The following notices provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified.
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice of this website.
To operate this website and the application we use processors from the category of hosting and infrastructure providers. They process personal data solely on our instructions and for the following purposes:
A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with every processor we use.
We will disclose the names and addresses of the processors we use to data subjects on request.
All content is stored exclusively on servers in Germany; every processor entrusted with that storage is established in the European Union. A transfer to third countries takes place only for the delivery of push notifications — and even then without names and without content — and, solely with your consent, for the web analytics of this website (see “Web analytics with Google Analytics”).
Technically, a push notification can only reach your mobile device through the delivery service of the respective operating system. These providers do not store anything for us; they merely transport the notification to your device:
In each case our contractual partners are the Irish companies; processing by their US parent companies cannot be ruled out. Such a transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which both companies are certified. We did not choose this route — it is the only way to deliver a notification to a mobile device, and it does not provide for any restriction to European data centres. This is why we transmit as little as possible in the process (see "Push notifications").
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the applicable data protection regulations and this privacy policy.
The responsible party for data processing on this website is:
Strecker Digital GmbH
Markgrafenstraße 41
74564 Crailsheim
Germany
Phone: +49 221 29195368
Email: info@echobos.de
Our website uses so-called "cookies". Cookies are small data packets that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device.
The session cookie “echobos-session” and the security cookie “XSRF-TOKEN” are technically necessary. They keep your session running and protect forms against misuse; they expire no later than 2 hours after your last page view. The legal basis is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(f) GDPR. We only set any other cookies with your consent.
With your consent, we use Google Analytics 4 on the public pages of this website, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This helps us understand how visitors find their way to our website and which content they use, so that we can improve our offering. The echoBOS app, the web application and all pages after login are excluded; no web analytics takes place there.
The data processed includes, in particular, the pages viewed (without personal details in the URL), the page you came from, date and time, device type, browser, operating system, screen resolution, your approximate location at country and region level, and interactions such as clicks on buttons, submitting a form (without its content) or expanding a question on the FAQ page. According to Google, your IP address is used only to determine your approximate location and is not stored. Google Signals and personalised advertising are disabled. We only use advertising features with your additional consent to “Marketing” (see “Measuring ad performance”).
For this purpose, Google Analytics stores the cookies “_ga” and “_ga_<ID>”, which contain a random identifier for your browser, for a maximum of 13 months. We store your consent decision locally in your browser (entry “echobos_einwilligung”) so that we do not have to ask again on every page view.
The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Google processes the data on our behalf; a data processing agreement is in place with Google. A transfer to Google LLC in the USA cannot be ruled out in the process. Such a transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google is certified. The analytics data is deleted automatically after 14 months.
Your consent is voluntary and can be withdrawn at any time with effect for the future, via “Cookie settings” at the bottom of every page or via the button below; when you withdraw it, the Google Analytics cookies in your browser are deleted. Further information: Google’s privacy policy
If you additionally consent to “Marketing”, we use Google Analytics to measure whether a visit that started with one of our ads on Google leads to a trial account or an enquiry via our forms. Google Analytics passes this result on to our advertising account with Google Ads, which is also operated by Google Ireland Limited. This shows us which ads and search terms work, so that we can use our advertising budget in a targeted way. We do not use remarketing, personalised advertising or Google Signals.
The data processed is the ad click identifier (“gclid”) from the address through which you reached our website and the information that a trial account was created or an enquiry was sent, but not its content. For this purpose, Google may store the cookies “_gcl_au” and “_gcl_aw” in your browser for a maximum of 90 days.
The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For a transfer to the USA, the information given above on Google Analytics applies. Without your consent to “Marketing”, this measurement does not take place. You can withdraw it at any time via “Cookie settings”, also independently of “Statistics”; the cookies mentioned are then deleted.
If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing your inquiry and in case of follow-up questions.
If your organisation activates the optional “Deadlines” module, its administration can store the name of a deadline and the associated validity or due date for you. This may include the date of your next occupational fitness examination. Because even this date may reveal information about your health, we treat it as health data. Findings, diagnoses, certificates, copies of evidence and the result of any fitness decision must expressly not be stored in echoBOS.
