Privacy at Dagobert

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

Dagobert is a household budget book for your comdirect account on iPhone and iPad. I run no server for Dagobert, there is no account with me, no analytics, no advertising and no crash reports to third parties. I receive nothing from you through the app. Data only goes to comdirect when you fetch transactions directly, and to your iCloud when you turn on sync.

What is stored on your device

Dagobert stores transactions, accounts, categories, rules and settings in a database on your device. If you save your comdirect access, it is kept in the iOS Keychain on this device only; it goes neither into backups nor into iCloud. The device lock with Face ID or passcode is checked by iOS itself; the app receives no biometric data. CSV files and backups you import or export end up only where you put them via the share menu.

The legal basis, to the extent I process anything at all, is Art. 6(1)(b) GDPR: the app needs this information to do what you want it to do.

Direct fetch from comdirect

When you fetch transactions directly, the app connects from your device to the comdirect interface. Your own client ID and client secret from the comdirect developer access, your access number, PIN and TAN approval go there; your balance and transactions come back. The connection does not run through any server of mine. comdirect is a brand of Commerzbank AG and processes this data as your bank under its own responsibility; its privacy notice applies. Without a direct fetch, comdirect is not contacted.

The legal basis is Art. 6(1)(b) GDPR.

Commerzbank AG (comdirect)

Kaiserplatz, 60261 Frankfurt am Main, Germany

Provider’s privacy policy

iCloud sync

Sync is off until you turn it on in the settings. Dagobert then stores your data in the private iCloud database of your Apple Account so it is available on your other devices and after a reinstall. The content of each record is stored encrypted. Apple sees administrative details such as the number, size and time of the records. I have no access to your iCloud. Your comdirect access and the device lock are not synced.

The legal basis is Art. 6(1)(b) GDPR.

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

App Store

You download the app from the App Store; whatever Apple processes in the course of that (for example for download and purchase) is Apple's own responsibility.

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Self-hosted server version

Dagobert is also available as a server version (Docker) that you run yourself. Whoever runs it is responsible for the data in it; I operate no server for it and receive no data. If that version fetches transactions from comdirect, it does so from the operator's server.

Retention and deletion

The data stays on your device until you delete it in the app or remove the app. You can remove the saved comdirect access in the app. You delete data in your iCloud in your device's iCloud settings under “Manage Storage”. Since I hold no data about you, you exercise your rights for the app directly by deleting the data on your device and in your iCloud; for questions you can reach me at the address above.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.