Privacy statement of the emergency call app 'nora'

The following privacy statement informs you how your personal data (hereinafter also: data) is processed when using the official emergency call app 'nora' (hereinafter: the App) of the federal states and what data protection rights you are entitled to. 

For information on processing of your personal data while using the website nora-notruf.de, please refer to the separate privacy statement for this website.

The protection of your data is of particular concern to the controllers, which is why personal data is only processed to the extent necessary. In the following, a general section points out the scope of this privacy statement and explains who is responsible for data processing within the App and which service providers ('recipients') are involved in the processing of your data (see Sections 1 – 3). Insofar as the controllers are named in Section 2 alone or jointly with others, determine the purposes and means of the processing, they are obliged in particular to provide the data subject (hereinafter also 'you', 'user') transparently about type, scope, purpose, period for which the data will be stored and the legal basis of the processing (cf. Article 13 f. of the General Data Protection Regulation (hereinafter: GDPR)).

The individual data processing procedures within the App are described in Section 4. Important details such as the categories of data to be processed, the legal bases for the processing and information on the storage period of your data are provided for each process. 

At the end of this privacy statement, you will be informed about your rights and will find a list of the contact details of all data controllers as well as a reference to where the contact details of the data protection officers of the data controllers can be found (see Sections 5 – 8). 

In order to find the parts relevant to you, please refer to the following table of contents of this privacy statement:

Insofar as the terms 'personal data'/'special categories of personal data', 'processing', 'controller', 'third party', 'processor' and 'consent' are used in this privacy statement, they correspond to the meanings assigned to them in Article 4 GDPR. 

We would like to point out that in context of developments in data protection law as well as technological or organisational changes, this privacy statement is regularly reviewed for the needs of adaption and amendment. You will be informed immediately of any changes. The privacy statement shown here is the version 2 dated September 2024. 

Overview

  1. Joint responsibility of the competent authorities in all federal states for data processing; contact details for questions, suggestions and complaints
  2. Scope of application of this privacy statement; control centres as recipients of data
  3. Service providers as recipients of your data
  4. Data processing procedures in detail 
  5. Your rights
  6. Contact details of the controllers
  7. Contact details of the data protection officer
  8. Information pursuant to Article 26 (2) GDPR 

With regard to Sections 1 – 8 and their Subsections, a brief summary of content is provided first to give you an initial overview. This is followed by a detailed explanation in which the details of the respective Sections from the overview are presented in detail. 

1. Joint responsibility of the competent authorities in all federal states for data processing; contact details for questions, suggestions and complaints

Summary: 16 federal states are jointly responsible for processing your data within the App.

The competent authorities in all 16 federal states (hereinafter referred to as 'states') are jointly responsible for data processing within the App. In an agreement pursuant to Article 26 GDPR, the federal states have stipulated that the internal administration and organisation of the App is carried out by the established Business and Coordination Office, which is currently integrated into the Ministry of the Interior in the state of North Rhine-Westphalia (NRW) and serves as the direct contact point for citizens and all persons affected by the data processing (data subjects). 

Summary: Accessibility of the direct contact person (Business and Coordination Office as special contact point in the state of NRW) and the controllers.

The contact details of the Business and Coordination Office are as follows:

Ministry of the Interior of the State of North Rhine-Westphalia 
Business and Coordination Office Emergency Call App System 
Friedrichstr. 62-80 
40217 Duesseldorf

E-mail: poststelle[at]im.nrw.de

To contact us, you can also use the following notification/contact form in the App or on the website of the App at the following link: 

https://www.nora-notruf.de/fragen/support/

In principle, you can assert your data subject rights against any controller and address your data protection enquiries to any controller. You can find the contact details of the controllers here:

https://www.nora-notruf.de/verantwortliche-stellen/

For organisational reasons, we recommend you to address all questions, suggestions and complaints to the forementioned Business and Coordination Office or use the notification/contact form above. 

Section 7 explains how you can view the contact details of the respective data protection officers of the data controllers.

2. Scope of application of this privacy statement; control centres as recipients of data

Summary: This privacy statement only concerns data processing within the App.

This privacy policy only applies to the processing of personal data within the emergency call app system. The exact procedures and categories of data subject to the processing are explained in detail in Section 4.

Summary: As soon as the emergency call or the emergency call data is transmitted to the responsible control centre in the federal states, the joint controllership of the federal states ends and the state of the locally responsible control centre is the only controller when processing your data.

At the moment the emergency call is made, the data collected during the emergency call (see Section 4) is transmitted via the App to the locally responsible police or non-police emergency call centres of the federal states (hereinafter: control centres). From the moment the (emergency call) data is transferred to the locally responsible control centres, only the operators of the responsible control centres are responsible for the processing of the transferred (emergency call) data (controllers of the emergency call data). Therefore, it may vary depending on the federal state, as to which control centre is responsible for the further processing of the emergency call data once the emergency call has been received. Depending on the federal state, the further processing of the emergency call data may also be handled differently. For example, there may be different storage periods. 

For information on the further processing of emergency call data from the time it is received by the locally responsible control centres, please refer to the privacy statement of the respective control centre. The App displays which control centre receives the emergency call and/or the emergency call data.

3. Service providers as recipients of your data

Summary: In order to ensure trouble-free operation, functionality and availability of the App, we pass on your data to an IT service provider, an identification service provider, and an Internet network operator who process your data on our behalf.

The technical operation, maintenance and hosting of the emergency call app system was transferred by the controller to the service provider bevuta IT GmbH, Ettore-Bugatti-Straße 35, 51149 Cologne. bevuta IT GmbH will process your personal data on its servers for the aforementioned purposes.

If user identification is required upon registration to prevent misuse of the App, this will be carried out by Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany, as the identification service provider. For this purpose, you will be forwarded directly to the POSTIDENT portal of Deutsche Post AG. Further details on the identification process and the data processed in this context can be found in Section 4.6.

In addition, an Internet network operator checks incoming data traffic for any DDoS (Distributed Denial-of-Service) attacks and takes appropriate protective measures if attacks are detected; however, no personal data is usually processed in this context. 

If the App crashes, crash reports are generated which are submitted to the technical service provider (bevuta IT GmbH) and analysed by them in order to improve the stability of the App. The crash reports may contain information relating to the use of the App, such as device type, operating system, App version and time of the crash. The only purpose of this is to improve and further develop the functions of the App. 

