Privacy Policy
As of: 1 November 2026
This Privacy Policy explains how SchelloLabs processes personal data when providing its website and apps. It also describes which data is processed exclusively under the user's control on their device or in their Apple iCloud storage.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
SchelloLabs - Marcus Schellstede
Pirschweg 22
26160 Bad Zwischenahn
Germany
Telephone: +49 4486 3684202
Email: support@schellolabs.de
Website: https://www.schellolabs.de
2. Scope
This Privacy Policy applies to the SchelloLabs website and to the following apps, insofar as the respective app refers to this policy:
- AufmassPro|tokolle
- HOAI-Rechner
- E|Rechner
- AbÄppelApp
- ÜbergabePro|tokolle
- PrüfPro|tokolle
- BauDokuPro|tokolle
- KüchenHopping
- RegiePro|tokolle
- RechnungsPro|tokolle
- StundenPro|tokolle
- BeetKlar
The functions and data processing actually available depend on the respective app version, the operating system, purchased feature entitlements and the user's settings.
3. Privacy at a glance
SchelloLabs follows the principle of data minimisation:
- In its current configuration, the website does not use analytics, marketing or tracking services or externally hosted web fonts.
- The apps primarily process user-entered content locally on the device.
- SchelloLabs does not maintain its own app user accounts or operate its own central server database for app content.
- SchelloLabs does not use app content for advertising, profiling, AI training or automated decision-making.
- Where an app supports iCloud or CloudKit and that function is used, the app data selected for it is stored or synchronised through Apple services.
- Simply entering content locally in an app does not transmit it to SchelloLabs. Support content is transmitted only when the user initiates contact.
- Exports and sharing take place only when the user selects the relevant function.
4. Roles and responsibilities for app content
The apps provide technical tools. The purposes, content and recipients of professional, community or organisational data processing are generally determined by the user or the organisation deploying the app.
Where personal data relating to other people is recorded, photographed, imported, synchronised, signed or shared in an app, the user or the organisation deploying the app is generally responsible for ensuring that a legal basis exists and that data protection obligations are met. This Privacy Policy does not replace the separate information obligations of an employer, contractor, client, landlord, stable operator, event organiser or other responsible organisation towards the people concerned.
This applies in particular where StundenPro|tokolle or another app is used in an employment context. Employers and other controllers must independently assess, among other things, the purpose, necessity, legal basis, access permissions, retention period, erasure and, where applicable, employee representatives' participation rights. In particular, Section 26 of the German Federal Data Protection Act (BDSG), in conjunction with Article 6 GDPR, may provide a legal basis for processing employee data. The legal basis actually applicable depends on the specific use.
For exclusively personal or family use, the household exemption under Article 2(2)(c) GDPR may apply. Once data is processed for professional, business, association or organisational purposes or disclosed to a wider group of people, the applicability of this exemption generally needs to be assessed separately.
SchelloLabs is responsible for the technical provision of the website and apps as determined by SchelloLabs, and for processing for which SchelloLabs determines the purposes and means. Where data is processed exclusively locally under the user's control and is not received by SchelloLabs, SchelloLabs generally cannot view that content or attribute it to a particular person.
5. Website provision and hosting
The website is hosted by:
STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany
A data processing agreement is in place with STRATO.
When the website is accessed, technically necessary access data is processed. This may include, in particular:
- IP address of the device accessing the website
- Date and time of access
- Page or file requested
- Volume of data transferred
- Browser type and version
- Operating system and device information
- Referrer URL
- Hostname
- HTTP status code and technical error messages
This processing is necessary to deliver the website, maintain its stability and security, and detect attacks or technical faults. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, reliable and economically viable operation of the website.
According to its current product information, STRATO anonymises hostnames or IP addresses in the access logs made available to the website operator. These logs may cover access within the preceding six weeks. For internal security and operational logs, STRATO specifies retention periods ranging from a few days to a maximum of 60 to 90 days, depending on the specific purpose. Longer retention may be necessary to investigate a specific security incident, pursue legal claims or comply with legal obligations.
Further information:
https://www.strato.de/datenschutz/
6. Encryption, cookies, access to devices and external content
The website is provided over an SSL/TLS-encrypted connection.
In its current configuration, SchelloLabs does not use analytics or marketing cookies requiring consent, advertising networks, social media plugins or comparable tracking technologies.
