Heidelberg University
heiCOLLECTIONS logo

Datenschutzerklärung für die App „heiCollections“

Version: July 2026
Pursuant to Art. 13 of the General Data Protection Regulation (GDPR), you will find below information on the processing of personal data by Heidelberg University in connection with the use of the augmented reality app “heiCollections”

The most important points at a glance

  • The app runs largely locally on your device. No user accounts are created.
  • No tracking, no advertising, and no profiling take place. No cookies, no analytics or advertising SDKs, and no device or advertising IDs are used.
  • Personal data arise only in the form of technically necessary connection data when content, 3D models, and map sections are loaded.
  • The research module records exclusively anonymous statistics, already anonymized on your device, with no reference whatsoever to any person or device

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other data protection provisions is: Heidelberg University, legally represented by the Rector Prof. Dr. Frauke Melchior Grabengasse 1, 69117 Heidelberg, Germany Email: rektorin@rektorat.uni-heidelberg.de

II. Name and address of the Data Protection Officer

The controller’s external Data Protection Officer is: Ass. jur Christian Dugall Heilbronner Str. 156, 70191 Stuttgart Email: datenschutzbeauftragter@uni-heidelberg.de

III. General information on data processing

1. Scope of the processing of personal data As a rule, we collect and use users’ personal data only insofar as this is necessary to provide a functional app and our content and services.

2. Categories of personal data Pursuant to Art. 4 GDPR, personal data are all information relating to an identified or identifiable natural person. In connection with the use of this app, we process exclusively technically necessary connection data arising when app content and map displays are retrieved, as well as when anonymous research events are received (IP address, date and time of access, information on the operating system). No real names, email addresses, or user-related accounts are created. No tracking, profiling, or advertising-related evaluation takes place; cookies and analytics and advertising SDKs are not used.

3. Purpose of processing The processing of the data named above takes place exclusively for the purpose of technically providing the app content, analysing errors, and ensuring system stability.

4. Legal basis for processing If processing is necessary for the performance of a task incumbent on Heidelberg University under the State Higher Education Act (for example, the promotion of students’ intellectual interests (§2 para. 3 LHG)), Art. 6 para. 1 lit. e in conjunction with para. 3 GDPR in conjunction with §12 para. 1 LHG serves as the legal basis for processing. If processing is necessary for the performance of another task that is in the public interest or carried out in the exercise of official authority conferred on Heidelberg University, Art. 6 para. 1 subpara. 1 lit. e in conjunction with para. 3 GDPR in conjunction with § 4 LDSG BW serves as the legal basis for processing. If processing is necessary to ensure the technical protection of systems and, as a consequence, the security of the personal data stored in those systems, Art. 6 para. 1 lit. c in conjunction with Art. 32 para. 1 GDPR serves as the legal basis.

5. Recipients For the development, provision, and technical maintenance of the app, we use Playersjourney GmbH (Lohmühlenstraße 65, 12435 Berlin) as a processor strictly bound by instructions in accordance with Art. 28 GDPR. The following services are used for the technical delivery of content:

  • Texts, images, and audio content via services of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
  • 3D models of the exhibition objects via Unity Cloud Content Delivery (Unity Technologies, Inc., 30 3rd Street, San Francisco, CA 94103, USA).
  • Map display and pedestrian navigation via Mapbox (Mapbox Inc., USA).
  • For the precise placement of content on footpaths, anonymous geometry queries are also sent to the OpenStreetMap Overpass API.

In this process, connection data required for technical reasons, in particular the IP address, are transmitted to these providers. Insofar as data are transferred to the USA in this context, this takes place based on the adequacy decision of the European Commission regarding the EU-US Data Privacy Framework or based on standard contractual clauses pursuant to Art. 46 GDPR.

6. Data erasure and storage period Personal data are erased or blocked as soon as the purpose of storage no longer applies. The connection data arising technically at the service providers used are erased after their standard retention periods. Technical connection data arising on the server infrastructure operated by Heidelberg University for the anonymous research module (Section VI), in particular IP addresses, are limited to the technically required minimum and are deleted or truncated without delay.

IV. Provision of app content

1. Description and scope The app content (texts, images, audio) is retrieved when accessed via the infrastructure of our service provider Google. The 3D models of the exhibition objects are retrieved via the infrastructure of our service provider Unity Cloud Content Delivery (USA). In this process, the following data are processed for technical reasons:

  • Information about the operating system and version
  • the user’s IP address
  • date and time of access

For the provision of app content, Heidelberg University itself does not operate its own server infrastructure and does not store these data itself. These data are not combined with other personal data of the user.

