Privacy notice for data donation in BonBunker

This notice covers only the voluntary "Donate receipts" feature. If you do not donate, nothing leaves your device through this feature. What else the app does is described in the app's general privacy policy (https://receiptify.daturex-cloud.de/privacy-policy).

1. Controller

DATUREX GmbH Hermann-Reichelt-Straße 3A 01109 Dresden Germany E-mail: kontakt@daturex.de Represented by its managing director (Geschäftsführer) Marcel Kießlich Amtsgericht Dresden (commercial register), HRB 36495 VAT ID DE325253451

Contact for data protection matters: datenschutz@externer-datenschutzbeauftragter-dresden.de, or by post to the address above, marked "z. Hd. Datenschutzbeauftragter" (for the attention of the data protection officer)

2. What is processed when you donate

What we store when you confirm a donation:

• the photo of the receipt, complete and unredacted, as a file exactly as the app sends it. The app removes information embedded in the photo file (EXIF), such as the time it was taken, the device manufacturer and model and the location, before sending.
• the data recognised from the receipt: store, additional store details (e.g. address), date and time, total, and the items with name, additional detail, quantity and price, in each case including your corrections,
• whether you corrected the recognised data,
• the name of the recognition model, the app version and the app language,
• a checksum of the photo file (SHA-256, a kind of digital fingerprint of the file), the file format and the size of photo and data,
• the day (without time of day) on which the donation arrived,
• a checksum of your deletion code (not the code itself).

Receipts can contain personal data printed on them, for example the last digits of a card, a loyalty-card number, a name on an invoice, the cashier's name, and the time and place of a purchase. The items bought can allow conclusions about personal circumstances, in individual cases including specially protected information such as health (e.g. a pharmacy receipt). A receipt can also contain other people's data. We do not collect such information on purpose and do not evaluate receipts for it. If a receipt contains it anyway, we process it on the basis of your explicit consent (section 4). You decide for each receipt whether you donate it.

What remains after a withdrawal: When we delete a donation, the server notes the checksum of the photo file and the day of the deletion, and nothing else: no photo, no recognised data, no deletion code, no IP address and no time of day. By this it recognises the donation if it comes back with a backup, and deletes it again (section 6). After 90 days we delete this entry as well. If you donate the same photo again before that, the server deletes the entry at once.

What is processed only temporarily and not stored:

• Checksums of the photos selected for donation. The app sends them first so that the server can say which photos it does not have yet. The server compares them and does not store them.
• your IP address. It is technically required for the transfer. The application also uses it to limit the number of requests per connection (protection against abuse). For this it is held only in memory and only as a check value from which the address cannot be worked back (a hash, computed with a key that also exists only in memory). The check value stays for the duration of the respective time window (at most one hour, plus a few minutes) and is not written to a database, to files or to the application's logs.
• an access key, if your version of the app contains one. It is built into the app, is the same for all users and says nothing about you. The server checks it and does not store it.
• The program that sits in front of the server and accepts the requests (proxy) writes no access log for this service.

What we do not collect: no user account, no name, no e-mail address, no device or advertising identifier, no cookies. The application stores nothing that connects two donations by the same person. This does not mean a donation has no relation to a person: the photo and the recognised data can make you or others recognisable, and matching details in several photos (e.g. the same loyalty-card number) can make donations attributable to each other.

3. Purposes

We use the donated photos and data for fine-tuning the models that recognise receipts in BonBunker, that is, to train and test these models.

We process the IP address to deliver the response and to prevent abuse (request limiting).

We use the checksum of a withdrawn donation only to delete that donation again after the server has been restored.

There is no automated decision-making, including profiling.

4. Legal bases

• Storage and use of the donation: your consent, Art. 6(1)(a) GDPR, which you give in the app before each donation. Where a receipt contains specially protected information (section 2), the legal basis is your explicit consent, Art. 9(2)(a) GDPR. That the app reads the photo and the data from your phone and sends them for this purpose is also based on your consent (Section 25(1) of the German TDDDG).
• Temporary processing of the IP address to prevent abuse: our legitimate interests, Art. 6(1)(f) GDPR: we protect the server against overload and abuse.
• Keeping the checksum of a withdrawn donation for 90 days (section 2): our legitimate interests, Art. 6(1)(f) GDPR: we want to honour your withdrawal also when the server is restored from a backup.

Donating is voluntary. You are under no statutory or contractual obligation to do so. Not donating has no consequences for your use of the app.

The app is not aimed at children and young people under 16.

5. Recipients

The recipient of donations is DATUREX GmbH. Access on our side is limited to the employees of DATUREX GmbH who work on the recognition model.