Where strictly necessary cookies, local storage or comparable access are used, they serve exclusively to provide a function expressly requested by the user. Storing information on a user's terminal equipment or accessing information already stored there is governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Section 25(2), point 2 TDDDG may apply in particular to strictly necessary access; non-essential access generally requires consent under Section 25(1) TDDDG.
The assessment under Section 25 TDDDG and the data protection legal basis for any subsequent processing of personal data are separate matters. Depending on the purpose, processing of personal data may in particular be based on Article 6(1)(b) or (f) GDPR or, where valid consent has been obtained, Article 6(1)(a) GDPR.
An operating system permission, for example for the camera, photos, files or location, initially controls the app's technical access. It does not automatically constitute consent under data protection law. Where processing is based on consent, the requirements of Article 4(11) and Article 7 GDPR must also be met.
External websites, particularly Apple or App Store pages, are opened only when the user selects the relevant link. From that point onwards, the external provider processes data under its own responsibility and in accordance with its privacy information.
7. Contact and support
When users contact SchelloLabs by email, telephone or an app's contact function, the data they voluntarily provide is processed to handle their enquiry.
This may include, in particular:
- Name and contact details
- Content of the enquiry
- Name and version of the app concerned
- Device type and operating system version
- Language and region settings
- Technical status of app functions and, where applicable, voluntarily provided information about the number of stored records
- Description of the error
- Voluntarily attached screenshots, documents, export files or diagnostic information
The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract, purchase, subscription or pre-contractual measure. For general questions, bug reports and suggestions for improvement, the legal basis is Article 6(1)(f) GDPR. The legitimate interest is handling enquiries and improving security, stability and usability. Where a legal retention or processing obligation exists, Article 6(1)(c) GDPR may additionally apply.
Some apps may offer a minimal support template, sometimes labelled "anonymous", and a more detailed technical support template. In this context, "anonymous" means that the app does not automatically insert project data, personal details, photos, documents or full usage data into the message text. If the enquiry is sent from a personal email account, the sender's address and content added by the user will nevertheless be visible to SchelloLabs and the email service providers involved.
Before sending, the user can review and edit the generated message and attachments. Project content, personal data relating to third parties, photos, documents or complete records are transmitted only if the user selects or attaches them. Email communication may be processed through STRATO's technical infrastructure. Ordinary emails are generally not end-to-end encrypted. Particularly sensitive or unnecessary data should therefore not be transmitted by email.
Support data is erased once the enquiry has been fully resolved and there are no legal retention obligations or legitimate reasons for further storage. Where a message is subject to retention as business or contractual correspondence, the applicable statutory retention period applies.
8. Principles and legal bases for data processing in the apps
Projects, calculations, measurements, invoice reviews, working time records, garden and plant data, care tasks, journal entries, supporting records, reports, photos, documents, notes and other content entered by users are not automatically transmitted to a server operated by SchelloLabs.
Depending on the app, version and settings, data may be:
- Stored exclusively locally on the device;
- Stored in iCloud or CloudKit storage or synchronised between devices;
- Shared with expressly invited people through CloudKit Sharing;
- Exported as a file; or
- Transmitted through the operating system's sharing functions to a recipient selected by the user.
Local storage and access to saved app states that are strictly necessary for app functionality serve to provide the digital service expressly requested by the user, in accordance with Section 25(2), point 2 TDDDG. Insofar as SchelloLabs is responsible for associated processing of personal data, this processing generally takes place to perform the app usage agreement on the basis of Article 6(1)(b) GDPR.
Depending on the app, optional functions can be controlled through app or system settings. Where an operating system permission is required, the relevant function becomes available only after that permission has been granted. The default setting and availability of a function depend on the respective app version and configuration. Operating system permission is not automatically the legal basis under the GDPR. Depending on the purpose and the controller's role, processing may in particular be based on Article 6(1)(b), (c) or (f) GDPR, Section 26 BDSG or, where valid consent has been obtained, Article 6(1)(a) GDPR. Special categories of personal data may be processed only if an exception under Article 9(2) GDPR and, where applicable, a supplementary national legal basis also apply.
Professional or organisational users processing other people's data must determine and document the relevant legal basis themselves. They may enter only necessary data and must observe, in particular, information, access, protection, retention and erasure obligations.
