Privacy policy for Jiwar

This is a translation for convenience. In case of discrepancies, the German version shall prevail.

Version of: 16.10.2026

1. Controllers

Jiwar is operated by BGGI GmbH · Rostocker Straße 43 · 53117 Bonn · Deutschland. Data protection contact: datenschutz@bggi.de.

For residents' data in the operation of a compound, the respective management or developer of the compound is the controller; BGGI GmbH processes this data on their behalf. For the technical operation of the app (account, sign-in, security), BGGI GmbH itself is the controller.

2. Which data

Account: name, phone number or email address, language, password (hash only), unit and role in the compound.

Use: visitor passes (guest name, validity, code), gate entries and exits (time, gate, result), deliveries, repair requests (text, photos — location and other metadata are removed on upload), notices read, ratings, days on which the app was used.

Deliveries: announced deliveries (carrier, tracking number, time window, “leave at the gate” or “let the courier in”), parcels received at the gate (unit, carrier, shelf, time) with a photo of the parcel taken by the guard at the gate (metadata removed), the pickup code (stored only encrypted or as a check value) and the pickup (time, with code or with a note by the guard).

For craftspeople (app “Jiwar Pro”) in addition: trades and company, work order status with time (accepted, on the way, on site, done), proof photos (metadata removed), the name of the resident who confirms the work, and the work pass for the gate. There is no continuous location tracking.

Marketplace: orders (provider, items, prices, payment method, note, unit, times) and reviews. The provider receives your unit, first name and note, not your phone number. You pay in cash or directly to the provider, or online via the payment service Paymob (see “Payments”). For providers (app “Jiwar Business”): company details, tax number and commercial register for verification, catalogue with product photos (metadata removed), orders, the commission per order and, where applicable, the fee for a highlighted placement in the marketplace.

Drivers of a provider (app “Jiwar Business”): own account (name, phone number or email, language), assigned orders (unit, first name, note — without amounts), status “on the way” and “delivered” with time, proof of delivery with the resident's delivery code or a photo (metadata removed), and the delivery pass for the gate, on which the guard sees the driver's name. Craftspeople and drivers see the location of the building as a link to Google Maps (opens in the browser); people are not located.

Community: bookings of shared facilities (facility, time, number of persons, unit). Votes in polls are stored anonymously — only with a pseudonym that cannot be traced back to you or your unit; the management only sees totals.

Payments: you pay online (orders, bookings, charges, quotes) on the payment page of Paymob (Paymob Solutions S.A.E., Egypt), an independent controller for payment processing; Paymob receives your name, email and phone number for this. Jiwar only stores amount, status and reference — no card data. The provider's share goes directly to their account with the payment service.

Charges and quotes: charges of the management for your unit (title, amount, due date, payment, receipt number) and quotes for repairs in your unit (amount, acceptance or decline) — kept for 10 years (accounting).

Provider application (jiwar.vip/anbieter): business, category, contact person, phone/email, requested compound, message and IP address (abuse prevention) — for review by BGGI GmbH, deleted 12 months after the last update.

Notifications: if you allow notifications, we store the push token of your device (iPhone: Apple Push Notification service; Android: Google Firebase Cloud Messaging) with platform and app. On Android, Firebase creates an installation identifier for this (Firebase Installation ID), which Google processes together with the token for delivery; it is not used for advertising or analytics. The texts contain no names — only the occasion (e.g. “Your visitor has arrived”). Email notifications go to the address stored in your account. You can opt out per area and channel in the settings (security emails excepted); the token is removed when you sign out or delete your account, otherwise after 90 days without use.

QR codes at the gate: the guard app “Jiwar Gate” reads visitor and pickup codes with the camera. On Android, Google ML Kit recognises the code on the device; camera images are neither stored nor transmitted. ML Kit may send technical diagnostic and usage data (e.g. device model, operating system and app version, performance metrics) to Google. On Android the library is also included in “Jiwar” and “Jiwar Pro”, but is not used for scanning there.

Technical: IP address and device type at sign-in and in security logs; log of management actions (who changed what and when); proof of consent (version, time, IP address, device).

3. Purposes and legal bases

Operating the compound (access, visitors, deliveries, repairs, notices) — consent (Art. 6(1)(a) GDPR; Law No. 151 of 2020) and performance of the terms of use (Art. 6(1)(b) GDPR).

Marketplace, payments and billing (order, delivery with code or photo proof, commission, invoices) and notifications — performance of the terms of use (Art. 6(1)(b) GDPR); retention of payments and invoices — legal obligation (Art. 6(1)(c) GDPR).

Security, abuse prevention, error analysis — legitimate interest (Art. 6(1)(f) GDPR).

Pilot metrics for the management (usage, gate, repair times, satisfaction) — aggregated only, no individual profiles; legitimate interest.

4. Storage location and transfer

All data is stored with Google Cloud in Frankfurt am Main (region europe-west3, Germany/EU); Google is a processor under Art. 28 GDPR.

