Privacy notice for the “Etra Atlas” app

The Etra Atlas app for iPhone and iPad is the mobile access to Atlas, the digital registry your company uses. This notice explains which data the app processes, where it goes and what rights you have. Our website has its own privacy policy.

1. Who is responsible

Companies use Atlas for their own staff. Your company (the employer that gave you your account and company code) decides which data its Atlas holds and why, and is the controller of that data under Art. 4(7) GDPR. We run Atlas on your company’s behalf (processing under Art. 28 GDPR), or your company runs it itself.

We are responsible for the app itself and for the company directory (section 3):

Please ask your company first about your data in Atlas (documents, working times, your account). You can always contact us as well.

2. No advertising, no tracking

The app contains no advertising, no third-party analytics or advertising services, and does not track you across other apps or websites. We do not sell data.

3. Company code

On first launch you enter your company’s code. The app asks our company directory (track.registra-atlas.com) which Atlas the code belongs to and receives that Atlas’s name and address. Only the code and the technically necessary connection data (IP address, time) are transmitted. We do not store the request; the IP address is kept in memory for at most 15 minutes to limit repeated failed attempts. Legal basis: Art. 6(1)(b) and (f) GDPR. If you enter the Atlas address instead of a code, the directory is not contacted.

4. What the app exchanges with your company’s Atlas

• Sign-in: email address, password and the code from the email or an authenticator app go to your company’s Atlas. The app does not store your password (unless you save it in iCloud Keychain). The session is kept encrypted in this device’s keychain.
• Content: documents, photos and scans you upload, notes, approvals, Workflow cards and questions to Atlas AI. Atlas AI runs on the Atlas server itself; documents and questions are not sent to any external AI provider. The app keeps the Atlas AI conversation on the device.
• Workon: start of work, breaks and end of work. The app records your location only when you start and end the working day, and only if you allow location access. Leave requests and sick notes, optionally with a scanned certificate. A certificate is health data (Art. 9 GDPR); your company processes it for the employment relationship (Art. 9(2)(b) GDPR, § 26 BDSG).
• My assignment: vehicle, destination and times from your company’s planning, for display only.
• Notifications: the app asks your company’s Atlas for new notifications. If push notifications are set up, Apple Push Notification service delivers them; Apple receives a device token and the notification text.
• This iPhone as a second factor: when you connect the device, the app creates two keys in the Secure Enclave. Only the public keys, the device name and, if used, the push token go to Atlas.
• Areas of the Atlas website (for example Inventory or Finance) open in the app with the same sign-in; the same applies there.

Legal basis: the employment or service relationship with your company (Art. 6(1)(b) GDPR, § 26 BDSG) and its legitimate interest in secure sign-in (Art. 6(1)(f) GDPR).

5. What stays on the device

• Codes for other services (authenticator): the secrets stay in this device’s keychain, or in iCloud Keychain if you choose (end-to-end encrypted by Apple). They never reach us or Atlas.
• Face ID: iOS performs the check. The app only learns whether it succeeded.
• Widgets and “Share”: the number of open items and files waiting to be uploaded are stored in the storage shared by the app and its widgets on the device.

6. Permissions

The app only asks when you use a feature: camera (scanning documents and QR codes), photos (uploading images), location (Workon, start and end), microphone (voice input), Face ID and notifications. You can withdraw any permission in the iOS settings.

7. Recipients

Data goes to your company’s Atlas, run by us on your company’s behalf or by your company itself. Apple receives data only where you use Apple services (push notifications, iCloud Keychain); Apple’s privacy policy applies. Services your company connects to Atlas itself (such as Microsoft 365) are set up by and the responsibility of your company.

8. Retention and deletion

The session and cached data stay on the device until you sign out or delete the app; “Websitedaten löschen” (clear website data) in the app’s settings removes them at once. Your company decides how long data stays in its Atlas (for example statutory retention periods for receipts). Your company creates your account and deletes it; please contact your Atlas administrators.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). For data in your company’s Atlas, please contact your company; we support it. For the company directory, an email to info@registra-atlas.com is enough. You may also lodge a complaint with a data protection authority; ours is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

10. Changes

When the app changes, we update this notice. The version published here applies.

Last updated: October 2026