Processor: Donations are held on servers of Hetzner Online GmbH, Gunzenhausen, Germany (hosting/data centre). Hetzner processes them on our behalf and on our instructions (Art. 28 GDPR). We use no further processors for donations.

Apart from that we do not pass donations on to anyone, and we do not publish them.

The recognition model we train with donations is distributed as part of the app. The donated photos and data themselves are not distributed.

A transfer to countries outside the EU/EEA is not intended and does not take place.

6. Storage location and duration

Storage location: servers of Hetzner Online GmbH in Germany.

We keep a donation until you withdraw it, or until we no longer need it for improving the recognition models. There is no fixed period. We review at least every three years whether we still need the donations; what we no longer need, we delete.

Backups: We keep backups of the server's storage for at most 30 days. A withdrawn donation can therefore still be contained in a backup for up to 30 days; after that it is gone from there too.

Restoring from a backup: If we have to restore the server from a backup, donations withdrawn since that backup come back with it. The server deletes them again when it starts. For this it keeps the list of checksums of withdrawn donations (section 2). This works as long as that list survives; we therefore keep a copy of it separately from the server. If the server is lost together with its storage, the copy does not know the withdrawals that arrived after it was made. For those withdrawals we cannot promise that the donation is deleted again after the restore.

After a withdrawal: We delete the donation from the server at once and do not use it for any further training. Copies we made for training are compared with the server before every training run; in doing so we delete withdrawn donations from those copies. Models that were already trained with the donation are not changed or retrained; they stay in use and remain part of the app.

7. Withdrawing consent

You can withdraw your consent at any time with effect for the future. You do not have to give a reason, and we do not refuse a withdrawal. The lawfulness of processing up to the withdrawal is not affected.

In the app: Under "Settings", "Donate receipts", "Withdraw my donations" you withdraw all donations that came from this phone. You cannot withdraw a single donation in the app. Before sending a donation, the app generates a random deletion code, keeps it with the receipt on your device and sends it along with the donation. With this code the server deletes the photo, the recognised data and the corresponding entry. The server knows only a checksum of the code and cannot issue it. The deletion code is part of the backup you can create in the app.

What withdrawal does: We delete the donation from the server at once and do not use it for any further training. Models that were already trained with it are not changed or retrained. The donation disappears from the server's backups within 30 days. What applies when the server is restored from a backup is described in section 6.

By e-mail, with the checksum: You can also withdraw a donation by e-mail to kontakt@daturex.de, for example a single one. Tell us its checksum (a kind of digital fingerprint of the file that was sent). The app shows the checksums of your donated receipts under "Settings", "Donate receipts"; you can copy them there. With the checksum we find the donation reliably and delete it.

If the deletion code is no longer available (app uninstalled, app data cleared, phone changed or lost): if you have a backup of the app that you made after donating, restore it. The deletion codes and the checksums are then back, and you can withdraw in the app.

If you have no such backup and no longer have the app, write to kontakt@daturex.de and attach a photo of the receipt. We do not link donations to a person and therefore look for the donation by the receipt itself: by store, date and total, and we compare the pictures. If we find it, we delete it. A new photo of the receipt has a different checksum from the donated file; this route therefore works only by hand, and it can happen that we do not find a donation.

How we check that you are entitled: We do not know who sent a donation and cannot verify it either. Whoever tells us the checksum of a donation or shows us the receipt is treated as entitled to have it deleted. We do not ask for an identity document or other proof.

Special case: If an identical photo was already on the server, the server does not store it again, and there is no deletion code for you. Your app then cannot delete that photo; that is possible only with the deletion code of whoever sent it first, or by e-mail.

8. Your rights

Under the GDPR you have, in principle, the following rights towards us: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21).

Important for exercising them: We store donations without an account and without an identifier and therefore cannot determine on our own which donations are yours. We cannot act on a request such as "all my donations". You can exercise your rights for a specific donation by using the deletion code in the app, by telling us the checksum of the donation, or by sending us a photo of the receipt so that we can look for the donation (section 7). We do not have to store additional data about you merely to be able to identify you later (Art. 11(1) GDPR). We can therefore fulfil the rights under Art. 15 to 20 GDPR only if you give us information with which we find your donation (Art. 11(2), Art. 12(2) GDPR).

Send requests to kontakt@daturex.de or to datenschutz@externer-datenschutzbeauftragter-dresden.de.

9. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is:

Sächsische Datenschutz- und Transparenzbeauftragte (the Saxon data protection and transparency commissioner) Devrientstraße 5 01067 Dresden Germany

10. Changes

Date: 2026-10-09. If what is sent or stored changes, we will update this notice and the consent text before the change takes effect.