memory.
• Nothing is stored on the device. The demo ends when the app is closed.

The demo serves solely to try out how the app is operated. A Snipe-IT server of your own is required for live operation.

3. Data stored on your device

This data is stored in the operating system's encrypted storage (on Android, in the EncryptedSharedPreferences via the Android Keystore) so that you do not have to log in again each time you start the app. When you log out, the user name, API token and account details are removed from the device completely.

The details of the logged-in account are additionally kept locally so that the app starts and stays logged in even without a network connection – for example in a basement, in a hall or on a building site. Without a connection, the app displays a notice to that effect; you are logged out only if the server expressly rejects your token.

4. Data transfer to the server you have chosen

All application data is exchanged exclusively between your device and the server you have entered, always over a TLS-encrypted HTTPS connection. The app does not permit unencrypted connections (http://).

The following is transferred:

• Your API token for authentication with every request
• Your bookings: checking out a device to your user, rebooking, placing into storage including the selected condition
• Search queries for device or serial numbers

From the server, the app receives device data (device number, serial number, model, category, status, device image) and the information about which user a device is currently assigned to. In this process, the names of other employees may also be displayed.

As is technically necessary, every request also transmits your device's IP address to the server. How long the server logs this is determined by its operator.

5. Camera

To scan QR codes and barcodes, the app requests the Camera permission.

• The camera image is evaluated exclusively in real time in order to recognise a code.
• Recognition runs entirely on your device (Google ML Kit Barcode Scanning, embedded locally in the app). No connection to the outside exists for this.
• No photos or videos are taken, stored or transferred – neither to the inventory server nor to third parties.
• Only the recognised character string, that is, the device or serial number, is sent to the server.
• The app can also be used without camera access: device and serial numbers can be entered manually.

6. What the app does not do

• No advertising. No advertising networks are integrated.
• No tracking, no analytics. No analytics, crash reporting or statistics services are integrated.
• No disclosure to third parties. Data goes exclusively to the server that you yourself have entered.
• No transmission to the app provider. Geier-IT does not operate a server for this app and receives no usage data whatsoever.
• No location, no contacts, no microphone, no access to the photo gallery.

Overview of requested permissions

The app requests no further permissions.

7. Responsibility for the inventory data

The actual inventory, assignment and booking data is located on the server that you enter in the app. The controller within the meaning of the GDPR for this data is the operator of that server – in business use, therefore, your employer, not the provider of the app.

Requests for access and erasure concerning inventory data are therefore also to be addressed to that operator. You will receive separate privacy information on this from your employer.

Note for companies using the app: The app makes it traceable who took over which device and when. Such data may be suitable for monitoring behaviour or performance. Where a works council exists, its introduction is, as a rule, subject to co-determination under § 87(1) no. 6 BetrVG.

8. Legal bases

Insofar as the app provider processes data – this concerns exclusively the local storage on your device under section 3 – this is based on:

• Art. 6(1)(b) GDPR – provision of the function you have requested
• Art. 6(1)(f) GDPR – legitimate interest in a functional and secure application

For processing on the inventory server, § 26(1) BDSG additionally applies as a rule, insofar as the app is used in the employment relationship. The server operator is responsible for this (section 7).

9. Storage period

• On the device: see the table in section 3.
• On the server: in accordance with the requirements of the respective operator and the statutory retention periods.

10. Your rights

You have the following rights against the respective controller:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

For matters concerning the app, contact info@geier-it.eu. For inventory data on the server, contact its operator (section 7).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the authority of your place of residence or that of the controller.

11. Deleting data

• Data on the device: In the app under Settings → Log out, the user name and API token are removed. When the app is uninstalled, all local data, including the server address and the image cache, is deleted.
• Data on the server: informal request to the operator of the server. Deletion takes place unless statutory retention obligations stand in the way.
• The app provider holds no data that could be deleted.

12. Changes to this policy

This privacy policy is amended if the app or the legal position changes. The current version at any given time is available at this address.

13. Note on trademarks

“Lagerbewegung” is an independently developed client for servers with a Snipe-IT API. The app has no connection to the Snipe-IT project and is neither operated nor supported by it. Product names mentioned are trademarks of their respective owners.

This policy applies exclusively to the app “Lagerbewegung”. The general privacy policy applies to the website geier-it.eu/software.