You can see only your own entries; your organisation's administration can see the entries of the organisation's members. The data is used for organisational overview and reminders. echoBOS does not determine fitness or operational clearance, and a reminder replaces neither the authoritative original document nor any required examination and documentation process. Push notifications contain no name, deadline type or date.
Your organisation is responsible for the professional use of this feature and, before activating it, must determine and document the required legal basis under Article 6 GDPR and, for health data, an exception under Article 9(2) GDPR. echoBOS processes this data on your organisation's instructions. Entries are deleted when the administration removes the entry, its deadline type, your account or the organisation. You may contact your organisation or us to request access, correction or deletion.
You have the right at any time to obtain free information about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data.
If you have given your consent to data processing, you may revoke this consent at any time with effect for the future. For this purpose as well as for any further questions regarding data protection, you may contact us at any time.
The following notes concern the echoBOS mobile app. Within the app, your organisation's data is processed separately and made available only to members of your organisation.
The camera is only opened after an explicit action, for example when you take a photo in a chat. Preview and editing (cropping, marking, caption) happen locally on your device. Captures are initially stored only temporarily on the device; they are transmitted to echoBOS only when you choose "Send". You can revoke the camera permission at any time in your device's system settings.
If you wish to attach an existing photo or video, the app uses your operating system's permission-free system picker. This grants the app access only to the files you specifically select; the app does not read your photo library. Only when you send them are the selected or captured photos and videos transmitted to the echoBOS servers and made available to the participants of the respective chat within your organisation.
The microphone is used only while you are actively recording, for example for a voice message in a chat or for the audio track of a video. No recording takes place in the background. The recording stays on your device at first; only when you send it is it transmitted to the echoBOS servers as message content and made available to the participants of that chat. You can withdraw the permission at any time in your device settings.
The app collects your location only when you share it yourself in a chat. No background location tracking takes place; the app deliberately requests only the "While Using the App" permission. When you share a location, the following are processed: geographic coordinates, time of measurement, accuracy and, where available, the corresponding address. This data is stored together with the message on our infrastructure and is visible to the members of that chat. If you delete the message, the location data is irrevocably removed on the server. The legal basis is Art. 6(1)(a) GDPR (consent), which you give by sharing and may withdraw at any time by revoking the location permission.
To determine the address for your coordinates, the app uses your operating system's geocoding service (Apple or Google). Your coordinates are transmitted to that provider. To display the map in the selection dialog, map tiles from the OpenStreetMap Foundation are loaded; your IP address and the visible map section are transmitted in the process. No such transmission takes place when you receive a location: the message shows no map tiles, and the map only opens in your system's map app after you deliberately tap it.
You receive push notifications only if you consent to them on your device; you decide in the app settings which areas may notify you. We use CleverPush GmbH as a processor for sending them; delivery then necessarily takes place via Google (Android) or Apple (iOS). All that is transmitted in the process is a pseudonymous device identifier (push token), a reference to the area concerned — for example "New notification: Chat" — and internal reference numbers so that tapping the notification takes you to the right screen. Names, message texts, event titles or defect report titles are not transmitted: they do not leave our servers in Germany and can only be seen in the app itself. The analytics functions of the service used are permanently disabled in the app. You can stop receiving notifications at any time in the app or in your device settings.
If you wish, you can add an event to your device calendar. This writes to your device only; no calendar data is transmitted to us and no existing events are read. You can withdraw the permission at any time in your device settings.
App accounts are created and managed exclusively by your organisation; there is no public self-registration. Access is unlocked with an invitation code issued by your organisation. If you leave, your organisation's administration removes the account together with the associated data. You may also address requests for information or deletion directly to us at any time; the contact details can be found above under "Controller".
With your consent we use Google Analytics: under “Statistics” to understand how this website is used, and under “Marketing” additionally to measure whether visits from our ads on Google lead to an enquiry or a trial account. This stores cookies and transfers usage data to Google, including to the USA. There is no personalised advertising. The echoBOS app and the web application are not affected. You can change your choice at any time under “Cookie settings”. More in the privacy policy