9. Data categories in individual apps
AufmassPro|tokolle
AufmassPro|tokolle may process, in particular, project and property data, customer and contact details, bills of quantities, GAEB data, line items, quantities, units, formulae, measurement record versions, target/actual values, variations, notes, photos and change information. This also includes PDF, CSV and GAEB export files generated from these details. Processing serves project-specific recording, calculation, management and documentation of measured quantities and work performed.
HOAI-Rechner
HOAI-Rechner may process, in particular, project names, project, practice and customer data, chargeable costs, service profiles and phases, fee zones and rates, supplements and deductions, incidental expenses, calculation variants and templates. This also includes saved calculations and PDF outputs generated from them. Processing serves fee calculation, comparison of different approaches and their project-specific documentation.
E|Rechner
E|Rechner may process, in particular, technical input and calculation values, project names, saved calculations, favourites, technical table values and notes. This also includes PDF outputs generated from these details. Project names and notes may contain personal data if the user enters such information. Processing serves the performance, management and documentation of electrical engineering calculations.
AbÄppelApp
AbÄppelApp may process, in particular, stable community names, members' names and roles, horse data, tasks and duties, appointments, absences, cover and swap requests, notes, photos, documents, invitations and technical synchronisation data. Processing serves the organisation of stable activities and the shared use of information made available to members. Authorised members may access and edit shared data depending on their role.
ÜbergabePro|tokolle
ÜbergabePro|tokolle may process, in particular, project and property data, names and contact details of participating people or businesses, room and condition details, defects, meter readings, key details, dates, notes, photos, signatures and change information. This also includes PDF records generated from those details. Processing serves the structured recording and documentation of property handovers, conditions and the information recorded in connection with them.
PrüfPro|tokolle
PrüfPro|tokolle may process, in particular, project and property data, details of clients, contact people and inspectors, technical inspection and measurement data, inspection results, findings, defects, deadlines, notes, photos and change information. This also includes PDF inspection reports generated from those details. Processing serves the structured recording, management and documentation of inspections and the results recorded by the user.
BauDokuPro|tokolle
BauDokuPro|tokolle may process, in particular, project, construction site, client and contact data, details of businesses and personnel deployed, activities and work performed, weather and time information, disruptions, defects, notes and photos. This also includes daily, weekly and monthly reports and PDF and CSV outputs. Processing serves project-specific documentation of construction progress and recorded construction site events.
KüchenHopping
KüchenHopping may process, in particular, event, participant and team data, names, addresses, doorbell information, contact and invitation details, course and route assignments, and voluntary information about dietary preferences, intolerances and allergies. Processing serves the organisation and running of the event and the intended sharing of information with participants. Section 10 additionally applies to any health data included.
RegiePro|tokolle
RegiePro|tokolle may process, in particular, project, construction site, client and contact data, details of people carrying out or reviewing work, working times, activities, work performed, materials, equipment, notes, photos, attachments, optional location details and signatures. This also includes finalisation and change information, technical checksums and PDF supporting records. Processing serves the recording, review and documentation of daywork, site work and labour records.
RechnungsPro|tokolle
RechnungsPro|tokolle may process, in particular, project, client, contractor and contact data, contract and bill-of-quantities values, GAEB data, invoice numbers and periods, cumulative billing positions, quantities, prices, discounts, variations, deductions, retentions, tax treatments and rates, review comments and attachments. This also includes status and change information and PDF review sheets. Processing serves structured invoice review and may involve confidential financial and contractual information.
StundenPro|tokolle
StundenPro|tokolle may process, in particular, employment, employer, project and profile information, start and end times, breaks, target and actual times, surplus and shortfall hours, time accounts, leave, sickness and other absences, special time categories, notes and change information. This also includes weekly, monthly and annual analyses, PDF and, where available, CSV outputs and technical synchronisation data. Sections 4 and 10 additionally apply to employee and health data.
BeetKlar
BeetKlar may process, in particular, names and characteristics of garden areas, beds, lawns and stone-surfaced areas, trees, hedges and plantings, care tasks, sowing and harvest dates, processing status, notes and garden journal entries. This also includes voluntary profile details, PDF outputs, technical settings and synchronisation data. Processing serves garden organisation and documentation. Garden and property information may constitute personal data if it can be linked to an identifiable person.