Summary: The aforementioned service providers/recipients of your data process your personal data exclusively in accordance with our instructions and on our behalf and may not process your data for their own purposes. 

In addition, the aforementioned service providers process the personal data of the users listed in detail under Section 4 exclusively on the instructions and on behalf of the controller, only insofar as this is either necessary for the provision of the App or to ensure the (trouble-free) operation. For these purposes, we have concluded an agreement on the processing of personal data (data processing agreement - DPA) with the aforementioned service providers in accordance with Article 28 (3) GDPR or the relevant provisions of state data protection law (in particular the Data Protection Act of North Rhine-Westphalia – DSG NRW), insofar as this is legally required. 

Beyond this, data will only be transferred to third parties if we are obliged by law to do so in individual cases, e.g. in the event of inquiries submitted by security or law enforcement authorities.

 

4. Data processing procedures in detail

4.1. Download of the App

Summary: When you download the App, your personal data (email address, App ID, individual device identification number and time of download) is transmitted to the app Store (Apple App Store / Google Play Store).

When you download the App, only data required for this purpose (e.g. email address, App ID, device type or time of download) will be transmitted to the app store (Apple App Store or Google Play Store). In addition, the app store may collect various data independently and provide you with analysis results. We have no influence on this data processing procedure and are not responsible for it. We only process your data to the extent necessary to download the App to your mobile device. 

Legal basis

Summary: Your data is processed either because it is necessary for the performance of a contract or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

If your personal data is processed by us as part of the download of the App, this is done on the legal basis of Article 6 (1) (b) second alternative GDPR. This legal basis permits data processing also to take steps prior to entering into a contract, insofar as these are carried out at the request of the data subject (here: by 'download'). The contract (here: user contract) to be entered into afterwards is concluded between you and the State of North Rhine-Westphalia, represented by the Ministry of the Interior of the State of North Rhine-Westphalia. For further details on the conclusion of the contract, please refer to the Terms of Use for the mobile App, available at https://www.nora-notruf.de/nutzungsbedingungen/. 

Insofar as the processing of the aforementioned data is not absolutely necessary in order to take steps prior to entering into a contract, the data is processed on the legal basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis makes the processing of personal data lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The federal states are obliged by law to ensure that emergency calls are answered.

4.2. Access to the App

Summary: Data is automatically collected when the user accesses the App. From a technical point of view, the collection is necessary for the operation and provision of the App. 

Each time the App is used, the data listed below is automatically collected and exchanged. The collection of this data is necessary from a technical point of view in order to provide the functions of the App and to ensure the stability and security of the application. This data is: 

  • IP address of the Internet service provider
  • App ID (if already available),
  • User ID (if already available),
  • Version of the installed App,
  • Date and time of access,
  • Destination address of the access,
  • Amount of data transferred, if applicable,
  • Notification whether the access was successful.

Legal basis

Insofar as it is necessary for the provision of the App, the data is processed on the legal basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis makes the processing of personal data lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The federal states are obliged by law to ensure that emergency calls are answered.

4.3. Registration process

Summary: Registration is required to use the App. Mandatory information for registration: Declaration of consent to the Terms of Use, acknowledgement of the privacy statement (incl. content and versioning), mobile phone number, number of SMS messages requested for registration (incl. number of code entry attempts), first and last name, callback option: ('yes'/'no'/'no information'), registration App ID (discarded after registration) incl. time stamp, IP address upon registration, version of the installed App, user ID of the successfully registered account, OS version, device-related information.

After downloading and opening the App for the first time, you will be asked to register. As part of the registration process, the following data (hereinafter referred to as 'registration data') will be collected from you:

  • Declaration of consent to the Terms of Use, acknowledgement of the privacy statement (incl. content and versioning)
  • Mobile phone number,
  • Number of SMS messages requested for registration (incl. number of code entry attempts),
  • First name and surname of the user,
  • Callback option: ('yes'/'no'/'no specification'),
  • Registration App ID (discarded after registration) incl. timestamp (time of registration),
  • IP address on registration
  • Version of the installed app
  • User ID of the successfully registered account
  • OS version
  • Device-related information: Manufacturer, type, display size (width and height), time of registration (timestamp).

A confirmation code will be sent to the mobile phone number provided during registration for verification purposes. The provision and collection of the aforementioned registration data is mandatory in order to be able to use elementary functions of the App (e.g. localisation of the device location, call-back option for emergency services). The App cannot be used without this data. If the registered mobile phone number is subsequently changed in the personal details, the registration process must therefore be completed in full again. In this case, the following data will also be processed: 

  • (New) name (first name and surname)
  • (New) mobile phone number
  • (Time) of deregistration

Legal basis

Summary: Your data is processed either because it is necessary for the performance of a contract or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 

Insofar as the aforementioned collected data is absolutely necessary for the use of the App (and/or for the performance of the user contract), the data is processed on the legal basis of Article 6 (1) (b) GDPR. This legal basis makes the processing lawful if it is necessary for the performance of a contract. The underlying user contract is concluded between you and the State of North Rhine-Westphalia, represented by the Ministry of the Interior of the State of North Rhine-Westphalia. For further details on the conclusion of the contract, please refer to the Terms of Use, available at https://www.nora-notruf.de/nutzungsbedingungen/. 

Insofar as this data is not absolutely necessary for the use of the App (or for the fulfilment of the user contract), it is processed on the legal basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis makes the processing of personal data lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The federal states are obliged by law to ensure that emergency calls are answered.

Deletion

Summary: When the account is deleted, all of your personal data will also be deleted.

The data collected under Sections 4.1 - 4.3 will be deleted when it is no longer required for technical or legal reasons, e.g. after successful completion of the registration process or after deregistration/deletion of the App, unless specific statutory provisions of the respective state stipulate a further retention obligation. 

Insofar as the data is processed because this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority according to Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law, it will be deleted as soon as it is no longer required for the performance of the task in the public interest (when the emergency call/emergency call service is received, e.g. after transmission to the responsible control centre or after the emergency call has ended). The data collected on the legal basis of state data protection law will be deleted in accordance with the storage periods specified in the respective provisions of state data protection law.

4.4. Assessment of the access requirements

Summary: As part of the registration process, certain data – in the form of characteristics ('access requirements') – can be collected and assessed from users. Depending on the result of the assessment, further verification/identification measures may be required before registration process is completed.

