Privacy Policy

1. Data Controller

The app "Knuffingers" is operated by Miniatur Wunderland Hamburg. For questions regarding data protection, you can contact the data protection officer.

2. Purpose of the App

The app "Knuffingers" is an internal employee app for Miniatur Wunderland Hamburg. It provides information and tools for guest operations and security functions, serves communication, monitoring of business data, knowledge management, and emergency functions.

3. Data Collected

3.1 Registration and Account Data

The following personal data is collected during registration and use of the app:

• Personal Information:
  • First name
  • Last name
  • Email address
  • Gender
  • Password (stored encrypted)
• Account Data:
  • User ID and unique user identifier (UUID)
  • API key for authentication
  • Membership in user groups and teams
  • Service status (on duty/off duty)
  • Permissions and roles within the app

3.2 Technical Data

The app collects the following technical information:

• Device Information:
  • Device manufacturer (for detection of built-in barcode scanners)
  • Device type (iOS/Android/Web)
  • Operating system version
• App Usage Data:
  • Time of last app usage
  • Login attempts and timestamps
  • Synchronization timestamps
  • Network status
• Push Notifications:
  • Expo Push Token (for delivery of push notifications, e.g., for emergencies or time-critical business information)
  • Notification settings

3.3 Content Data

The following content may be created and stored during app usage:

• Communication:
  • Messages to teams (no individual messages)
  • Replies to team messages
  • Reactions to messages
• Media:
  • Photos and images (for reports, wiki entries, messages)
  • Barcode scans of tickets
• Function-Specific Data:
  • Emergency exit checks
  • Business data and metrics
  • Wiki entries and employee skills
  • Ticket information

4. Legal Basis for Data Processing

The processing of your personal data is based on:

• Art. 6 para. 1 lit. b GDPR (Contract Performance): Data processing is necessary for the provision and use of the app.
• Art. 6 para. 1 lit. f GDPR (Legitimate Interest): Processing serves to ensure the functionality of the app and internal communication.
• Art. 6 para. 1 lit. a GDPR (Consent): For certain functions (e.g., push notifications, camera access), processing is based on your consent.

5. Purpose of Data Processing

Your data is processed for the following purposes:

• Provision and management of your user account
• Authentication and authorization
• Provision of app functions:
  • Monitoring of business data and metrics
  • Display of employees on duty in critical roles
  • Wiki for employee skills
  • Conducting emergency exit inspections
  • Internal messenger for employees (team communication only)
  • Status check of tickets
• Sending push notifications
• Ensuring app security and preventing misuse
• Improving app functionality

6. Registration and Access

The app requires registration with a user account. All registrations must be approved by a company administrator. Without activation, use of the app is not possible. User accounts can be deactivated or removed at any time by the company, for example, when an employee terminates their employment or no longer needs the app's functions in their role.

7. Data Sharing

7.1 Service Providers

Your data is shared with the following service providers:

• Expo (Expo.dev): Only data necessary for push notifications and app updates
  • Provider: Expo, Inc.
  • Further information: https://expo.dev/privacy
• Google Firebase Services: Only data necessary for specific Android functionalities (such as push notifications)
  • Provider: Google LLC
  • Further information: https://policies.google.com/privacy

7.2 Backend Server

All data is stored and processed on company-owned servers under the domain api.miwu.app. The servers are located in Germany (i.e., within the European Union).

7.3 No Sharing with Third Parties

Your data is not shared with third parties for marketing, analysis, or advertising purposes. Sharing only occurs within the framework of the above-mentioned service providers for the provision of app functionality.

8. Storage Duration

Your personal data is only stored for as long as is necessary for the purposes of the app or legal retention obligations exist. After termination of employment, your data will be deleted or anonymized, unless legal retention obligations prevent this.

9. Your Rights

You have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You can request information about the data stored about you.
• Right to Rectification (Art. 16 GDPR): You can request the correction of incorrect data.
• Right to Erasure (Art. 17 GDPR): You can request the deletion of your data, provided no legal retention obligations exist.
• Right to Restriction of Processing (Art. 18 GDPR): You can request the restriction of processing of your data.
• Right to Object (Art. 21 GDPR): You can object to the processing of your data, provided the processing is based on legitimate interest.
• Data Portability (Art. 20 GDPR): You can request the transfer of your data in a structured, commonly used, and machine-readable format.
• Withdrawal of Consent: You can withdraw given consent at any time.

To exercise your rights, please contact the data protection officer or your supervisor.

10. Data Security

We implement technical and organizational measures to protect your data from unauthorized access, loss, or destruction:

• Encrypted transmission (HTTPS)
• Secure storage of authentication data (expo-secure-store, uses the "Secure Enclave" on Apple devices or the equivalent on Android devices)
• Passwords are stored encrypted
• Regular security updates
• Access controls and permission management system

11. App Permissions

The app requires the following permissions:

• Camera: For scanning barcodes and taking photos for reports, wiki entries, and messages
• Photos/Media: For access to stored photos for use in the app, e.g., for wiki entries or messages.
• Internet: For communication with the backend server
• Notifications: For receiving push notifications
• Network Status: For checking internet connection

These permissions are only used for the stated purposes and are not misused for other functions.

12. Cookies and Tracking

The app does not use cookies or tracking technologies for marketing, analysis, or advertising purposes. Technically necessary data is only stored for the functionality of the app.

13. Changes to the Privacy Policy

We reserve the right to adjust this privacy policy to adapt it to changed legal situations or functionalities of the app. The current version can be viewed at any time in the app or on our website.

14. Contact and Complaints

For questions or complaints regarding data protection, you can contact:

You also have the right to file a complaint with the competent supervisory authority:

15. Last Updated

This privacy policy was last updated on: January 4, 2026