Controller: SUDO s.c.,
Address: ul. Krasnobrodzka 5/10, 03-214, Polska
Contact: kontakt@sudo.com.pl
Effective date: 2025-09-30

1. Scope

This policy applies to the mobile app “Product origin scanner” (the “App”). It explains what data we process, for which purposes, and your rights.

2. Who processes your data

The data controller is SUDO s.c. We also use third-party SDKs (e.g., Google). Such providers act as independent controllers or processors under their own policies.

3. Data we process

• Camera image (barcode scanning): The camera feed is processed on-device using Google ML Kit to detect and read barcodes (EAN/GTIN). We do not send images or scanned codes to our servers.
• Advertising data (Google Mobile Ads/AdMob): the ad provider may process the Advertising ID (AD_ID), approximate location (e.g., derived from IP), ad impressions/interactions, and app/ device information (SDK diagnostics). Scope depends on your consent (see section 5) and Google’s policies.
• No accounts / no own servers: we do not create user accounts nor keep our own user database.
• Permissions: CAMERA, INTERNET, AD_ID.

4. Purposes and legal bases (GDPR)

• App functionality (barcode scanning) – Art. 6(1)(b) GDPR (performance of a service at your request).
• Ads and ad measurement (AdMob) – Art. 6(1)(a) GDPR (consent) in the EEA/UK; outside the EEA, processing may rely on the provider’s legitimate interests.
• Security & SDK diagnostics – Art. 6(1)(f) GDPR (legitimate interest in stability and security).

5. Consent & privacy controls

In the EEA/UK we use User Messaging Platform (UMP) to obtain consent for advertising data and personalization. You can change your choice anytime in the App: Menu → Privacy options (ads). Without consent, only non-personalized ads are shown.

6. Sharing

• Google (AdMob / Google Mobile Ads SDK): as described in section 3.
• External links: opening GS1 takes you to a third-party site governed by its own policy.
  We do not share your data with other parties unless required by law.

7. International transfers

Providers like Google may process data on servers outside the EEA under appropriate safeguards (e.g., SCCs).

8. Retention

• We do not store barcode data (processing is on-device).
• Ad provider retention follows its own policies.

9. Your rights

You have the right to access, rectify, erase, restrict, object, data portability, and lodge a complaint with a supervisory authority. Contact us at [contact email]. For data processed by Google, use Google’s privacy controls.

10. Children

The App is not directed to children and should not be used by individuals under 13.

11. Changes

We may update this policy. Updates will be posted at the same URL with an effective date.