In addition to the aforementioned registration data (see Section 4.3), certain data in the form of characteristics or combinations of characteristics ('access requirements') may also be collected from users as part of the registration process and analysed by the system. If the result of the evaluation provides concrete indications that the access requirements have not been met (e.g. in the event of suspected misuse), further measures may be required to verify or identify users before the registration process is completed. It is assumed that the access requirements are not met in particular if – on a user-specific basis – there are indications that the registration is not or at least not exclusively for the purpose of using the App as intended (in particular for contacting the emergency services in emergencies or dangerous situations). For further details regarding the intended use of the App, please refer to the Terms of Use.

Personal user data may also be collected as part of the assessment of access requirements. This involves the following personal data or categories of personal data

  • Registration data (in particular mobile phone number, including any existing offence reports, see Section 4.11.),
  • IP address
  • Time of registration
  • Any other usage data (if available)
  • Result of the evaluation ('score')

The specific characteristics or combinations of characteristics on the basis of which the assessment is carried out are determined by the data controllers or the technical service provider on a risk-basSummary: As part of the registration process, certain data – in the form of characteristics ('access requirements') – can be collected and assessed from users. Depending on the result of the assessment, further verification/identification measures may be required before registration process is completed.

Legal Basis

Summary: Data processing is carried out for the performance of a task carried out in the public interest or in the exercise of official authority.

Data is only collected and analysed to the extent necessary to avoid restrictions on availability and to ensure the trouble-free operation of the App.

The only purpose of collecting this data is to ensure the functionality and trouble-free operation of the App and to avoid restrictions on the availability of the App. The data is processed on the basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis authorises the processing of personal data if this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In the present case, the measure of assessing the access requirements serves the purpose of ensuring the statutory obligation incumbent on the federal states to answer emergency calls. In this respect, the experience of the controller to date has shown that trouble-free operation and the necessary high availability of the App cannot be guaranteed without the implementation of targeted measures to prevent misuse of the App. Data processing is only carried out to the extent necessary to determine the intention of misuse. The principles of the GDPR (in particular the principle of data minimisation pursuant to Article 5 (1) (c) GDPR) are taken into account.

Deletion

With the exception of the IP address, the data collected as part of the asessment of access requirements is stored for a maximum period of 30 days. The IP address is only stored for a short period of a maximum of seven (7) days and then deleted from the servers. After the respective storage periods have expired, it is no longer possible to retrieve the data.

4.5. Limitation of requests ('Rate Limiting')

Summary: To ensure trouble-free operation of the App, the number or type of actions or requests made to the system by the user can be limited ('rate limiting').

The number or type of requests or actions made by the user in the emergency call app system may be limited if, in individual cases, the type or frequency of protocol messages generated by the system poses a risk to the functionality or trouble-free operation of the App. The limitation takes place on the system side if a conspicuous or above-average volume of requests is detected or if there are indicators that the App is being used in contravention of the Terms of Use.

As part of the limitation of requests, the following personal data (categories) of users may also be processed:

  • Location data (see Section 4.9)
  • Emergency call data (with the exception of 'voluntary personal information' within the meaning of Section 4.7)

The characteristics on the basis of which a limitation can be considered in detail can be freely configured or combined and are determined, regularly reviewed and, if necessary, adjusted by the Provider and the Provider's technical service provider - based on risk and operating experience.

Legal basis

Summary: Data processing is carried out for the performance of a task carried out in the public interest or in the exercise of official authority.

Insofar as personal data of users is processed within the limitation of requests, this is done exclusively to avoid availability restrictions and to ensure system stability and trouble-free operation of the App. 

The only purpose of collecting this data is to ensure system stability, functionality and trouble-free operation of the App and to avoid availability restrictions. The processing of the aforementioned data is carried out on the basis of Article 6 (1) (e) in conjunction with article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis authorises the processing of personal data if this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In the present case, the limitation of requests serves the purpose of ensuring the statutory obligation incumbent on the federal states to answer emergency calls. In this respect, the experience of the controllers to date has shown that trouble-free operation and the necessary high availability of the App cannot be guaranteed without the implementation of targeted measures to prevent misuse of the App. The limitation only takes place if system stability cannot be guaranteed in any other way. The principles of the GDPR (in particular the principle of data minimisation pursuant to Article 5 (1) (c) GDPR are taken into account.

Deletion

The data collected as part of the limitation of requests is only recorded on a situational basis and deleted from the servers immediately after fulfilment of the purpose (limitation of user-related actions or requests). After this, it is no longer possible to retrieve the data.

4.6. Verification / identification upon registration

Summary: As part of the registration process, verification of the registration data in the form of personal identification may be required in individual cases. If necessary, the identification serves exclusively to ensure the trouble-free operation and availability of the App.

After entering the mobile phone number, additional verification of the information you provided during registration (registration data) may be required as part of the registration process. Verification is currently carried out by identifying the registering user. When and under what conditions the additional identification process must be undertaken during registration is decided on a case-by-case basis, taking into account the previous experience of the controllers on the operation of the App and the specific risk to the App's availability and trouble-free operation. The result of the assessment of the access requirements (see Section 4.4) may also be taken into account in the decision.

The processing of the data collected as part of the identification process and listed in detail in Sections 4.6.1 – 4.6.4 (hereinafter also referred to as 'identification data') serves only the purpose of minimising or preventing misuse of the App and ensuring and guaranteeing the functionality and availability of the emergency call app system. Processing for any other purpose, in particular linking or merging data with other user data, does not take place. 

Summary: Users of the App can freely choose between the following identification procedures offered by Deutsche Post AG: 

POSTIDENT via post office branch, POSTIDENT via ID card function (eID), POSTIDENT via video chat, POSTIDENT via AutoID. Different data is processed as part of the chosen identification process. 