Requests via jiwar.vip are forwarded to this service in encrypted form by Firebase Hosting (Google); no content is stored in the process. Emails (e.g. sign-in and signature codes) are sent by Resend from the EU region (Ireland). Both are processors under Art. 28 GDPR.

For compounds in Egypt, storage in Germany is a transfer abroad under Law No. 151 of 2020. It is based on your express consent and on the licence of the Egyptian Personal Data Protection Center (PDPC), which is obtained before pilot operation with real data.

Push notifications are delivered by Apple (APNs) or Google (Firebase Cloud Messaging), which receive the token and text for this, on Android also the Firebase Installation ID. This data and the diagnostic data of Google ML Kit may be processed in the USA; Apple and Google are certified under the EU-U.S. Data Privacy Framework.

Data is not passed on to third parties for advertising. There is no tracking, no advertising network and no third-party advertising. Providers in the marketplace can be highlighted for a fee: they are then shown at the top of the list and marked as “Featured” (advertisement). No data about you is evaluated for this.

5. Retention

Visitor passes: 90 days after expiry. Gate log and deliveries with parcel photos: 12 months. Repair requests with photos: 24 months after closure. Days of use: 13 months. Ratings: 24 months. Expired sign-in and invitation codes: 30 days.

Marketplace orders with reviews and delivery photos: 24 months after completion. Catalogue photos: as long as the item exists. Bookings: 12 months after the date. Polls: 24 months after closing. Payments and invoices: 10 years (retention obligations); expired unpaid payment attempts: 30 days. Log of management actions: 3 years.

If you delete your account, your name and contact details are removed immediately; repair requests, orders and bookings remain available to the management without your name until the end of their period. Instructions: https://jiwar.vip/legal/konto-loeschen — in the app or by email. The proof of consent is kept as long as claims may arise from it: 3 years after the consent ends (agreement to a new version or deletion of the account).

6. Your rights

You have the right of access and to a copy of your data, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) as well as the rights under Art. 2 of Law No. 151 of 2020. You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); processing so far remains lawful, but Jiwar cannot be used without consent.

How to make a request: (1) in the app or dashboard under “My data” — a copy as a file (JSON and HTML), rectification, withdrawal, objection and deletion; consequential steps are confirmed with your password; (2) via the form https://jiwar.vip/legal/betroffenenrechte; (3) by email to support@jiwar.vip or datenschutz@bggi.de. For (2) and (3) we send a confirmation link to the email address registered in your account — this is how we make sure the request comes from you; we only carry it out after confirmation. If your account has no email address, we verify your identity through the management of your compound. Unconfirmed requests expire after 7 days. How to delete your account: https://jiwar.vip/legal/konto-loeschen.

Deadlines: we answer within 6 working days of receipt (Art. 32 of Law No. 151 of 2020), at the latest within one month (Art. 12(3) GDPR). If we extend the deadline under the GDPR, we tell you the reasons within the first deadline. Requests are free of charge. If we refuse, we give the reasons.

Objection (Art. 21 GDPR): to the recording of your days of use and to satisfaction ratings for the management's statistics — afterwards this processing no longer takes place for you and data recorded so far is deleted. Logs for security and abuse prevention remain (compelling legitimate grounds).

Erasure and retention duties: we must keep payments, receipts and invoices (Art. 17(3)(b) GDPR; Section 147 AO, Section 257 HGB; Law No. 206 of 2020). They remain without your name and restricted until the period ends (restriction instead of erasure). We keep the register of your requests (type, dates, outcome — without contact details) as evidence for 3 years after completion.

You may lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia or the Egyptian Personal Data Protection Center (PDPC).

7. Security

Encrypted connections (TLS), data separated per compound in the database (row-level security), passwords as hashes only, encrypted keys and codes, app credentials in the device keychain/keystore, tamper-evident logs.

8. Contact form on jiwar.vip

Purpose and data: if you write to us using the contact form on jiwar.vip, we process your name, email address, topic and message, optionally your phone number and compound/company, as well as the language of the page and the time — to answer your request.

Legal basis: requests about a cooperation (e.g. a demo for a compound, providers) — Art. 6(1)(b) GDPR; other requests — legitimate interest in answering them (Art. 6(1)(f) GDPR). Under Law No. 151 of 2020 we process the details on the basis of your consent, which you give with the checkbox in the form and can withdraw at any time.

No storage in Jiwar: the details are not stored in the database. They are sent once as an email (sent via Resend, EU region) to the mailbox of BGGI GmbH; a reply goes directly to your email address. There is no automatic confirmation to you. To prevent abuse, the service briefly counts requests per IP address in memory (at most 5 per hour); the IP address is not stored.

Retention: the email remains in the mailbox of BGGI GmbH as long as it is needed to handle your request and any resulting cooperation, and is then deleted according to the mailbox's retention rules, unless a statutory retention obligation (e.g. for business letters) applies. Your rights under section 6 apply here too.