SchelloLabs does not use the app content listed in this section for its own advertising, profiling, AI training or analysis of content for unrelated purposes.
10. Other people's data and particular protection needs
Processing other people's data may concern, in particular:
- Customers, clients, contractors and contact people
- Employees and people carrying out work, inspections or signing documents
- Tenants, owners and other people involved in a handover
- Members of a stable community
- Event participants
- People, vehicle registration plates, plans or documents identifiable in photos
- Signatures and location details
- Contract, invoice, measurement, inspection, working time and employee data
- Information about allergies, intolerances, sickness or other sensitive matters
Information about allergies, intolerances, sickness, medical reasons or diagnoses may constitute health data within the meaning of Article 9 GDPR. Where the GDPR applies, an exception under Article 9(2) GDPR is required in addition to a legal basis under Article 6 GDPR. Where voluntary processing is based on consent, explicit consent under Article 9(2)(a) GDPR is generally required. Withdrawal takes effect for the future; it does not automatically erase copies already stored or exported by recipients.
For employee data, Section 26 BDSG, necessity, any collective agreements and participation rights, and appropriate access and erasure arrangements must additionally be assessed in particular. Diagnoses and other unnecessary health information should not be stored in free-text fields.
Before processing, the legal basis, purpose, data minimisation, information obligations, access permissions, confidentiality, retention period and permitted recipients must be assessed in particular. Unnecessary or particularly sensitive data should not be stored in the apps.
A signature captured with a finger or stylus is stored as a graphical representation of a signature. SchelloLabs does not use it for biometric identification of a person. Users must ensure that signatures are lawfully collected, used and disclosed to authorised recipients.
11. iCloud, CloudKit and responsibility roles
Depending on the app version and settings, some apps offer storage or synchronisation through Apple iCloud or CloudKit. App data may be stored in CloudKit storage assigned to the user's Apple Account and synchronised between devices.
SchelloLabs does not operate its own cloud servers for this purpose. In ordinary app and support operations, SchelloLabs has no routine access to the content of private CloudKit databases. This does not affect SchelloLabs' responsibility under data protection law for the CloudKit integration and its purposes as determined by SchelloLabs, insofar as SchelloLabs determines the purposes and means of that processing.
Under the currently published Apple Developer Program terms, Apple acts as a technical service provider or agent for the processing, storage and handling of personal data stored through the iCloud Storage APIs or CloudKit APIs. The terms provide, among other things, for processing in accordance with instructions, confidentiality, assistance with data subject rights and personal data breaches, information relevant to obligations under Article 28 GDPR, and safeguards for international transfers. Within these terms, Apple may process the data to provide and improve the iCloud service.
Apple also processes data relating to the Apple Account, the general provision of iCloud, the App Store and other Apple services as a controller in its own right. Apple may additionally process technical and diagnostic information about the use of iCloud services under Apple's terms.
CloudKit processing serves the storage, synchronisation and, where applicable, collaboration selected by the user. Insofar as SchelloLabs is responsible for this processing, Article 6(1)(b) GDPR generally provides the legal basis. For other people's data, the legal basis must be determined by the respective user or responsible organisation. For special categories of personal data, Article 9(2) GDPR and, where applicable, national law must also be observed.
Use requires an Apple Account, an active iCloud configuration, sufficient storage and, where necessary, an internet connection. Users can control iCloud functions through system or app settings. Disabling them may restrict synchronisation and collaboration functions.
Depending on the app version and configuration, synchronisation may already be enabled by default. Depending on the technical implementation, changes to the synchronisation setting take effect immediately or after the app has been fully restarted. Disabling synchronisation does not automatically erase cloud data already stored.
Further information:
Apple Privacy Policy:
https://www.apple.com/de/legal/privacy/de-ww/
iCloud Terms and Conditions:
https://www.apple.com/legal/internet-services/icloud/de/terms.html
Apple Developer Program License Agreement, particularly Attachment 4:
https://developer.apple.com/support/terms/apple-developer-program-license-agreement/
12. CloudKit Sharing and collaboration
Sharing or collaboration through CloudKit Sharing is available only where the respective app expressly provides such functions. Private synchronisation between the user's own devices does not share data with other people.
