Privacy Policy

This privacy policy informs you, in accordance with Art. 13 GDPR, about which personal data is processed when you visit this website and use the contact form, for which purposes this is done, and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

EWS Einzelhandelsberatung und Warenwirtschaft System GmbH & Co. KG
Mühlenstraße 20
49838 Lengerich
Germany

Phone: +49 5904/9644-0
Email: info@ews-gmbh.org

For all questions regarding data protection and for exercising your rights as a data subject, you can reach us via the contact details above.

2. Principles of data processing on this website

This website is a purely informational company website. We process personal data only to the extent technically necessary to provide the website, or when you send us data via the contact form or by email. There are no sales, no registration, and no login on this website. Your data is not processed for advertising purposes and is not sold to third parties.

3. Cookies, analytics, and external services

This website does not use cookies and does not store any information on your device (including no LocalStorage or SessionStorage). Fonts are served exclusively from our own server; no external services such as Google Fonts, content delivery networks, map services, or video platforms are embedded. The location map shown on the website is a static image with no connection to third-party providers.

We do not ourselves use any analytics, statistics, or tracking tools, and we do not create usage profiles. However, our hosting provider IONOS carries out server-side audience measurement ("WebAnalytics") as part of the hosting product, which is enabled by default. Data is collected either via a counting pixel or from the server log files and, according to the provider, does not involve cookies. Your IP address is anonymised immediately after transmission and is used only to determine the approximate location of access; it is therefore not possible to draw conclusions about individual visitors. The evaluation serves statistical purposes and the technical optimisation of our website. The legal basis is Art. 6 (1)(f) GDPR.

As no information is stored on or read from your device, no cookie or consent banner is required for the operation of this website.

4. Hosting and server log data

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany ("IONOS"). When you access the website, IONOS automatically processes information on our behalf in so-called server log files, which your browser transmits. This includes in particular: the IP address of the requesting device, date and time of access, the page or file requested, the amount of data transferred, a message confirming successful retrieval, browser type and version, and the operating system.

Processing this data is technically necessary to deliver the website and to ensure the stability and security of the service (e.g. to defend against attacks). The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in the secure and reliable operation of the website). The log data is not combined with other data sources. It is deleted after 8 weeks; longer storage takes place only where this is necessary to investigate or defend against a specific security incident. We have concluded a data processing agreement with IONOS in accordance with Art. 28 GDPR.

5. Contact form and email contact

If you write to us via the contact form, we process the data you provide (name, email address, optionally company, and your message) solely to handle and respond to your inquiry. The website itself does not store your data in any database. The same applies if you contact us directly by email.

Technically, a script on our web server hosted at IONOS receives your input and sends it as an email to our mailbox info@ews-gmbh.org. These emails are received and stored by our email service provider QualityHosting GmbH, Uferweg 40–42, 63571 Gelnhausen, Germany. Both providers process the data solely on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place with each of them. The data is not passed on to any other third parties.

The legal basis for this processing is Art. 6 (1)(b) GDPR where your inquiry relates to entering into or performing a contract, and otherwise Art. 6 (1)(f) GDPR (legitimate interest in responding to inquiries addressed to us).

The confirmation in the contact form serves solely to record that you have read this privacy policy. It does not constitute consent to any processing beyond that described here.

We delete your inquiry once its handling is complete and the matter has been conclusively resolved, unless statutory retention obligations (in particular under Sec. 257 of the German Commercial Code (HGB) and Sec. 147 of the German Fiscal Code (AO) for business correspondence) prevent deletion. In that case, processing is restricted for the duration of the retention period.

6. Links to external websites

This website contains links to external third-party websites, for example to the Apple App Store and Google Play (download of the ESL-Easy Mobile app). No data is transferred to these providers when you merely visit our website. Only when you click such a link do you leave our website; from that point on, the privacy policy of the respective provider applies.

7. TLS encryption

For security reasons and to protect the transmission of confidential content, such as inquiries you send via the contact form, this website uses TLS encryption. You can recognize an encrypted connection by the "https://" prefix in your browser's address bar and by the lock icon shown there.