If identification is required upon registration, the following identification procedures are available to users via the POSTIDENT portal of Deutsche Post AG or by using the mobile POSTIDENT app:

4.6.1. POSTIDENT by post office branch

The following data or categories of data are collected from you as part of the 'POSTIDENT by post office branch' identification procedure:

  • Personal details: first name(s), surname, date of birth, address (optional – only if available in the ID document), nationality
  • ID card data: type of ID card, ID card number, country of issue, issuing authority (if available), date of issue (if available), expiry date of the ID card, image of the user's signature (if available on the ID document)
  • Process-related data collection: image of the ID card, e-mail address of the user

4.6.2. POSTIDENT through online ID function (eID)

The following data or categories of data are collected from you as part of the 'POSTIDENT by online ID function (eID)' identification procedure:

  • Personal details: First name(s), surname, date of birth. Address (optional – only if available in the ID document), nationality
  • ID card data: Type of ID card, DKK services and card-specific identifier, country of issue, expiry date of the ID card
  • Process-related data collection: image of the ID card, e-mail address of the user

4.6.3. POSTIDENT through video chat

As part of the 'POSTIDENT by video chat' identification procedure, the following data or categories of data are collected from you: 

  • Personal details: first name(s), surname, date of birth, address (optional – only if available in the ID document), nationality, portrait photo
  • ID card data: type of ID card, ID card number, country of issue, issuing authority (if available), date of issue (if available), expiry date of the ID card, image of the user's signature (if available on the ID document)
  • Process-related data recording: image of the ID card, user's e-mail address, visual document and person recording

4.6.4. POSTIDENT through AutoID

As part of the 'POSTIDENT by video chat' identification procedure, the following data or categories of data are collected from you: 

  • Personal details: first name(s), surname, date of birth. Address (optional – only if available in the ID document), nationality, portrait photo
  • ID card data: Type of ID card, ID card number, country of issue, issuing authority (if available), date of issue (if available), expiry date of the ID card, image of the user's signature (if available on the ID document)
  • Process-related data collection: image of the ID card, e-mail address of the user, audio-visual call recording (of document and person)

In addition, the following data will be transmitted to the technical service provider if technically necessary for reasons of traceability of technical problem cases that may arise during the identification process (e.g. due to interface problems, unavailability, etc.). 

  • ID of the identification process,
  • Data for the identification of the service in accordance with theGerman Telecommunications Act (TKG) (in particular name, address, date of birth)
  • Time (start) and status of the identification process,
  • Identification result (unknown, positive or negative) incl. time,
  • Time: POSTIDENT identification result is available
  • If the identification result is negative: specification of the reasons
Legal basis

Summary: Your data is processed because it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The 'identification data' is only collected insofar as this is necessary in individual cases to ensure the trouble-free operation of the App. 

The identification data is processed on the legal basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis makes the processing lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In the present case, the identification of the user serves the purpose to fulfill the states' legal obligation to ensure that emergency calls are answered.

In this respect, the experience of the controllers to date has shown that trouble-free operation and the necessary high availability of the App cannot be guaranteed without the implementation of targeted measures to prevent misuse of the App. The identification data is only collected if a high risk of misuse is detected during registration process in individual cases (e.g. in the event of a high streak of misuse, unsuccessful verification, etc.). The criteria for deciding whether it is necessary to identify users in individual cases are regularly evaluated by the controllers and, if necessary, adjusted taking into account the current state of the art, the specific risk and the general principles of the GDPR (in particular the principle of data minimisation pursuant to Article 5 (1) (c) GDPR). Your data is also processed in order to comply with legal obligations insofar as the controller is subject to these. The legal basis for the processing is particular Section 172 (3) in conjunction with Section 172 (1) TKG. According to this, the controllers of the App insofar as they are providers of number-independent interpersonal telecommunications services are generally obliged by law to store 'data for the identification of the service' (see above) for possible inquiries submitted by the security authorities if this data - as in the present case - is collected when the App is used. 

Deletion

The identification data is generally deleted from the identification service provider as soon as it is no longer required for contractual or technical reasons, e.g. after successful completion of the identification process and after successful transmission of the identification result to the technical service provider, but after 90 days at the latest. After this storage period has expired, it is no longer possible to retrieve the identification data. 

Insofar as the data is processed within the app system by the technical service provider or by the controller because this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, cf. Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law, they will be deleted as soon as they are no longer required for the performance of the task in the public interest (in particular the provision or receipt of the emergency call/emergency call service). This is the case at the latest when the user deregisters. If the data is stored due to an existing legal obligation (e.g. Section 172 (3) in conjunction with Section 172 (1) TKG), the data will only be stored for as long as the controllers are obliged to store the data by law. For example, data ('data for the identification of the service') that must be retained due to the controller's position as a telecommunications provider for inquiries of the security authorities (see above) will be deleted at the end of the calendar year following the termination of the user contract of the App. 

4.7. Creation of a user profile (voluntary 'personal information')

Summary: Voluntary 'personal information' can be stored in the App. These can be helpful for the deployment planning.

You have the opportunity to add further voluntary personal information to your user profile. The data can be helpful for deployment planning. It enables better and faster organisation of care in the event of an emergency. For example, the information can be used to assess whether an emergency doctor is required or whether assistance of police needs to be requested. The personal information is only stored in the App until an emergency call is made and is only transmitted to the control centres in emergency scenarios in which it is relevant. It is not necessary to give voluntary 'personal information' in order to use the App.

Overview of the voluntary 'personal information'

Summary: Voluntary personal information: age, gender, pre-existing health conditions, disabilities, emergency key, pets, infectious diseases, quarantine.

The following predefined specifications can be selected:

  • Mobile phone number (new number possible),
  • Callback option ('yes'/'no'/'not specified'),
  • Date of birth,
  • Gender (female / male / non-binary / not specified),
  • Health conditions (multiple choice: severe allergy (emergency kit needed); asthma/COPD; pacemaker/defibrillator; other; no health conditions; not specified).
  • Disabilities (multiple choice: hearing impairment; speech impediment; visual impairment; deafblindness; mobility impairment; cognitive impairment; mental health impairment; no disability; not specified).
  • Other
    • (Selection: An emergency key exists.)
    • (Selection: I have a dog.)
    • (Selection: I am in quarantine or have an infectious disease).

Legal basis

Summary: Your data will only be processed if you have given your consent. Your consent can be withdrawn at any time and/or the settings can be changed at any time.

This additional voluntary personal information is provided on the legal basis of your consent in accordance with Article 6 (1) (a) or Article 9 (2) (a) GDPR. You have the right to withdraw your consent at any time. To do so, you can remove the personal information yourself at any time in the menu of the App. In the event of withdrawal, the lawfulness of the processing based on the previously given consent remains unaffected until the time of the withdrawal (here: deletion/removal of your data from the user account). 