2. Legal basis The legal basis for the temporary processing of these data is, insofar as this concerns university tasks under the State Higher Education Act, Art. 6 para. 1 subpara. 1 lit. e in conjunction with para. 3 GDPR in conjunction with §12 para. 1 LHG; insofar as this concerns other public tasks, Art. 6 para. 1 subpara. 1 lit. e in conjunction with para. 3 GDPR in conjunction with § 4 LDSG BW. Insofar as processing is necessary to ensure the security of personal data, the legal basis follows from Art. 6 para. 1 lit. c in conjunction with Art. 32 para. 1 GDPR.

3. Purpose The temporary processing of the IP address is technically necessary to deliver the app content to the user’s end device.

4. Duration of storage Heidelberg University itself does not store any connection data in its own infrastructure. The connection data arising technically at our service providers are erased after standard retention periods.

V. Access to device functions (camera and location)

To provide you with the augmented reality experience (AR) and location-based content, the app requires access to certain functions of your device:

1. Camera The app uses your device’s camera exclusively locally to project digital objects into your real environment. At no time are image or video recordings stored or transmitted to servers.

2. Location data (GPS) The app accesses your device’s GPS data locally to determine whether you are near an exhibition trigger point. On Android devices, location determination is supported via the Fused Location Provider of Google Play Services; within its system services, Google processes the signals from your device required for location determination (GPS, Wi-Fi, mobile network). Your GPS coordinates are at no time transmitted to Heidelberg University or Playersjourney GmbH, and no movement profiles are created. Only within the scope of the anonymous research module (see Section VI), outside Heidelberg, the name of the nearest city is determined locally on your device and recorded statistically without any reference to a person or device.

3. Map service Mapbox The app uses the Mapbox service (Mapbox Inc., USA) to display the map and provide pedestrian navigation. When map sections are loaded, your IP address and the requested map sections are transmitted to Mapbox for technical reasons. The transfer to the USA takes place based on the EU-US Data Privacy Framework or Standard Contractual Clauses pursuant to Art. 46 GDPR. The app does not integrate a Mapbox SDK; Mapbox is accessed exclusively via the REST interfaces for map tiles and routing. No collection of telemetry or usage data by a Mapbox SDK takes place beyond this.

VI. Evaluation for research purposes (research module)

For the scientific evaluation of the app, we collect exclusively anonymous, non-personal usage statistics. Anonymization takes place on your device already (Privacy by Design): the app calculates the statistical values locally and transmits exclusively identifier-free individual events that contain no device or user identifier of any kind. Specifically, the following are recorded:

  • exhibition objects accessed (object identifier; the location of the objects in Heidelberg is known to us from our own data),
  • the language set in the app,
  • the duration of use of individual app sections within a session,
  • a feature calculated locally on the device indicating whether an object was visited repeatedly,
  • outside Heidelberg, the name of the nearest city (determined locally; GPS coordinates are not transmitted).

Neither IP addresses nor device IDs, advertising IDs, or other identifying features are stored with these events. It is therefore technically impossible to combine the events into user profiles or to recognize individual devices. The anonymous statistics transmitted in this way are received on a server infrastructure operated by Heidelberg University itself and evaluated there exclusively in aggregated, anonymous form. As these are not personal data, this processing does not fall under the provisions of the GDPR.

VII. Provision via the app stores (Apple App Store and Google Play)

The app is provided via the Apple App Store and Google Play. When downloading and using it via these platforms, the respective operators — Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) and Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), respectively — process data under their own responsibility under data protection law (e.g. your store account data, download information, and, where applicable, aggregated or anonymized usage and crash statistics). We have no influence over this processing; the privacy policies of the respective provider apply:

  • Apple:

https://www.apple.com/legal/privacy/de-ww/

  • Google:

https://policies.google.com/privacy

We receive statistics on downloads from the stores exclusively in aggregated, non-personal form.

VIII. Rights of the data subject

If personal data concerning you are processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis Heidelberg University:

  • Right of access (Art. 15 GDPR): You may request confirmation as to whether personal data concerning you are being processed.
  • Right to rectification (Art. 16 GDPR): You have the right to rectification and/or completion of inaccurate or incomplete data.
  • Right to restriction of processing (Art. 18 GDPR): Under certain legal conditions, you may request restriction of processing.
  • Right to erasure (Art. 17 GDPR): You may request immediate erasure, provided one of the legal grounds applies and the processing is no longer necessary.
  • Right to data portability (Art. 20 GDPR): You have the right to receive data concerning you in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 para. 1 subpara. 1 lit. e GDPR.
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority.

To exercise your rights, please contact the data protection officer named above.

The supervisory authority responsible for Heidelberg University is: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg Königstraße 10 a, 70173 Stuttgart Email: poststelle@lfdi.bwl.de

IX. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services, for example when introducing new functions. The version available at the time of your visit shall apply.

Deutsch

Kontakt