CloudKit Sharing allows selected data to be shared with invited Apple users. Depending on their assigned role, invited people may view, add, change or erase content. The creator or administrator decides whom to invite and what data to share.
Before sending an invitation, the user must assess whether sharing is lawful and whether invitees will receive only the data needed for their task. When sharing is ended, other participants generally lose the access provided through CloudKit. However, content already exported, photographed, copied or otherwise stored may continue to exist outside the app.
13. Apple App Store, StoreKit, purchases and subscriptions
Downloads, updates, in-app purchases, one-off purchases and subscriptions are handled through the Apple App Store and StoreKit. Apple processes, in particular, Apple Account, device, purchase, payment, subscription, security and fraud prevention data under its own responsibility and in accordance with Apple's terms.
The respective app receives only the information needed to verify and provide purchased features. This may include, in particular:
- Product identifier
- Transaction identifier and original transaction identifier
- Purchase, expiry, renewal, revocation and entitlement status
- Purchase restoration status
SchelloLabs does not receive full credit card, bank or other payment details. According to Apple's current information, purchase receipts accessible to development teams generally do not contain directly identifiable personal payment details. For subscriptions, Apple may provide a subscriber identifier specific to the user and the development team, as well as subscription and country or region reports.
Where SchelloLabs processes entitlement status within the app, this is done to perform the usage agreement on the basis of Article 6(1)(b) GDPR. Where legal record-keeping or retention obligations exist, the legal basis is Article 6(1)(c) GDPR.
The "Restore Purchases" function triggers a new check with Apple of existing, restorable entitlements. Subscriptions are managed, changed and cancelled through the Apple Account.
Further information:
https://www.apple.com/legal/privacy/data/de/app-store/
14. Device permissions, camera, photos, files, location and notifications
Depending on the app and the function selected by the user, the operating system may request access to the camera, photo library, files, location or notifications.
An operating system permission does not automatically result in transmission to SchelloLabs and does not automatically constitute consent under data protection law. It initially allows the app to perform the selected function on the device. Data is transmitted to Apple only insofar as an enabled iCloud or CloudKit function provides for it; disclosure to other recipients occurs only following a selection by the user.
- Camera and photo library: Photos can be added to projects, records, reports, supporting documents, stable communities or events.
- Files: Depending on the app, documents and PDF, CSV or GAEB files can be imported, opened, saved or exported.
- Location: Where the respective app offers a location function, it is used only following the user's selection and with the required operating system permission for the intended documentation. SchelloLabs does not analyse location data for advertising, movement profiles or tracking. A manually entered place must be distinguished from automatic location collection.
- Notifications: Where an app offers local reminders, these are generally scheduled on the device. SchelloLabs does not receive reminder content as a result.
Permissions can be changed or revoked at any time in system settings. The relevant function may then be restricted. Where processing is exceptionally based on consent under data protection law, that consent can additionally be withdrawn at any time with effect for the future; withdrawal does not affect the lawfulness of processing carried out beforehand.
Photos, documents, location details and file contents may contain personal, confidential or security-sensitive information. Before capturing, storing or sharing them, users must assess whether the people concerned have been informed and whether the processing is lawful.
15. Importing, exporting and sharing data
Depending on the app, data may in particular be imported or exported as PDF, CSV or GAEB files. System functions such as AirDrop, Mail, Messages, Print, Files or other installed apps may also be used.
Export or disclosure takes place only after the user makes the relevant selection. The user determines the content, recipient and transmission method.
After data has been handed to a selected recipient, cloud storage provider or third-party provider, further processing is governed by that recipient's or service's responsibilities, terms and privacy information. SchelloLabs has no influence over this further processing.
Exported, sent or copied files may remain after the original app data has been erased. They must be deleted separately at their respective storage location or by the recipient.
16. Finalisation information, signatures, checksums and change histories
Some apps may process status information, signature images, finalisation timestamps, snapshots, change information or technical checksums to make a documented state traceable and make accidental changes to finalised records more difficult.
This information is processed for the respective app's documentation and integrity functions. Insofar as SchelloLabs is responsible for the technical processing, Article 6(1)(b) GDPR generally provides the legal basis. Professional users must assess the legal basis on which they process signatures and personal supporting or change data concerning the people involved, and how long they may retain it.
Technical checksums are not used for biometric identification, advertising or profiling.