8. Your rights

As a data subject, you have the following rights vis-à-vis us with regard to your personal data: the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), and the right to data portability (Art. 20 GDPR). To exercise these rights, an informal message to info@ews-gmbh.org is sufficient.

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6 (1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

Withdrawal of consent: Where we process personal data on the basis of your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen
(The State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover, Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de

10. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place in connection with this website.

11. Date and changes to this privacy policy

This privacy policy is dated August 2026. We will update this policy whenever the data processing on this website changes (e.g. when new features are introduced) and will publish the current version here. In case of doubt, the German version of this privacy policy prevails.

Privacy policy for the ESL-Easy Mobile app

This privacy policy applies to the "ESL-Easy Mobile" app for Android (package name org.ewsgmbh.esleasymobile) and iOS. It applies regardless of whether the app was obtained from Google Play, from the Apple App Store, or from an installation file (APK). It describes which data the app processes, where the data is transmitted, how long it is stored, and which rights you have. Visits to our website are covered solely by the privacy policy for the website; the statements made there do not refer to the app.

1. Scope and provider

The provider of the app is:

EWS Einzelhandelsberatung und Warenwirtschaft System GmbH & Co. KG
Mühlenstraße 20
49838 Lengerich
Germany

Phone: +49 5904/9644-0
Email: info@ews-gmbh.org

You can also reach us via these contact details with any questions about data protection.

The app is a work tool for companies that use the ESL-Easy system for electronic shelf labels. Employees of these companies and service technicians use it to link labels to items and to remove such links, to query the status of labels, to display the location of an item in the store, and to view or change master data where the company permits this. The "AP scan" function shows the radio access points of the label system and their signal quality. The app has no function without an ESL-Easy server. It is not intended for consumers or for children.

2. Who is responsible for your data

The app works together with an ESL-Easy server. The server's address is stored in the app's settings or is read from a configuration QR code. This server is operated by the company that uses the app (the "operator"), either itself or through a service provider it has engaged, within its own network or in a data centre. As a rule, the operator is your employer. The operator decides on the use of the app, on the server's settings, and on the storage period. The operator is the party responsible under data protection law for the processing of data on its server. The operator informs you about the purposes and legal bases of this processing.

EWS provides the app and the ESL-Easy software. No EWS address is stored in the app, and the app does not transmit any data to EWS on its own initiative. Section 7 of this policy describes the cases in which EWS may nevertheless come into contact with data from an ESL-Easy installation. Section 5 describes the transmission to Google on Android.

3. Data the app transmits

Endpoints. The app exchanges data with the operator's ESL-Easy server. It downloads language and help files from the operator's ESL-Easy system; the address used is the server address or a separately configured address. On Android, the integrated barcode library also transmits data to Google (section 5). The app does not run in the background and does not keep a permanent connection to the server.

Server discovery. If no server is configured or the server cannot be found, the app searches the local network for an ESL-Easy server. To do so, it sends a discovery message as a broadcast (UDP) into the local network. The message contains a command and a module name, but no device data. Discovery is switched on by default.

Device data. When the app signs in to the server, it transmits:

a device identifier that the app generates itself at random when it is first started and keeps until it is uninstalled (not a hardware, phone, or advertising identifier),
the device name assigned in the app,
the manufacturer, the model, and the device name set in the operating system,
the operating system and its version, the device type (e.g. phone or tablet), and the screen size,
the version of the app,
the number of the store to which the device is assigned (not a geographic location).

The device identifier and the device name are also sent with further requests. The server keeps a list of mobile devices. It uses this to recognize the device, to assign a group, a store, and settings to it, and to lock it if necessary. Depending on how the device is set up, the device name set in the operating system may contain a person's name. If a device is used by one particular person only, the device details and the work steps transmitted with it can be attributed to that person.

IP addresses. The app transmits the IPv4 addresses assigned to the device in the network so that the server can identify the store from the network range. As with any network connection, the server also learns the IP address from which a request originates. It records this address, together with the content of the request, in its log files.

Error reports. If the app catches a program error during operation, it sends the error text to the ESL-Easy server. If the app crashes on Android, it writes a crash report to a file on the device and to the Android system log. The report contains the time, the app version, the manufacturer, the model, the Android version, the error message, and the stack trace. The next time it is started, the app transmits the report to the ESL-Easy server. It deletes the file once the server has confirmed receipt. The reports are used for troubleshooting.

