Legal

Privacy policy for SecuritGo

Last updated: October 13, 2026 · Version: Public 1.2

This is an English translation of our German Datenschutzerklärung. In the event of any discrepancies, the German version shall prevail.

This privacy policy provides information about the processing of personal data in connection with the use of the website www.securitgo.app, the mobile application and the web-based administration application "SecuritGo".

SecuritGo is B2B software for security, guarding and service companies. The software supports the planning, execution and documentation of mobile patrol services, inspection tours, shifts, guard tours, incidents and client reports. It is not intended for use by consumers or children.

1. Controller and data protection contact

The provider of the website and the software is:

MBIT Digital Services UG (haftungsbeschränkt)
Steinbacher Str. 9
67814 Dannenfels
Germany

Managing directors: Ralf Mühlberger, Frank Blasius
Email: info@mb-it-digital.com
Register court: Amtsgericht Kaiserslautern, HRB 34421
VAT ID: DE461649424

Please send data protection inquiries to:

Email: datenschutz@mb-it-digital.com
Postal address: MBIT Digital Services UG (haftungsbeschränkt), Steinbacher Str. 9, 67814 Dannenfels, Germany, reference "Datenschutz" (data protection)

Further provider information can be found in our legal notice.

2. Controllership and processing on behalf of clients

Where MBIT processes personal data of its own contractual partners, for example contact details of contact persons for contract initiation, contract performance, billing, security or support, MBIT is the controller within the meaning of the GDPR. The same applies to the operation of this website and the handling of inquiries.

If a client company uses SecuritGo for its own security processes, that client company is generally the controller of the data of its employees, security staff, clients, locations and contact persons processed in SecuritGo. In this case, MBIT processes this data as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement and in accordance with the client's instructions.

If you are an employee or security officer of a company that uses SecuritGo, please address data protection inquiries primarily to your employer or to the organization that uses SecuritGo with you.

3. Visiting this website

Hosting: The website www.securitgo.app is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes the data generated when the website is accessed on our behalf (Art. 28 GDPR).

Server log files: When you access the website, your browser automatically transmits information to the server, which may be stored in server log files. This includes in particular the IP address, date and time of access, the page or file accessed, the amount of data transferred, the HTTP status code, the previously visited page (referrer), browser type and version, and operating system.

This data is technically necessary to deliver the website and to ensure its stability and security, for example for error analysis and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and functional website. This data is not combined with other data sources or analyzed for marketing purposes. The log files are stored only as long as necessary for these purposes and are then deleted or anonymized. If longer retention is required to investigate a specific security incident, we retain the affected entries until the investigation has been completed.

No cookies, no tracking: The website does not set any cookies, does not use any analytics or tracking tools and does not embed content from external providers such as fonts, maps, videos or social media plugins. Therefore, no information is stored on or read from your device that would require consent under Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act).

4. Contact and demo requests

You can contact us by email. The "Request a demo" form on our website does not transmit any data to our server. It merely creates an email draft in your email program from the information you enter (company name, name, email address and, optionally, phone number). The data is only transmitted to us once you send this email yourself.

We process the information in your message to answer your inquiry, to contact you and, if applicable, to prepare a demo or an offer. The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry is aimed at concluding a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries and in initiating business).

To receive and process emails, we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor. A transfer of personal data to Microsoft Corporation in the USA cannot be ruled out; please refer to Section 11 for more information.

We delete your inquiry once it has been fully processed, unless statutory retention obligations prevent this. We generally retain business correspondence for six years in accordance with commercial and tax law requirements (in particular Section 257 HGB, Section 147 AO).

5. Purposes of processing in SecuritGo

SecuritGo serves in particular the following purposes:

organizing security, guarding and mobile patrol services;
planning and optimizing routes, shifts and inspection tours;
carrying out and documenting guard tours via the mobile app;
managing clients, sites, locations, checkpoints and service instructions;
recording and processing incidents;
providing proof of service to clients and internal analysis of operations;
providing, operating, maintaining, securing and supporting the software.

