Experience Lab Data Collector Privacy Statement

Version: 1.2
Effective Date: March 25, 2026
This privacy statement describes the guidelines for information processing carried out by
the Experience Lab of Breda University of Applied Sciences (BUas) when you use the
Experience Lab Data Collector application (formerly MyBUas Route).
This statement is in accordance with the General Data Protection Regulation (GDPR) and
the guidelines of the BUas Research Ethics Advice and Assessment Committee.

Pseudonymization & privacy?

To protect your privacy, we prioritize pseudonymization and data minimization.

• No Personal Login: The app does not require an email address, name, or password.
• Participant Codes: Data is collected under a unique alphanumeric code (e.g.,
  “P001”) assigned to you.
• Hardware Privacy: A unique hardware identifier (UUID) is generated and stored in a
  private registry on our server to manage your session. This identifier is kept separate
  from the actual research logs to ensure that your physical device cannot be easily
  linked to your specific movements by unauthorized parties.
• Separation of Data: Your identity is never linked to the sensor data within the
  application database.

What data do we process?

We process categories of data that are strictly necessary to analyze spatial behavior and
experience. Broad or anonymized data is insufficient for our research questions regarding
precise mobility patterns.
Mobility and Sensor Data

• Location Data (GPS): Precise latitude, longitude, altitude, speed, and accuracy
  radius.
• Motion Data (Accelerometer): High-frequency 3-axis G-force data to analyze
  movement intensity and physical activity.
• Proximity Data (Bluetooth Beacons): When enabled for a project, the app detects
  nearby Bluetooth iBeacons to determine your proximity to specific points of interest
  or indoor locations.
• Timestamps: The exact UTC time recorded for every sensor event.
  Research Context
• Zone Markers: The app records if you are within a predefined research boundary
  (Geofence).
• Device Metadata: The model of your phone (e.g., “Pixel 9”) is recorded to help
  researchers calibrate sensor sensitivity.

How do we collect data?

Our application is designed for active research sessions only.

• Explicit Start/Stop: Data collection only begins when you tap “Start” and ceases
  immediately when you tap “Stop” or when a predefined project time limit is reached.
• Persistent Recording: During an active session, the app uses a “Foreground
  Service” to ensure data is not lost if you use other apps or put the phone in your
  pocket. You will see a persistent notification when this is active.
• Silent Idle Mode: When you are not in an active recording session, the app enters a
  “Silent” state. It removes all location and geofencing requests from the mobile
  operating system, resulting in zero location tracking and zero background battery
  drain while idle.

Why do we collect this data?

The collected data is used exclusively for:

• Academic Research: Analyzing behavior in leisure, tourism, and mobility settings.
• Visualization: Mapping trajectories on secure Experience Lab dashboards to
  understand spatial flows.
• Technical Integrity: Debugging sensor accuracy and ensuring data synchronization.
  We do not sell your data, use it for advertising, or share it with commercial third-party
  cloud platforms (e.g., Google, Meta).

Data storage and security

• Buffered Memory: To protect battery life and security, data is stored in the device’s
  temporary memory (RAM) and not as permanent files on the phone’s storage.
• Real-Time Sync: Data is transmitted every 60 seconds via an encrypted connection
  to a private, secure SQL server managed by the BUas Experience Lab.
• Restricted Access: Only authorized BUas researchers and staff have access to the
  raw data.
• Retention: Pseudonymized data is retained for the duration of the research project
  and archived for up to 10 years for academic validation. Afterward, it is destroyed or
  fully anonymized.

Your rights

Participation is entirely voluntary. Under the GDPR, you have the right to:

• Access: Request a copy of the data collected under your Participant Code.
• Deletion: Request the removal of your data. Note: You must provide your Participant
  Code (e.g., P001) so we can locate your records.
• Withdrawal: Stop participation at any time by stopping the recording or deleting the
  app.

Contact & complaints

For questions or to exercise your rights, please contact the research team:
Breda University of Applied Sciences
Attn: Experience Lab / Prof. Dr. M. Bastiaansen
Mgr. Hopmansstraat 2, 4817 JS Breda, The Netherlands
Email: ExperienceLab@buas.nl
If you are dissatisfied with how your data is handled, you have the right to file a complaint
with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).