Privacy policy and terms of use for the Virtual ID Card

Data protection is important to us. Below you will find information about the processing of your personal data and your rights when using our website. We also explain the terms of use for the app

 

1. data controller and its data protection officer Name and contact details of the data controller and its representative

 

The E.ON company at which you are employed or which you visit is responsible for data processing. Please contact the data protection officer responsible there. You can find information about the responsible data protection officer in your employment contract or internally at the following link: (15) (15) Connect | Group: Data protection. As a visitor, please contact our reception for further information.

 

 

 

2. individual data processing

a. Use of the Virtual ID Card

 

2.1 Verarbeitungen von personenbezogenen Daten durch die App

 

With Virtual ID, your data (KID, first and last name, associated company & photo and personnel number) is requested via Microsoft Entra ID. During installation, we request a secure token that contains your data and is stored locally on your device. A DeviceID is also generated, which is used as a unique identifier for some functions, for example. The Apple Wallet is used for some use cases and the data is then transmitted to the relevant recipients via interfaces using this and the app itself.

Apart from the transmission of data, no data processing takes place via the Virtual ID.

 

Data processing is carried out for the purpose of access authorization to the building and to pay in our bistros, canteens and at vending machines or to start a print job.

The card itself only transmits information about you as a user, the individual data processing then takes place in the respective systems, for example

•          in access management, where it is checked whether you have access authorization; the authorization check and authorization assignment itself takes place in access management
•          in the payment system at the bistro, canteen or vending machine, where personal information is transmitted to the billing system; the billing itself is carried out via the billing system
•          when printing, where information about your person is transmitted; the print job itself is processed via the system on which the printers are based
•          When booking working times, your personnel number is transmitted to assign the data
•          For room and workstation bookings, your KID is transmitted to Gingco. Your booking is then assigned to you.

The data is stored on your device for as long as you use the Virtual ID Card. As soon as you delete the app or leave the company, the data is deleted.

 

You have the right to object to data processing if you have an overriding interest. When you join the company, data such as your personnel number and KID are created, which are mainly used for the functions of the Virtual ID Card. These can only be deleted again when you leave the company. We have no influence over this. You can only object to the use of the app and uninstall it again. If you do not agree to the processing of the token and your data, please log out of the app and uninstall it. All token data stored locally on your device will then be deleted.

 

2.              Logfiles

 

We only process the execution logs in the middleware in MuleSoft. This means that we can trace the individual processing steps and which function is used how often. This is for traceability and analysis purposes. We also use Matomo for this purpose.  We do not log any personal data of the user during the use of the APIs and the app.

 

You have the right to object to data processing if there are reasons for this arising from your particular situation (see below).

 

3.      Third Country Transfer

 

For technical operations, we work exclusively with service providers who process your data within the EU.

 

4.      Your Rights as a Data Subject

 

As a data subject affected by data processing, you have the following rights under data protection law (GDPR) subject to the legal requirements. To assert your rights, please contact us using the contact details provided in section 1.

 

Information: You can request information about the personal data we process about you.

Correction: You can request the correction of incorrect data and the completion of incomplete data relating to you.

Erasure: You can request the erasure of your personal data if the legal requirements are met.

Restriction of processing: You can request the restriction of the processing of your data if the legal requirements are met.

Data portability: You can request that we make the data you have provided available to you or that we transfer it to another body.

 

Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (f) of Article 6(1) GDPR. We will then no longer process this personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

 

Revocation of consent: If you have given us your consent to process your data, you can revoke this at any time with effect for the future. This does not affect the lawfulness of the processing of your data until you withdraw your consent.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you is unlawful.

 

Please contact us if you have any questions.

 

Terms of use

 

1 Scope of application

 

These Terms of Use govern the use of the Virtual ID Card app (hereinafter “App”), which is provided by E.ON Digital Technology, (Ricklinger Stadtweg 123, 30459 Hanover, [email protected]) (hereinafter “Provider”). By downloading and using the App, you agree to these terms and conditions.

 

2. Service description

 

The app is provided free of charge and has the purpose of providing a digital version of the physical ID card. The application makes it possible to open access systems and enter buildings, pay in the canteen, log on to the printer, record working hours via Interflex terminals and book rooms and workstations. It can be used in addition to the employee ID card. There is no entitlement to certain functions or constant availability. The provider reserves the right to discontinue or modify the app in whole or in part. The obligation to carry the employee ID card remains unaffected. The app cannot replace the employee ID card.

 

3. Use of the app

 

Use is only permitted for access to E.ON buildings and for payment. It may only be used to the extent that the user has access rights. The authorizations are not extended by the app. Commercial use is prohibited without the prior written consent of the provider.

 

4. Registration/login

 

Registration/Login is required to use the app. The login and authentication of the data takes place via E.ON's internal Active Directory. Please log in once with your Microsoft 365 account with [email protected] and your password to gain access to the app.

 

The user undertakes to provide truthful and complete information when registering and to treat his/her access data confidentially.

 

 

 

 

 

5 Obligations of the user

 

The user is obliged not to post any content in the app that violates applicable law, the rights of third parties or common decency. The provider is entitled to delete illegal content and to block access.

 

6 Liability

 

Use of the app is at your own risk. The provider is not liable for damages arising from the use or impossibility of use of the app, unless these were caused intentionally or through gross negligence. In the event of simple negligence, the provider shall only be liable in the event of a breach of essential contractual obligations (cardinal obligations), but limited to the foreseeable damage typical for the contract.

 

6.1 Notes on liability

 

The data is securely retrieved and stored locally on the user's device. This data is processed for the purpose of access authorization to buildings, payment in bistros, canteens and at vending machines as well as for print jobs and working time bookings. The app only transmits information about the user, while the actual data processing takes place in the respective systems. A high security standard is guaranteed with two-factor authentication, Microsoft Entra ID and Mulesoft as middleware with the corresponding security standard. The app was tested and approved by the cyber security team using penetration tests prior to release.

 

7 Availability

 

The provider endeavors to ensure that the app is available without interruption but does not guarantee any specific availability or functionality.

 

8. changes to the terms of use

 

The provider reserves the right to change these terms of use with effect for the future. You will be informed of any changes in the app in good time. If you continue to use the app after the changes have come into effect, this shall be deemed to constitute your consent.

 

9. data protection

 

Information on the processing of personal data can be found in our privacy policy.

 

10. final provisions

 

Should individual provisions of these Terms of Use be or become invalid in whole or in part, this shall not affect the validity of the remaining provisions. The law of the Federal Republic of Germany shall apply to the exclusion of the UN Convention on Contracts for the International Sale of Goods. The place of jurisdiction is Hanover.