17. Diagnostic, crash and App Store analytics data
Apple may provide SchelloLabs with technical crash, diagnostic or App Store analytics data where the user has enabled the relevant sharing option in Apple's privacy and analytics settings, or insofar as Apple provides aggregated reports.
Such data may include, in particular, the app version, operating system version, device type, timestamp, technical status data, a crash report and aggregated usage or store information. It is used for error analysis and to improve stability, security and usability. SchelloLabs does not deliberately add project, document, photo or free-text content to automatic diagnostic reports. Users must review the contents of logs or attachments voluntarily submitted to support before sending them.
Insofar as SchelloLabs receives and uses diagnostic and analytics data provided by Apple, the legal basis is Article 6(1)(f) GDPR. The legitimate interest is resolving errors and providing secure, stable apps. Permission to share device analytics with Apple is separately governed by Apple's settings and privacy information. Where SchelloLabs requests separate consent in an individual case for an additional diagnostic transmission, Article 6(1)(a) GDPR provides the legal basis; consent can be withdrawn with effect for the future.
Diagnostic information is retained only as long as necessary to investigate, resolve and document the respective problem. Users can control whether and to what extent Apple collects diagnostic data and shares it with developers through their device settings.
18. Recipients of personal data
Personal data is transmitted only insofar as necessary for the purposes described, where the user initiates disclosure, or where a legal obligation exists.
Possible recipients include:
- STRATO as a processor for website hosting and email communication
- Apple as a technical service provider for iCloud and CloudKit, insofar as provided for in Apple's terms
- Apple as a controller in its own right for the Apple Account, App Store, StoreKit, payments, device backups and its own analytics services
- Participants invited by the user to a CloudKit share
- Recipients and third-party providers selected by the user for import, export and sharing functions
- Authorities, courts or other entitled bodies where a legal obligation exists
SchelloLabs does not sell personal data or transmit app content to advertising networks or data brokers.
19. Transfers to third countries
Under the agreed hosting arrangement, STRATO provides the website in Germany or within the European Union. Processing by subprocessors is governed by the data processing agreement concluded with STRATO.
For Apple services, it cannot be ruled out that data is processed by Apple companies or subcontractors outside the European Union or the European Economic Area. According to Apple's current privacy information, international transfers from the European Economic Area are based in particular on adequacy decisions or standard contractual clauses. The current Apple Developer terms also provide for an adequate level of protection or appropriate contractual transfer mechanisms for personal data processed through the iCloud Storage APIs and CloudKit APIs.
Details and options for requesting further information are available in the Apple privacy information and contractual terms linked in sections 11 and 13.
Where the user selects a recipient, cloud storage service or third-party provider outside the European Economic Area, the user or responsible organisation must independently assess whether that transfer is lawful.
20. Retention periods and erasure
SchelloLabs retains personal data only as long as necessary for the respective purpose or as required by legal obligations.
In particular:
- Website and hosting logs are retained as described in section 5.
- Contact and support data is retained as described in section 7.
- Technical diagnostic and analytics data is retained as described in section 17.
- Locally stored app content remains on the device until the user deletes it in the app, removes the app data or uninstalls the app.
- iCloud or CloudKit data remains stored in accordance with the respective app function, the user's settings and Apple's terms until removed by the user or an available deletion function.
- Apple retains purchase, payment and subscription data in accordance with its legal and contractual requirements.
- Exported, sent or third-party-shared files must be deleted separately at their respective storage location or by the recipient.
Deleting an app does not in every case automatically remove existing iCloud backups, CloudKit data, shares or previously exported files. Where necessary, these must additionally be deleted through the app, iCloud settings, the Apple Account or the respective recipient.
Where an app provides a function to delete its iCloud data, that function covers only data belonging to that particular app. Other iCloud content, data from other SchelloLabs apps, the Apple Account, App Store purchases, subscriptions and restorable purchase entitlements are unaffected. A deletion may be synchronised to other devices with a delay.
As SchelloLabs generally cannot view local or private CloudKit content, SchelloLabs cannot directly erase such content for the user. Management generally takes place through the relevant app, device or Apple's privacy and iCloud tools.
Before deleting data, users should check any applicable export and retention obligations. Supporting records required by law or contract should first be saved in a suitable location. Copies already stored by other people are not removed by deletion within the app.