Deletion

The data processed on the legal basis of your consent in accordance with Article 6 (1) (a) or Article 9 (2) (a) GDPR will be deleted immediately as soon as you withdraw your consent by removing the data from your user account yourself. 

4.8. Submission of an emergency call

Summary: Before submitting the emergency call, you will be asked a maximum of five (5) questions that can be answered via button.

In order to be able to correctly record the emergency situation in the control centre and initiate the appropriate assistance measures as quickly as possible, the operators in the control centre need some important information from you. For this purpose, you will be asked to answer a maximum of five (5) questions before the emergency call is sent.

The answers to the questions are provided in the App via a query tree - depending on the type of emergency call - and can be selected by you. Free text cannot be entered here. If necessary, the questions can be related to the state of health of a third (injured or endangered) person. The questions are used, for example, to determine what has happened, whether there are any injured persons and where they are located. The App also offers the option of making a so-called 'silent emergency call' in the event of a threat, i.e. your call goes unnoticed by people around you and is not visible on your display, for example. 

The information and data collected in the course of the query only serve the purpose of ensuring targeted emergency care and disaster relief for the users of the App. It is not processed for any other purpose. Before sending the emergency call (including the emergency call data), you will be shown all the data pending transmission and you can edit it. At this point, you still have the option to completely cancel the submission of the emergency call.

Processed personal data

Summary: The emergency call is used to transmit the answers you have selected to the maximum of five (5) questions and other 'emergency call data'. 

When the emergency call is sent, the following data (hereinafter: emergency call data) is sent via the App to the locally responsible control centre: 

  • Registration data (e.g. mobile phone number, user ID)
  • Your location data (see Section 4.9.)
  • Emergency call data (answers to the questions of the query, IP address during the emergency call, timestamp with start and end of the emergency call, any free texts that are transmitted to the control centre in the chat, including status (see Section 4.10.), any deployment data, e.g. deployment number from the deployment control system),
  • If applicable (relevant data for deployment planning, if available) the voluntary 'personal information'.

In addition, the emergency call is categorized by the answers you have selected. It is therefore possible that personal data of special categories (in particular health data, e.g. symptoms of illness, injuries) of you or third parties may be transmitted as a result of the answers selected. Personal data of special categories will only be transmitted if it is relevant or necessary in individual cases for dispatching of resources at the control centres.

Recipients of the data

Summary: The locally responsible control centres receive the data.

The emergency call data is transmitted via 'geo-localisation' (see section 4.9.) to the determined and locally responsible control centre. Which control centre receives this data is displayed as the first message in the chat history after the emergency call is sent. If the respective control centre is not available, the emergency call data can be transmitted to predefined substitute control centres of the police or fire/rescue service.

Legal basis

Summary: Your data is processed because it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The emergency call data is processed on the legal basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis makes the processing of personal data lawful if this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The federal states are obliged by law to ensure that emergency calls are answered.

Summary: The processing of the voluntary 'personal information' (see Section 4.7.) is based on your consent. If the information concerns third parties who cannot (or can no longer) give their consent for physical or legal reasons, their express consent is not required if it concerns the protection of life and limb.

The voluntary personal information will be processed on the legal basis of your consent in accordance with Article 6 (1) (a) or Article 9 (2) (a) GDPR, insofar as this data includes personal data of special categories (in particular health data) (see Section 4.5).

Health data of third parties is processed on the legal basis of Article 9 (2) (c) GDPR. Generally, it can be assumed that if you submit health data of third parties via the App, there is a situation that can be subsumed under Article 9 (2) (c) GDPR, i.e. the processing is necessary to protect the vital interests of the third party and this person concerned is physically or legally incapable of giving consent. If this is not the case, you would have to obtain the express consent of the third party (there is no technical function for this in the App – in this context reference is made to a corresponding provision in the Terms of Use).

Summary: In the case of a police emergency call for purposes of the prevention, investigation or prosecution of criminal offences, your data will be processed in accordance with the provisions of the state police/data protection laws that implement the JHA Directive or the German Code of Criminal Procedure (StPO) and Part 3 of the German Federal Data Protection Act (BDSG). 

In the case of a police emergency call, i.e. where data is processed for the purposes of prevention, investigation or prosecution of criminal offences, data is processed on the following legal bases:

The legal basis for processing by the police for the purpose of the prevention of criminal offences is the respective state police law or the state data protection laws, which implement the provisions of Directive (EU) 2016/680 (JHA Directive). In the context of criminal prosecution of criminal offences, the legal basis for processing by the police is based on the German Code of Criminal Procedure (StPO) and Part 3 of the German Federal Data Protection Act (BDSG). The examination and documentation of the legal basis under state law is the responsibility of the respective state (or the responsible control centre).

Deletion

Summary: The emergency call data is stored on the servers of the emergency call app system for a maximum of seven (7) days. After submitting the data to the locally responsible control centre, the relevant storage period can be requested there.

The data record of an emergency call is only stored on the servers of the emergency call app system for a few days (maximum seven (7) days) to ensure that the responsible control centre can download the entire data record. The emergency call data is then deleted from the technical service provider's servers. 

The storage period of emergency call data at the locally responsible control centre depends on the respective state law. If you have any questions about the specific storage period, please contact the responsible control centre or the relevant federal state (the contact details can be found below in Section 6).

4.9. Location tracking during an emergency call

Summary: The submission of location data is necessary for the provision of assistance by the emergency services. As part of the continuous location determination, the location data is only determined for the required time period. An emergency location that differs from the determined location data can be specified.

It is of elementary importance that the location of the person making the emergency call can be determined in the event of an emergency. Without the location being transmitted, no help can be provided by the emergency services. Since it is essential for emergency services to provide assistance as promptly as possible in, the transmission of the location is the fastest way to determine a person's location and provide assistance as promptly as possible. If the emergency location differs from the determined location of the mobile device, you can specify a different emergency location by clicking on the map or by entering an address. 

Processed personal data

The following data is collected from you as part of the geo-localisation (location tracking) of the person making the emergency call: 

  • Location of the device: Location determined by the mobile device
  • Location of the emergency call (when sending the emergency call): GNSS location determined by the mobile device, emergency call location selected by the user on the map, location entered by the user via address input and deviating from the automatically determined emergency location

The GNSS location determined by your mobile device is determined in the following stages:

  • when starting the emergency call as a suggestion,
  • when sending the emergency call as determined location of your device,
  • as a regularly updated live location ('continuous location determination') after the emergency call has been sent.