Working data. While you work with the app, the scanned or entered details of labels, items, storage locations, and master data, as well as the selected store, are transmitted to the server and retrieved from it. This is business data of the operator.

No personal user account. The app has no sign-in for individual persons: no registration, no email address, no personal account. For the connection to the server it uses technical access credentials of the transmission protocol, which are not assigned to any person.

Program updates (APK version only). The version distributed as an installation file downloads program updates from the operator's ESL-Easy system and offers them for installation. The versions from the stores receive updates through the respective store.

4. Permissions

Timing. On Android, the app requests the permissions for the camera and, depending on the Android version, for Bluetooth scanning or for location once when it is started, not only when the respective function is opened.

Camera and flashlight. The app uses the camera to read barcodes and QR codes; the flashlight provides light while doing so. Recognition takes place on the device. The app does not store or transmit images. It uses only the recognized code.

NFC. The app reads the identifier of NFC-enabled labels. It does not write any data via NFC.

Bluetooth. In the "AP scan" function, the app receives the radio messages of the label system's access points in order to display their signal quality. It does not establish a connection to these devices. The names you assign to access points remain on the device and are not transmitted. Up to and including Android 11, the app also uses the Bluetooth permissions to check whether Bluetooth is switched on.

Location (Android up to version 11 only). Up to and including Android 11, the operating system permits a Bluetooth scan only with the "precise location" permission. The app requests it only on these versions and needs it solely for the AP scan. The app does not query a position and does not determine, store, or transmit a location. From Android 12 onwards, the app instead uses the Bluetooth scanning permission with the declaration that it is not used to derive location. On iOS, the app does not request a location permission.

Network. On Android, internet access and the query of network and Wi-Fi state are used for the connection to the server, for downloads, and for server discovery. On iOS, the app requests the "Local Network" permission for server discovery.

Vibration. Vibration is used for feedback after a scan.

Install packages (APK version only). The version distributed as an installation file needs this permission to offer a program update for installation.

The app does not request any further permissions, for example for storage, notifications, contacts, or the microphone.

5. Barcode recognition with Google ML Kit (Android only)

On Android, the app uses the Google ML Kit software library for barcode recognition with the camera. The recognition model is built into the app, and recognition runs on the device. According to Google, ML Kit does not send images or recognized codes to Google.

According to Google, however, ML Kit collects usage and diagnostic data and transmits it to Google via HTTPS, in particular:

device information (e.g. manufacturer, model, operating system version and build, available hardware accelerators),
information about the app (package name and version),
an identifier of the respective app installation which, according to Google, is not intended to uniquely identify a person or a device,
performance and usage data of the recognition (e.g. performance metrics, configuration such as image format and resolution, input and output size, feature version, event type, error codes and, depending on the function used, further technical details of the scanning process).

According to Google, it uses this data to measure performance, to debug, maintain, and improve the library, and to detect misuse. According to Google, ML Kit may also contact Google servers from time to time, for example to retrieve bug fixes or information on hardware support. As with any internet connection, Google learns the IP address under which the device appears on the internet.

Transmission is only possible if the device can reach Google via the internet. EWS does not receive this data. Google states that it does not pass the data on to third parties.

The library is integrated on the basis of Art. 6 (1)(f) GDPR. The legitimate interest lies in fast and reliable barcode recognition on the device. You may object to this processing (section 9).

Google may process the data on servers outside the European Union, in particular in the USA. According to its own statements, Google LLC has certified that it adheres to the principles of the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists. Google decides on the storage period at Google; EWS has no influence on it. Details from Google: developers.google.com/ml-kit/android-data-disclosure, developers.google.com/ml-kit/terms, policies.google.com/privacy, and policies.google.com/privacy/frameworks.

On iOS, the app instead uses Apple's Vision framework, which is part of the operating system. The app itself does not transmit any data to Apple or Google during recognition.