21. Requirement to provide data
The technical access data generated when visiting the website is necessary for transmitting and securely providing the website. Without this processing, the website cannot be accessed.
Providing information in a contact or support enquiry is voluntary. Without a means of contacting the user and an adequate description, it may not be possible to process the enquiry.
Entering content in the apps is generally voluntary. However, certain details may be required to perform a function selected by the user or to generate a meaningful document. Optional camera, photo, file, location and notification functions cannot be used, or can be used only to a limited extent, without the relevant operating system permission.
Apple's technical and contractual requirements additionally apply to App Store purchases, subscriptions, restoration of purchases and iCloud functions.
22. Rights of data subjects
Subject to the applicable legal conditions, data subjects have, in particular, the following rights:
- Access to personal data processed by SchelloLabs under Article 15 GDPR
- Rectification of inaccurate data under Article 16 GDPR
- Erasure under Article 17 GDPR
- Restriction of processing under Article 18 GDPR
- Data portability under Article 20 GDPR
- Objection to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR
- Withdrawal of consent with effect for the future under Article 7(3) GDPR
- Lodging a complaint with a data protection supervisory authority under Article 77 GDPR
An objection to processing under Article 6(1)(f) GDPR may be raised on grounds relating to the data subject's particular situation. SchelloLabs will then cease processing the data concerned unless compelling legitimate grounds or grounds relating to the establishment, exercise or defence of legal claims justify continued processing.
To exercise these rights, send a message to:
support@schellolabs.de
Where necessary, SchelloLabs may request additional information to reasonably verify the applicant's identity and authority. SchelloLabs will not collect additional personal data solely for identification where it is unnecessary.
As SchelloLabs does not maintain its own app user accounts and has no routine access to local or private CloudKit content in ordinary operations, applicants may need to identify the app and record concerned and explain their authority in more detail. Local data can generally be managed within the respective app or by removing app data. For data processed by Apple as a controller in its own right, Apple's privacy tools and contact options should be used.
The competent supervisory authority includes, in particular:
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Germany
Telephone: 0511 120-4500
Email: poststelle@lfd.niedersachsen.de
Website: https://www.lfd.niedersachsen.de
Data subjects may also contact any other data protection supervisory authority competent under Article 77 GDPR.
23. Data security
Taking account of the state of the art, implementation costs and the nature, scope, context and purposes of processing, SchelloLabs implements appropriate technical and organisational measures to protect the processing for which it is responsible against loss, alteration, unauthorised access and unauthorised disclosure.
These include, in particular:
- Data minimisation and primarily local processing
- Encrypted website transmission
- Use of Apple's security and permission mechanisms
- Separation of the individual apps' data areas
- App-specific deletion functions, where provided
- Limiting SchelloLabs' own server-side data processing
- No SchelloLabs app user accounts and no central SchelloLabs server database for app content
- Protection of finalised records and technical integrity checks, where provided in the respective app
- Regular maintenance and updating of the apps
Nevertheless, complete protection of data in transit and on devices cannot be guaranteed. Users should protect their device and Apple Account with an up-to-date operating system, a secure device passcode, Face ID or Touch ID, two-factor authentication, careful allocation of access permissions and suitable backups.
24. No advertising, tracking, AI analysis or profiling by SchelloLabs
SchelloLabs does not use app content for personalised advertising, cross-provider tracking, user profiles or automated decision-making, including profiling within the meaning of Article 22 GDPR.
In the current functional configuration of the apps covered by this Privacy Policy, app content is not transmitted to an AI service or analysed using AI by SchelloLabs. SchelloLabs does not use app content to train its own or third-party AI models.
This statement concerns app processing determined by SchelloLabs. Independent processing by Apple in the App Store, Apple Account or other Apple services is governed by Apple's settings, terms and privacy information.
25. Updates to this Privacy Policy
This Privacy Policy will be updated when legal requirements, the website, service providers or an app's actual data processing change.
The current version is available at:
https://www.schellolabs.de/datenschutz/
Material changes to an app's data processing may additionally be communicated within the app concerned or through the App Store.
Last updated:
© 2026 Marcus Schellstede - SchelloLabs . Alle Rechte vorbehalten.
APPS MADE IN PETERSFEHN - GERMANY