As part of the continuous location determination, the location is only determined for as long as it is necessary to localise the person making the emergency call or to provide assistance. In this respect, a distinction is made between the following constellations: 

If an emergency call is made without the person making the call contacting the relevant control centre via the chat function, the location is determined for a period of at least 15 minutes (from the time the emergency call is made). From a technical point of view, this time period is generally necessary to determine the location of the person making the emergency call reliably. Within this period, the location determination can be terminated prematurely if the processing of the emergency call is completed beforehand or the App is closed. The location is only determined until the emergency call is marked as completed ('processed') in the control centre (usually until the emergency services arrive), but for a maximum time period of 30 minutes. After this period (30 minutes) has elapsed, the location data of the person making the emergency call is no longer continuously determined. 

If the emergency caller contacts the control centre via the chat function after sending an emergency call, the location is continuously determined for a further 15 minutes (from the time the chat message is sent). The continuous location determination serves to ensure the reliable trakcing of the location of the person making the emergency call, as the chat function is regularly used by the person making the emergency call to transmit information that is relevant for determining the location or for the assistance provided by the emergency services. The continuous determination of the location ends at the latest after a time period of 15 minutes (from the time the chat message is sent), unless the emergency caller interacts further (e.g. sends another chat message or makes another emergency call) or the emergency call is marked as completed ('processed') in the control centre before this period expires. 

Recipient of the data

Summary: The locally responsible control centre receives the location data.

The location is transmitted to the responsible control centre at the moment the emergency call is sent and immediately afterwards as a live location after the emergency call has been sent. The location is displayed as the first message in the chat after the emergency call is transmitted. 

Legal basis

Summary: Your data is processed because it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 

In the case of a police emergency call for the prevention, investigation or prosecution of criminal offences, processing is carried out in accordance with the provisions of the state police/data protection laws that implement the JHA Directive or the German Code of Criminal Procedure (StPO) and Part 3 of the German Federal Data Protection Act (BDSG). 

The localisation data is processed on the legal basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with Section 164 (4) sentence 1 TKG in conjunction with the respective state data protection law. This legal basis makes the processing of personal data lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The federal states are obliged by law to ensure that emergency calls are answered and to guarantee that the location data of the person making the emergency call are transmitted to the control centre responsible for the emergency call. 

In the case of a police emergency call for the purpose of preventing, investigating or detecting criminal offences, the location data is processed on the basis of the respective state police law or the state data protection laws, which implement the provisions of Directive (EU) 2016/680 (JHA Directive). If the location data is processed for the purposes of criminal prosecution, the processing is governed by the German Code of Criminal Procedure (StPO) and Part 3 of the German Federal Data Protection Act (BDSG). The examination and documentation of the respective legal bases is the responsibility of the respective country.

Deletion

Summary: The data of an emergency call is only stored on the servers of the emergency call app system for a few days (maximum seven (7) days). 

The storage period of the data at the locally responsible control centres can be requested from them.

The data record of an emergency call (including geo-localisation data) is only stored on the servers of the emergency call app system for a few days (maximum seven (7) days) to ensure that the relevant control centre can download the entire data record. The emergency call data is then deleted from the technical service provider's servers. 

The period of the storage of emergency call data at the locally responsible control centre depends on the relevant state laws. If you have any questions about the specific storage period, please contact the relevant control centre or the relevant federal state (the contact details can be found below in Section 6).

4.10. Chat function

Summary: After sending the emergency call, the person making the call can send messages to the local control centre (chat).

After sending the emergency call, you have the option of contacting the local control centre responsible for the emergency call via a chat window. The control centre can also contact you via chat. Use of the chat is not obligatory or mandatory for making the emergency call. When using the chat, messages can be sent directly to the local control centre via a free text window. This gives you the opportunity to describe the emergency situation in more detail to enable a faster and more precise assessment. 

The chat function may be used to transmit and process sensitive health data about yourself or third parties (e.g. a person who is at risk and/or injured or unconscious). The latter is always the case if you are not calling for help for yourself, but for another person who is in distress

Processed personal data

Summary: All data from the chat messages are transmitted to the local control centre and processed by it. 

Any personal data contained in the chat messages will be collected and processed by the locally responsible control centre. Under certain circumstances, the messages may contain personal data of special categories (in particular health data) about you or third parties if you disclose this there. In addition, personal data or personal data of special categories of third parties (in particular health data) may be requested in the chat messages. This may include, among other things, symptoms of illness, previous illnesses, mental and/or physical impairments, injuries, appearance or contact details.

In addition to the content of the chat messages that you send to the control centre, the respective status of the chat message is also processed in the App (sent, read, with corresponding time stamp) (see above).

Legal basis

Summary: Providing further health information within the chat is voluntary and is based on your consent.

Otherwise, the processing is carried out for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Insofar the information concerns third parties who are physically or legally incapable of giving their consent, their express consent is not required if it concerns the protection of life and limb.

In the case of a police emergency call for the prevention, investigation or prosecution of criminal offences, processing is carried out in accordance with the provisions of the state police/data protection laws that implement the JHA Directive or the German Code of Criminal Procedure (StPO) and Part 3 of the Greman Federal Data Protection Act (BDSG).

Data that you voluntarily provide in the chat will be processed on the legal basis of your consent in accordance with Article 6 (1) (a) GDPR or, in the case of health data, on the basis of Article 9 (2) (a) GDPR.  

Otherwise, the processing is carried out on the legal basis of Article 6 (1) lit (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis makes the processing of personal data lawful for the purpose of exercising official authority vested in the controller. The federal states are obliged by law to ensure that emergency calls are answered. 

Health data of third parties are processed on the legal basis of Article 9 (2) (c) GDPR. Generally, it can be assumed that if you submit health data of third parties via the App, there is a situation that can be subsumed under Article 9 (2) (c) GDPR, i.e. the processing is necessary to protect the vital interests of third parties and the person concerned is physically or legally incapable of giving consent. If this is not the case, you would have to obtain the express consent of the third party (there is no technical function for this in the App – in this context reference is made to a corresponding provision in the Terms of Use).