6. Storage on the device

The app stores the following on the device:

the connection settings (address and port of the ESL-Easy server, address of the content server, technical access credentials, timeouts, the encryption setting, the server discovery settings),
the device identifier and the device name, the selected store and language, the operating settings, and the password for the settings area,
the names assigned to access points in the AP scan,
a short log of downloaded files as well as the language and help files,
an error report, until it has been transmitted.

The two passwords are stored in encrypted form, the other settings unencrypted. The app does not store a scan history or images. On Android, a crash report is additionally written to the device's system log.

The data stored by the app is deleted when you uninstall the app or delete the app data in the operating system settings.

If the operating system's backup function is switched on for the device, this app data may be part of the backup held by the provider of the operating system (Google or Apple). Whether this happens depends on the settings of the device.

7. Recipients, transmission, and security

Recipients. The data listed in section 3 goes to the operator's ESL-Easy system. The app contains no advertising, no analytics or tracking services, no third-party crash reporting services, and no map or push services. The only transmission from the app to a third party is the one to Google described in section 5 (Android only). Data is not sold.

Transmission. The app transmits the data to the ESL-Easy server via IXOP, a proprietary EWS protocol. Depending on the configuration, the content is transmitted encrypted with AES or unencrypted. Encryption is switched on in the app's default setting. If the server responds only in the other mode, the app switches to that mode. The app downloads language and help files and program updates from the operator's system via HTTPS. If the server is not located in the operator's network but in a data centre, these connections run over the internet. The operator is responsible for securing the network over which the app and the server communicate.

EWS key server. When the ESL-Easy server registers a label it does not yet know, it retrieves the label's technical data from an EWS server on the internet (key server). In doing so, the operator's server (not the app) transmits the identifier of the label, the customer number, and the name of the ESL-Easy installation, and in some cases also the store number. The key server assigns the label to the operator in the process. No information about the mobile device or the person using it is transmitted.

Support and maintenance by EWS. Where an operator grants EWS remote access to its ESL-Easy server for support and maintenance, EWS can view the data stored there that is listed in section 3. Whether and to what extent this happens depends on the arrangements between the operator and EWS; the operator can provide information on this.

App stores. When you obtain the app via Google Play or the Apple App Store, their operators process data under their own responsibility. Where they provide EWS, as publisher of the app, with statistics (in the Google Play Console, for example, crash reports), the store operators and the settings of your device determine which data is collected for this purpose.

Where EWS itself processes personal data in individual cases described in this section, it does so on the basis of Art. 6 (1)(f) GDPR. The legitimate interest lies in the secure operation of the label system and in troubleshooting.

8. Storage period and deletion

On the device. The data listed in section 6 remains until the app is uninstalled or its data is deleted. An error report is deleted once the server has confirmed receipt.

Logs on the ESL-Easy server. The server records the sender address and the content of requests, as well as the app's error reports, in log files. These files therefore also contain the device identifier, the device name, and the device details. The operator determines in the system configuration how long these files are kept.

Device list on the ESL-Easy server. The entry of a device (device identifier, lock flag, device name, group, device details, settings, store, time of last contact) is not deleted automatically. The operator decides on its deletion.

Backups and forwarding. The ESL-Easy system can create backups of its database and forward logs to a further system; forwarding is switched off by default. The periods set for the respective system apply to such copies.

At Google. Google decides on the storage period of the data listed in section 5.

9. Your rights, contact, and date

You have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), and the right to data portability (Art. 20 GDPR).

Right to object (Art. 21 GDPR). Where your data is processed on the basis of Art. 6 (1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

Whom to contact. For the data on the ESL-Easy server, please contact the operator, as a rule your employer. The operator is responsible for this data. Where EWS itself processes data (sections 5 and 7), you may assert your rights against us informally, for example by email to info@ews-gmbh.org. We answer questions about the app and about this policy at the same address. Section 5 of the privacy policy for the website applies to your message to us.

Right to lodge a complaint. Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement. The supervisory authority responsible for EWS is:

For the operator, the supervisory authority responsible for it is relevant, as a rule the one at its registered office.

This policy is dated October 2026. The current version on our website esl-easy.de is authoritative; a version displayed in the app may be older. In case of doubt, the German version of this policy prevails.