Experience Lab Data Collector Privacy Statement

Experience Lab Data Collector Privacy Statement

Version: 1.2 
Effective Date: March 25, 2026 

This privacy statement describes the guidelines for information processing carried out by the Experience Lab of Breda University of Applied Sciences (BUas) when you use the Experience Lab Data Collector application (formerly MyBUas Route). This statement is in accordance with the General Data Protection Regulation (GDPR) and the guidelines of the BUas Research Ethics Advice and Assessment Committee. 
 

1. Pseudonymization & privacy 

To protect your privacy, we prioritize pseudonymization and data minimization. 

  • No Personal Login: The app does not require an email address, name, or password. 
  • Participant Codes: Data is collected under a unique alphanumeric code (e.g., "P001") assigned to you. 
  • Hardware Privacy: A unique hardware identifier (UUID) is generated and stored in a private registry on our server to manage your session. This identifier is kept separate from the actual research logs to ensure that your physical device cannot be easily 
    linked to your specific movements by unauthorized parties. 
  • Separation of Data: Your identity is never linked to the sensor data within the application database. 


2. What data do we process? 

We process categories of data that are strictly necessary to analyze spatial behavior and experience. Broad or anonymized data is insufficient for our research questions regarding precise mobility patterns. 

Mobility and Sensor Data 

  • Location Data (GPS): Precise latitude, longitude, altitude, speed, and accuracy radius. 
  • Motion Data (Accelerometer): High-frequency 3-axis G-force data to analyze movement intensity and physical activity. 
  • Proximity Data (Bluetooth Beacons): When enabled for a project, the app detects nearby Bluetooth iBeacons to determine your proximity to specific points of interest or indoor locations. 
  • Timestamps: The exact UTC time recorded for every sensor event. 

Research Context 

  • Zone Markers: The app records if you are within a predefined research boundary (Geofence). 
  • Device Metadata: The model of your phone (e.g., "Pixel 9") is recorded to help researchers calibrate sensor sensitivity. 


3. How do we collect data? 

Our application is designed for active research sessions only. 

  • Explicit Start/Stop: Data collection only begins when you tap "Start" and ceases immediately when you tap "Stop" or when a predefined project time limit is reached. Persistent Recording: During an active session, the app uses a "Foreground Service" to ensure data is not lost if you use other apps or put the phone in your pocket. You will see a persistent notification when this is active. 
  • Silent Idle Mode: When you are not in an active recording session, the app enters a "Silent" state. It removes all location and geofencing requests from the mobile operating system, resulting in zero location tracking and zero background battery drain while idle. 
     

4. Why do we collect this data? 

The collected data is used exclusively for: 

  • Academic Research: Analyzing behavior in leisure, tourism, and mobility settings. 
  • Visualization: Mapping trajectories on secure Experience Lab dashboards to 
    understand spatial flows. 
  • Technical Integrity: Debugging sensor accuracy and ensuring data synchronization. 

We do not sell your data, use it for advertising, or share it with commercial third-party cloud platforms (e.g., Google, Meta). 


5. Data storage and security 

  1. Buffered Memory: To protect battery life and security, data is stored in the device’s temporary memory (RAM) and not as permanent files on the phone's storage. 
  2. Real-Time Sync: Data is transmitted every 60 seconds via an encrypted connection to a private, secure SQL server managed by the BUas Experience Lab. 
  3. Restricted Access: Only authorized BUas researchers and staff have access to the raw data. 
  4. Retention: Pseudonymized data is retained for the duration of the research project and archived for up to 10 years for academic validation. Afterward, it is destroyed or fully anonymized. 


6. Your rights

Participation is entirely voluntary. Under the GDPR, you have the right to: 

  • Access: Request a copy of the data collected under your Participant Code. 
  • Deletion: Request the removal of your data. Note: You must provide your Participant Code (e.g., P001) so we can locate your records. 
  • Withdrawal: Stop participation at any time by stopping the recording or deleting the app. 


7. Contact & complaints 

For questions or to exercise your rights, please contact the research team: 

Breda University of Applied Sciences 
Attn: Experience Lab / Prof. Dr. M. Bastiaansen 
Mgr. Hopmansstraat 2, 4817 JS Breda, The Netherlands 
Email: [email protected] 


If you are dissatisfied with how your data is handled, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).