In the event of a police emergency call for the purpose of preventing, investigating or detecting criminal offences, the data collected as part of the chat function is processed on the basis of the respective state data protection laws, which implement the provisions of Directive (EU) 2016/680 (JHA Directive). If the data is processed for the purposes of criminal prosecution, the legal basis for the processing by the police authority is based on the German Code of Criminal Procedure (StPO) and Part 3 of the German Federal Data Protection Act (BDSG). The examination and documentation of the legal basis is the responsibility of the respective state.

Deletion

Summary: The chat history is only stored in the App for a few days (maximum seven (7) days) until deregistration on the mobile device or on the servers of the emergency call App system. After transmission to the locally responsible control centre, the retention period can be requested there.

The data processed as part of the chat function is only stored on the servers of the emergency call app system for a few days (maximum seven (7) days) to ensure that the responsible control centre can download the entire data set. The emergency call data is then deleted from the technical service provider's servers. 

The period for which the data is stored at the locally responsible control centre depends on the respective state laws (in particular the documentation obligations that may exist there). If you have any questions about the specific storage period, please contact the respective control centre or the respective federal state (the contact details can be found below under Section 6).

4.11. Notification of the emergency call in the event of violation of the Terms of Use

Summary: An emergency call that is made via the App even though there is no emergency constitutes a violation of the Terms of Use and may be punishable under Section 145 of the German Criminal Code (StGB). Such an emergency call can be flagged by the relevant control centre as a violation of the Terms of Use. In the event of multiple violations of the Terms of Use, you will be notified of this in the App. You can then contact the App's support team. Multiple violations can lead to your user account being blocked.

If you send an emergency call via the App even though there is no emergency situation and the help of emergency services is not required, this is a violation of the App's Terms of Use. Such behaviour may also constitute a criminal offense according to Section 145 of the German Criminal Code (StGB) - 'Misuse of emergency numbers and the tampering with means of accident prevention and first aid'. Section 145 StGB reads:        

'(1) Whoever intentionally or knowingly

1. improperly uses emergency numbers or distress signals or

2. pretends that the assistance of other persons is required due to an accident or a common danger or emergency

incurs a penalty of imprisonment for a term not exceeding one year or a fine.

(2) Whoever intentionally or knowingly

1. removes, defaces or distorts the meaning of warning or prohibition signs which serve to prevent accidents or a common danger or

2. removes, alters or renders unusable protective equipment which serves to prevent accidents or a common danger or rescue equipment designed for rendering assistance following accidents or in the case of a common danger

Incurs a penalty of imprisonment for a term not exceeding two years or a fine, unless the act is subject to a penalty under Section 303 [StGB] or Section 304 [StGB].'

It is the responsibility of the control centre responsible for the emergency call to assess whether there has been a breach of the App's Terms of Use and whether law enforcement authorities should be involved.

If an emergency call is classified as a violation of the Terms of Use or as misuse within the meaning of Section 145 of the German Criminal Code (StGB), the operators of the relevant control centre can report it or flag it as a violation of the App's Terms of Use.

If emergency calls via your user account are repeatedly marked as a violation of the Terms of Use or if your behaviour demonstrably constitutes a criminal offence pursuant to Section 145 of the German Criminal Code (StGB), you will be notified of this in the App. Multiple offences can lead to your user account being blocked. For further details, please refer to the App's Terms of Use, available at https://www.nora-notruf.de/nutzungsbedingungen/.

Processed personal data

Summary: Your App ID, including timestamp and reference to the emergency call and the user's mobile phone number are reported to the technical service provider.

The control centre reports the App ID, including time stamp and reference to the emergency call and the mobile phone number of the user concerned to the technical service provider. In addition, the following information and data may be collected from you in individual cases and transmitted to the technical service provider: 

  • Reason for flagging the account (mandatory field, free text if applicable, with time stamp)
  • In the event of multiple offences: total number of flags per user ID, total number of flags per phone number and, if applicable, (warning) notification of the blocking of the user account (incl. time stamp)
Legal basis

The data is processed on the legal basis of Article 6 (1) lit (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective state data protection law. This legal basis makes the processing of personal data lawful for the purpose of exercising official authority vested in the controller. The flagging of violations of the Terms of Use in the form of misuse of the App is necessary in the present case to ensure the availability, functionality and trouble-free operation of the emergency call app system as a whole. 

Deletion

Data relating to a breach of the Terms of Use will only be stored by us for as long as is necessary to ensure the integrity, security and functionality of the App. In this respect, the data may be stored in individual cases even after deletion of the user account/deregistration. Depending on the risk of misuse and the type of the violation, the controllers have implemented specific storage periods to ensure that this data/information is deleted in accordance with relevant data protection regulations

4.12. Push notifications

Summary: The App uses push notifications from the operating system producers (iOS and Android). Push notifications are messages that are displayed on the user's device screen without the need of opening the App. This allows you to be proactively informed about news.

We use the respective push services of the operating system producers (iOS-Apple Push Notification Service; Android – Google Cloud Messaging) to inform you about processes within the App, such as the availability of a new chat message from the control centre. During the initial setup of the App, you will be asked whether you agree to receive notifications. You are free to decide whether you want to receive push notifications. If you give your consent, a device token will be assigned for iOS or a registration ID for Android. The only purpose of processing the device token or registration ID is to provide the push service. In both cases, this is an encrypted device ID.

Legal basis

The legal basis for data processing in connection with push notifications is your consent according to Article 6 (1) (a) GDPR.

You can withdraw your consent to receive push notifications at any time with effect for the future. You can withdraw your consent directly on your mobile device as follows:

  • Deactivate push notifications in the iOS operating system:
  • Open 'Settings' on your mobile device.
  • Search there for the 'emergency call app nora' and click on it.
  • Select the item 'Notifications'.
  • Under the item 'Allow notifications' you can also deactivate push notifications

Deactivate push notifications in the Android operating system:

  • Open the 'Notification Centre'.
  • Tap and hold your finger on a notification from the 'nora emergency call app' and then tap on 'app info'.
  • Remove the tick under 'Receive notifications'.
Deletion

The device token or registration ID is deleted from the emergency call app system servers when you deregister. 

4.13. Support requests

If you have any questions or technical problems, you can contact the App's support team using the report/contact form available in the App or on the website. 