6. Categories of personal data

Depending on the configuration by the client company, the following categories of data in particular may be processed:

Contact and master data: names, business contact details, roles, qualifications and organizational assignments;
Account and authorization data: user IDs, roles, team and access rights, session information;
Operations and tour data: shifts, tasks, checkpoints, patrols, tour status, events and records;
Location data: location information required for navigation, operations coordination, proof of inspection or incident documentation;
Device and log data: technical information about the app, web app, device, delivery of notifications, errors and security events;
Site, client and contact person data: location data, contact persons and site-related information;
Media and documents: images, documents, incident attachments, reports or other files, insofar as they are provided by users or administrators.

Special categories of personal data within the meaning of Art. 9 GDPR are not the purpose of the software. If users record sensitive information in free text fields, images or attachments, the respective client company is responsible for ensuring lawful processing.

7. App permissions

Depending on the function used and the platform, the mobile app may request the following permissions:

Location: for navigation, tour guidance, operations coordination, proof of inspection and incident documentation during active operations;
Camera: for QR/barcode functions, incident documentation or document uploads;
NFC: for reading or registering checkpoints as part of the guard tour system;
Push notifications: for operations- and system-related messages;
File or media access: for selecting, displaying or uploading documents and images.

Permissions can be revoked via the operating system settings. As a result, individual functions may be restricted or unavailable.

8. Legal bases

Depending on the purpose and controllership, processing is based in particular on the following legal bases:

Art. 6(1)(b) GDPR, insofar as processing is necessary for initiating or performing a contract;
Art. 6(1)(f) GDPR, insofar as there are legitimate interests in operation, security, proof of service, support, prevention of misuse, answering inquiries, and in securing, examining and defending against liability claims;
Art. 6(1)(c) GDPR, insofar as legal obligations must be fulfilled;
Art. 6(1)(b) and (c) GDPR in conjunction with Art. 88 GDPR and the applicable employee data protection provisions (e.g. Section 26 BDSG), insofar as employee data is processed by a client company;
Art. 9(2)(f) GDPR, insofar as special categories of personal data must exceptionally be processed in connection with claims in order to establish, exercise or defend legal claims;
Art. 6(1)(a) GDPR or Section 25 TDDDG, insofar as consent is required for certain device functions.

In the employment context, a works agreement or another suitable regulation of the client company may also be relevant.

9. Recipients and service providers

Personal data is only passed on to recipients insofar as this is necessary for the stated purposes. These include in particular:

authorized users within the respective client organization;
providers of website hosting, email, hosting, backend infrastructure, authentication, storage, map and navigation services, push notifications, search, monitoring, error analysis, maintenance and support;
insurers and insurance brokers, as well as lawyers, experts and IT forensics service providers commissioned by them or by us, insofar as this is necessary in connection with an insurance or claims case (see Section 10);
authorities, courts, legal advisors or tax advisors, insofar as this is legally required or serves to establish, exercise or defend legal claims.

Hosting of the production system: The SecuritGo production system is operated on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Falkenstein, Germany. This location information refers to the production system; for website hosting, see Section 3; for other services used, the information on possible transfers to third countries in Section 11 applies.

Contracts pursuant to Art. 28 GDPR are concluded with the processors used. Personal data is neither passed on for advertising purposes nor sold.

10. Liability and cyber insurance

MBIT maintains IT liability insurance (financial loss, general and product liability insurance), including cyber and first-party data insurance, with Markel Insurance SE, Sophienstr. 26, 80333 München, Germany. The contract is managed by an insurance broker.

If an event occurs that may lead to liability claims against MBIT, if such a claim is asserted, or if an information security incident occurs, such as a hacker attack or a personal data breach, MBIT is contractually obliged to notify the insurer, to cooperate in the investigation and to provide the information and documents required for assessment. In this context, personal data may be transferred to the insurer, the insurance broker and to lawyers, experts, IT forensics service providers and service providers for notifying affected persons commissioned by the insurer or by us.

This may include in particular names and contact details of claimants, injured parties, witnesses and contact persons, information on the contractual relationship, the description of the incident, correspondence, and technical log and system data, insofar as this is necessary for the investigation. We only transfer the data that is necessary for reporting, examining, settling or defending the respective case.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting against business liability risks, fulfilling our obligations under the insurance contract, and examining, settling and defending against claims. Insofar as we fulfill statutory reporting and notification obligations, for example under Art. 33 and 34 GDPR, Art. 6(1)(c) GDPR also applies. We only process special categories of personal data, such as health data in the case of personal injury, insofar as this is necessary to establish, exercise or defend legal claims (Art. 9(2)(f) GDPR).

