Privacy Policy for the NCM App

Last updated: 9 October 2026

The NCM app (the “App”) connects your phone or tablet directly to a Codebeamer server that you choose. NANGA SYSTEMS GmbH never receives your Codebeamer content or your login credentials, and the App contains no analytics, advertising or tracking. This policy explains the few cases in which we do process personal data, and your rights.

1. Who is responsible

Controller for the processing described in this policy:

NANGA SYSTEMS GmbH
Königstraße 27, 70173 Stuttgart, Germany
Phone: +49 800 800 1007
Email: info@nangasystems.com
Managing director: Dominik Kassel
Commercial register: Amtsgericht Stuttgart, HRB 750 626

Data protection officer:

Rainer Deyhle
Pischekstraße 9, 70184 Stuttgart, Germany
Phone: +49 176 82270097
Email: info@datenschutzbeauftragter-dsgvo-stuttgart.de

This policy covers the App only. Our website has its own privacy policy at nangasystems.com.

2. How the App works and who is responsible for your Codebeamer data

The App is a mobile client for PTC Codebeamer. You sign in to a Codebeamer server that is usually operated by your employer, a customer or another organisation (“your organisation”).

• Direct connection. Everything you see and do in Codebeamer through the App (projects, trackers, items, wiki pages, comments, attachments, reviews, test runs, and the names and email addresses of other Codebeamer users) travels directly between your device and that server. It does not pass through any NANGA server, and we have no access to it.
• Your organisation is responsible for that data. The operator of the Codebeamer server is the controller for all content stored on it and for the logs it keeps. For questions about that data, or to exercise your rights regarding it, please contact your organisation.
• NANGA is responsible only for the processing described in sections 3, 4, 5 and 7 below. If you connect to a Codebeamer server that NANGA itself operates (for example a demo system), NANGA is also the controller for the data on that server.

You are not obliged by law to provide any personal data. Without a server address and credentials, however, the App cannot connect to Codebeamer, and without the purchase data described in section 4 we cannot provide paid features.

3. Data stored only on your device

To work, the App stores some information on your device. None of it is sent to NANGA, except for the push data described in section 6 where NANGA operates the push gateway.

Storing and reading this information on your device is strictly necessary to provide the App you asked to use (§ 25(2) no. 2 TDDDG). Any further processing is based on Art. 6(1)(b) GDPR (performance of the contract with you) or, where you use the App for your organisation, on Art. 6(1)(f) GDPR (our legitimate interest in providing a working app).

Depending on your device’s backup settings, the operating system may include App data in backups managed by Apple or Google. We recommend using a revocable Codebeamer API token instead of your password.

4. Subscriptions and in-app purchases

App Store and Google Play. You buy subscriptions through Apple’s App Store or Google Play. Apple or Google processes your payment and account data as an independent controller under its own privacy policy (Apple, Google). We do not receive your name, email address or payment details.

RevenueCat. To check whether you have an active subscription and which edition it covers, we use RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, as our processor (Art. 28 GDPR). RevenueCat processes:

• a random App user ID created by the App, which is not linked to your name, email address or Codebeamer account
• store transaction and receipt data: product, price, currency, store country, purchase, renewal and expiry dates, trial status, cancellations and refunds
• technical data: IP address, operating system and version, App version and device language

Purpose: providing the paid features of your edition, restoring purchases on a new device, handling renewals, cancellations and refunds, and our accounting. Legal basis: Art. 6(1)(b) GDPR, and for accounting records Art. 6(1)(c) GDPR together with German commercial and tax law.

RevenueCat processes data in the USA. The transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of our data processing agreement with RevenueCat. You can request a copy from us.

We keep subscription data for as long as your subscription is active and then for as long as German commercial and tax law requires us to keep accounting records (up to ten years). The App does not access your device’s advertising identifier, and we do not use purchase data for advertising.

5. Enterprise licences

If your organisation has bought an Enterprise licence from us, the licence key is checked on your device without contacting NANGA. To conclude and perform the licence agreement, we process the business contact details of your organisation’s contact persons, the licensed server names and the licence term (Art. 6(1)(b) GDPR towards the contracting party, otherwise Art. 6(1)(f) GDPR). We keep this data for the duration of the agreement and then for the statutory retention periods.