You can use the following notification/contact form, which is available in the App or on the App website at the following link: 

https://www.nora-notruf.de/fragen/support/

As part of a support enquiry, the following personal data may be processed by you: 

  • Name (first name and surname)
  • E-mail address
  • Topic and text of the support request
  • User ID
  • App version
  • Device type
  • Operating system
  • Screen size (width, height)
  • Location permission status depending on the setting in the mobile device's operating system (permitted, permanent, rejected)

Legal basis

Insofar as the data collected during registration is absolutely necessary for the use of the App (or for the performance of the user contract), the data is processed on the legal basis of Article 6 (1) (b) GDPR. This legal basis permits the processing of personal data for the performance of a contract. The underlying user contract is concluded between you and the state of North Rhine-Westphalia, represented by the Ministry of the Interior of the State of North Rhine-Westphalia. 

Insofar as the processing of this data is necessary for the provision of the App, it is processed on the basis of Article 6 (1) (e) in conjunction with Article 6 (3) GDPR in conjunction with the respective national data protection law. This legal basis permits the processing of personal data if this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The federal states are obliged by law to ensure that emergency calls are answered.

Deletion

The data transmitted as part of the support request will only be stored for as long as is necessary to fulfil the purpose (here: processing the support request. ensuring the back-up required for operational security). The data is generally deleted after the support case is closed (i.e. after the last interaction, usually after the ticket has been closed), but at the latest after a period of 21 days. 

5. Your rights

Summary: Your rights of access, rectification, erasure, restriction of processing, data portability, withdrawal of consent.

You have the following rights towards the controllers of the App with regard to the personal data concerning you, unless these are restricted in individual cases due to relevant state data protection regulations:

The right of access pursuant to Article 15 GDPR grants you the right to obtain, upon request and free of charge, comprehensive information about your personal data being processed by the controller and some other important criteria of the processing, e.g. the purposes of the processing or the period of storage. 

The right to rectification in accordance with Article 16 GDPR gives you the right to have incorrect personal data concerning you corrected. 

The right to erasure pursuant to Article 17 GDPR enables you to have personal data concerning you erased by the controller. However, you can only request the erasure of your data if your personal data has been processed unlawfully (in particular if it has been stored for too long) or if you have withdrawn your consent to this. 

The right to restriction of processing in accordance with Article 18 GDPR gives you the opportunity to prevent the controller from further processing your personal data for the time being (e.g. during the examination of the exercise of other rights to which you are entitled). 

The right to data portability (data portability) pursuant to Article 20 GDPR authorises you to receive the personal data concerning you, which is held by the controller, in a commonly used and machine-readable format in order to transmit it or have it transmitted to another controller. Please note in particular that this right is not available to you if the data processing is necessary for the performance a task carried out in public interest (i.e. on the basis of Article 6 (1) (e) GDPR) (cf. Article 20 (3) GDPR). 

You have the right to withdraw your consent if your personal data is processed on the basis of your consent (see above). You can withdraw your consent separately for each purpose for which your personal data is processed. The lawfulness of the processing based on your consent remains unaffected until the controller receives your withdrawal. 

Summary: To exercise your rights, you can contact: nora-datenschutz[at] im.nrw.de or use the contact form in the App.

To exercise your rights, simply send an email to: nora-datenschutz[at]im.nrw.de. You can also use the contact form in the App or on the website.

In addition, you can use the other contact options listed in Section 1.

Right to object pursuant to Article 21 GDPR

Summary: You have the right to object if data is processed in accordance with Article 6 (1) (e) and (f) GDPR. To exercise this right, you can use the email address provided or the contact form.

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 (1) (e) and (f) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms in individual cases, or the processing serves the establishment, exercise or defence of legal claims. 

To lodge an objection, you can contact the specified e-mail address: nora-datenschutz[at]im.nrw.de or use the contact form in the App or on the website at https://www.im.nrw/service/kontakt.

Summary: There is also the right to lodge a complaint with a data supervisory authority.

In addition, you have the right to lodge a complaint with a data protection supervisory authority in accordance with Section 77 GDPR. A list of German and European data protection officers and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

6. Contact details of the controllers

The contact details of each controller can be found here: https://www.nora-notruf.de/verantwortliche-stellen/

7. Contact details of the data protection officer

Summary: You can find the contact details of the data protection officers for each controller here: https://www.nora-notruf.de/datenschutzbeauftragte/

If you have any questions or concerns regarding the processing of your personal data in connection with the App, you can contact the Business and Coordination Office of the emergency call app (see Section 1 of this privacy statement) as well as the official data protection officer of the Ministry of the State of North Rhine-Westphalia. 

Data Protection Officer of the Ministry of the State of North Rhine-Westphalia
Ministry of the Interior of the State of North Rhine-Westphalia
Friedrichstrasse 62-80
40217 Düsseldorf

Phone: 0049 211 871-01
E-mail: datenschutzbeauftragter[at]im.nrw.de

In addition, you can also contact the data protection officers of each controller in the respective federal states. As a rule, these are the ministries responsible for internal affairs in the federal states. You can find a complete list of the contact details of the ministries' data protection officers here:
https://www.nora-notruf.de/datenschutzbeauftragte/.

8. Information pursuant to Article 26 (2) GDPR

In order to give all natural persons in the Federal Republic of Germany, but especially people with disabilities, equal access to emergency call services, the 16 federal states have decided to provide a standardised emergency call app. For this purpose, all 16 responsible parties are working closely together.

The joint controllership under data protection law refers exclusively to generating and processing data within the emergency call app system in the course of using the App (see data processing procedures in Section 4). 

The joint responsibility under data protection law ends as soon as the emergency call (including the emergency call data) is received by the locally responsible control centre (see Section 2). The competent authority in the respective country is responsible for all further steps (in particular the storage of your data in the responsible control centre, forwarding to other authorities). 

 

The controllers support each other in fulfilling their data protection obligations. The controllers provide you with the necessary information in accordance with Articles 13 and 14 GDPR within this privacy statement.

Joint responsibility under data protection law ends when the emergency call is completed. All further steps (e.g., storage in the emergency call centre, forwarding to the competent authority) are the responsibility of the respective competent authority in the respective country. 

The responsible parties support each other in the performance of data protection obligations. The required information according to Art. 13 and 14 GDPR is provided by the responsible persons with this data protection declaration.