Insurers and insurance brokers process the data under their own responsibility. Information on data processing by the insurer can be found in its privacy policy (in German, new tab).

We only pass on data that MBIT processes as a processor for client companies (see Section 2) to insurers insofar as the data processing agreement permits this, the client company has consented, or we are legally obliged to do so; otherwise only in anonymized form. If a client company is affected by a personal data breach, we inform it without undue delay so that it can fulfill its own reporting and notification obligations.

We store data from a claims case until the case has been concluded and beyond that until the expiry of the statutory limitation and retention periods.

11. Transfers to third countries

Depending on the services used, processing may also take place outside the European Economic Area, in particular for services from providers with group companies in the USA, such as Microsoft 365 (see Section 4). In such cases, appropriate safeguards pursuant to Art. 44 et seq. GDPR are used, in particular adequacy decisions of the European Commission (for the USA, the adequacy decision on the EU-U.S. Data Privacy Framework for companies certified under it), standard contractual clauses of the European Commission and supplementary safeguards.

12. Storage period

Personal data is only stored for as long as necessary for the respective purposes or as long as statutory retention, documentation or limitation periods apply. Insofar as MBIT acts as a processor, specific storage and deletion periods are primarily determined by the requirements of the respective client company.

After the respective periods have expired, data is deleted, anonymized or restricted in processing insofar as legal or technical reasons prevent immediate deletion.

13. No advertising, no sale of data, no tracking for advertising purposes

SecuritGo is not used for behavioral advertising. Personal data is not sold and is not used for advertising profiling. Analysis and monitoring functions serve exclusively the operation, security, stability and troubleshooting of the software.

This information refers to the website and software operated by MBIT. For data processing by the linked social media platforms, please refer to Section 18.

14. Automated decisions

MBIT does not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR that produce legal effects concerning data subjects or similarly significantly affect them.

Insofar as client companies use analyses from SecuritGo for work organization purposes, the respective client company is responsible for ensuring that this is done lawfully.

15. Security

MBIT takes technical and organizational measures pursuant to Art. 32 GDPR to adequately protect personal data. These include in particular access restrictions, authentication, encrypted transmission, logging of security-relevant processes, maintenance and procedures for restoring availability.

Users should keep their access credentials confidential and protect their devices against unauthorized access.

16. Data subject rights

Subject to the statutory requirements, data subjects have the right to:

access (Art. 15 GDPR);
rectification (Art. 16 GDPR);
erasure (Art. 17 GDPR);
restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
object (Art. 21 GDPR);
withdraw consent given, with effect for the future (Art. 7(3) GDPR);
lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Right to object under Art. 21 GDPR: Insofar as we process personal data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. The objection can be made informally, for example by email to datenschutz@mb-it-digital.com.

The competent supervisory authority for MBIT is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34
55116 Mainz
Germany
https://www.datenschutz.rlp.de

17. App stores

If the app is obtained via the Apple App Store or Google Play, the respective store operators process personal data of their own under their own responsibility. Their privacy information also applies.

In the footer of our website, we link to our SecuritGo profiles on LinkedIn and Instagram. These are simple external links. The icons are embedded directly in our website; we do not use any social media plugins, embedded feeds or tracking pixels for these links. Merely visiting our website does not trigger any data transfer to LinkedIn or Instagram.

If you open one of these links, you leave our website and access the respective platform. The platform provider receives in particular your IP address and technical information about your browser and device. If you are logged in there, the provider may associate the visit with your user account. The platform providers may process further data and may also use services outside the European Economic Area.

Information on processing by the platform providers, in particular on purposes, legal bases, storage period, international data transfers and your setting options and rights, can be found in their privacy notices:

LinkedIn: LinkedIn Ireland Unlimited Company, Ireland (for users in the European Economic Area).
LinkedIn privacy policy (new tab)
Instagram: Meta Platforms Ireland Limited, Ireland (for users in the European Economic Area).
Instagram / Meta privacy policy (new tab)

19. Changes to this privacy policy

This privacy policy may be amended if functions, data processing, service providers used, the legal situation or technical conditions change. The current version is published via the provided privacy policy URLs.