6. Push notifications (Enterprise edition only)

Push notifications are off by default. They are only available if your organisation operates a push gateway for its Codebeamer server and you switch them on in the App’s settings and allow notifications in your operating system.

When you switch push on, the App sends the following to the push gateway configured by your organisation:

• the push token of your device and its platform (iOS or Android)
• the address of your Codebeamer server and your Codebeamer username
• the list of projects you have chosen to follow

The gateway watches your Codebeamer server for changes and delivers notifications through the Apple Push Notification service (Apple Inc.) or Firebase Cloud Messaging (Google). A notification contains only technical identifiers (item ID, tracker ID and type of change), never item titles or content. When you tap it, the App loads the details directly from your Codebeamer server.

The push gateway is operated by your organisation, or by NANGA on your organisation’s behalf under a data processing agreement. In both cases your organisation is the controller for this processing. Apple and Google process the push token and notification data to deliver notifications and may transfer it to the USA, on the basis of the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.

You can switch push off at any time in the App’s settings or in your device’s notification settings. Signing out removes your device from the gateway.

7. Support and diagnostic logs

While the App is running, it keeps a log of technical events in working memory: errors, warnings, and failed or completed server requests (method, address path without query parameters, status code and duration). The log contains no passwords, tokens or item content. Credential-like strings are removed again before any export. Request paths can contain the numeric IDs of Codebeamer items, trackers or projects.

The App never sends this log anywhere on its own. Only when you tap Share diagnostic logs does it create a text file. That file also contains the App version, device model, operating system version, WebView version and the host name of your Codebeamer server. You decide whether, how and to whom you send it.

If you send us the log or contact our support, we process your message, your contact details and any attached log to handle your request. Legal basis: Art. 6(1)(b) GDPR where the request relates to a contract with you or your organisation, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering support requests). We delete this data once your request is closed, unless statutory retention periods apply.

8. Device permissions

The App only asks for a permission when you use the feature that needs it. You can withdraw any permission at any time in your device settings.

Photos and images are uploaded as they are. Depending on your camera settings, they may contain metadata such as the time and place the photo was taken.

9. Links and the in-app browser

Links to external websites, for example in wiki pages or item fields, open in an in-app browser window or in another app. The operator of that website is responsible for the data processed there.

Content on your Codebeamer server, such as comments or wiki pages, can contain images hosted on other websites. When the App displays that content, your device loads those images directly from the other website, which receives your IP address. The operator of that website is responsible for this processing.

10. What the App does not do

• no analytics, usage statistics or crash reporting services built into the App
• no advertising and no tracking across apps or websites
• no access to your device’s advertising identifier, contacts or location
• no sale or sharing of personal data for marketing
• no automated decision-making or profiling within the meaning of Art. 22 GDPR

Apple and Google may give us aggregated statistics and crash reports from users who have agreed in their device settings to share such data with app developers. We cannot link these reports to you. Apple and Google are responsible for this under their own privacy policies.

11. Security

The App stores credentials and licence keys only in the encrypted secure storage of your operating system and never writes them to ordinary App storage or to logs. Data is transferred encrypted when your Codebeamer server uses HTTPS. Please only connect to servers that use HTTPS, protect your device with a screen lock and sign out on shared devices.

12. Children

The App is a professional tool and is not directed at children under 16. We do not knowingly process data of children.

13. Your rights

Under the GDPR you have the following rights regarding the personal data we process:

• access to your data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of any consent you have given, with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, contact us or our data protection officer using the details in section 1. Because the App works without a NANGA account, we often cannot identify you on our own (Art. 11 GDPR). Please include information that helps us find your data, for example the order number from your App Store or Google Play receipt.

For your Codebeamer data, please contact the operator of your Codebeamer server, because we have no access to that data.

Right to lodge a complaint: You can complain to a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place. The authority responsible for NANGA is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

14. Changes to this policy

We update this policy when the App or the legal situation changes. The current version is always available in the App and on our website. The date at the top shows when it was last changed.