Privacy Statement
Name of the service
Authorization Server, in the following referred to the "Service".Simplified Overall Description of the Service
The Service does not have user accounts. It collects user data (personal information based on user authentication) from a trusted Identity Provider where the user has an account at upon the user's consent. A list of such operators (the "Identity Providers") is available here. The user is enabled to determine the scope of such personal data that is to be collected (such determined data in the following referred to as the "Data"). The Service is to make such Data available to the operators of applications and services registered with the Engagement Platform (the "Operators"). A list of such operators is available at "Operators".
The Operators are contractually bound to only use the Data for the Purpose and/or the Determined Use determined below. Any further use of the Data requires a separate consent of the user. Further, Operators are contractually bound to comply with General Data Protection Regulation ("GDPR") standards or even higher standards also in case the Operators have their seats outside of the EU or EEA.
Please note that the above is a simplified explanation only. Below please find a more detailed description, including in particular explanations in regard to the Purpose and the Determined Use, the implemented security measures and the duration of storage.
Description of the Service
This Service - the Authorization Server is part of the Platform (the "Platform") and acts as a broker of user authentication and personal information between the Identity Providers and the Operators, while the Identity Providers provide the authentication and the personal information of the user. Each registered Operator can obtain a specific amount of Data, individual for each application and service, for the Purpose as determined below. Any use exceeding the or deviating from the Purpose and/or the Determined Use of Data is described in the Terms of Use and Privacy Statement of each Operator and requires prior separate consent of the user.
This Service controls the provision of the Data to Operators based on OpenID Connect scopes that were used when the application or service was registered with this Service. It is not possible that an Operator can obtain more Data than authorized to the Operator based on the scope(s). Which scopes exist and which user attributes are linked with a scope are defined by the OpenID specification.
In order to provide the Data to the registered Operators, this Service must first collect the Data from the Identity Provider used for login. Each Identity Provider must get user consent to release any personal information to this Service. By using this Service, you agree that the collected information is processed for the purpose of making it available to the registered Operators upon request.
Any registered Operator requires a valid access token to obtain Data. Each access token has a validity period that limits the time where it can be used to fetch Data. This Service allows you to see the amount of Data that is collected for the current lifetime of an access token.
This Service does not collect any more personal information as received from an Identity Provider as previously authorized by the user at login with the Identity Provider.
Controller of the personal data file and a contact person
Secure Dimensions GmbHWaxensteinstr. 28, 81377 Munich, Germany
Tel. +49 89 38151813
Andreas Matheus
support <at> secure-dimensions.de
Jurisdiction
Germany - Bavaria (DE-BY)Collected Data
The Data is collected from the Identity Provider used for login. The amount of Data available depends on the approval of the user at login with the Identity Provider. Only this information is the superset that can be made available to registered Operators.
The client IP address is collected automatically.
Processed Data
The Data, collected from an Identity Provider is temporarily stored for the Purpose to make it available to registered Operators upon request. The Data is not processed for any other Purpose.The Purpose of the processing of the Data
The Purpose of this Service is to fulfil the objective of brokering Data to Operators' registered applications and services by presenting a valid access token. It is a technical requirement that the brokered information is stored for the validity of the access token. The lifetime of an access token begins when the user starting the registered application or service and ends after a predefined time. The lifetime ends before the expiration time with the user's logoff.
The Operators are contractually bound to use the Data solely as determined in the Terms of Use and Privacy Statement (the "Determined Use"). An Operator must provide a URL to the Terms of Use and Privacy Statement when registering an application or service with this Service. It is the duty of the Operator to further obtain the user's specific and explicit consent to any use of the Data exceeding the or deviating from the Purpose and/or the Determined Use.
A description of the Data being processed
The Data that can be requested by registered Operators is controlled via the concept of scopes. Please consult the OpenID specification for further information.Scope openid (default)
For this scope, this service provides a user cryptonym to registered applications and services. A cryptonym is only generated if a subject identifier was received from the asserting Identity Provider.Scope profile
According to the OpenID Connect specification, the following Data is linked with this scope:name, family_name, given_name, middle_name, nickname, preferred_username, profile, picture, website, gender, birthdate, zoneinfo, locale, and updated_at
Scope email
According to the OpenID Connect specification, the following Data is linked with this scope:Email (mail), email_verified (was the email verified by the Identity Management at the Identity Provider)
Scope idp
This scope provides information about the Identity Provider used for login. The information includes:idp_origin, idp_identifier, idp_name, idp_origin, idp_country
Client IP address
The client IP address is used to limit application registration requestes.Retention of the Data
The Data is stored for the duration of the lifetime of active sessions determined by the lifetime of access tokens. The processing history of the Data is stored for the maximum duration of 30 days unless deleted by the user. The user has the option to stop the Data to be made available for trusted applications from this page by choosing the "revoke" or the "logout" button. The Data stored as processing history can be deleted from this page via the "delete" button.Principles of protecting personal data
This Service enforces all communication to be HTTP over TLS (HTTPS). For the storage of the Data at this Service, standard security procedures to ensure a secure data storage are applied.Regular disclose of the Data to third parties
This service provides the personal Data as OpenID Connect User Claims to registered Operators using a valid access token. The amount of Data depends on the scopes bound to the access token.Transfer of the Data outside the EU or EEA
This Service allows non-managed, self-registration of applications and services by Operators. This Service does not limit the Operators to be legal entities inside the EU or EEA. Therefore, the user shall read the Terms of Use and the Privacy Statement of the Operator's application to understand the further processing of the Data and to determine the transfer of the Data outside the EU or EEA before authorizing the application. If in doubt, the user shall not authorize an application to prevent the transfer of the Data outside the EU or EEA.Operators are contractually bound to comply with GDPR standards or even higher standards also in case the Operators have their seats outside of the EU or EEA.
In case an Operator is seated outside of the EU or EEA, the Service will point this out to the user explicitly in the course of the user's registration with such Operator's application or service.