Can smart-device apps collect data under contract?
Yes, where processing is necessary to deliver the service contracted with that user. Assess each purpose separately: optional analytics cannot inherit the basis used for essential functions, and app storage or access needs a separate check. Build these distinctions into your supplier brief with Cambridge China Bridge.
Start with purposes, not app permissions
Before collection starts, identify the lawful basis and explain it in the privacy information. Build a purpose register: device control, account access, fault diagnosis, product improvement and advertising should have separate entries. For each, ask the supplier what information leaves the device, where it goes and what the recipient does with it.
A phone permission screen is a useful inspection point, but it does not explain every subsequent use. Ask for a data-flow diagram covering the device, app, cloud service and embedded analytics components. Keep product security checks alongside this review using our connectable products guide.
Test whether the contractual service needs it
Contract necessity concerns the service agreed with the individual whose information you process. It does not cover that person merely because you have a contract with their employer or another purchaser. Processing must be integral to delivering the service; reasonable, less intrusive alternatives rule out this basis.
For a remote-control appliance, ask why account identifiers and command routing are needed, then challenge unrelated location collection or persistent usage histories. These are questions to investigate, not automatic classifications. Record the promised function, the proposed processing and why a less intrusive design would not reasonably deliver it.
Keep optional analytics separate
Putting analytics in the user terms does not make it necessary for the contract. Reusing customer information for your own business purposes is outside this basis. Optional product-improvement analytics therefore needs its own lawful-basis assessment, even when the same information also supports an essential function.
Ask the developer to separate operational events from optional analytics uploads. Test whether users can control the appliance with analytics disabled. If consent is the chosen basis, provide separate choices for different purposes, keep consent separate from terms, and allow refusal and easy withdrawal without detriment.
Check device access as well as later use
The ICO says storage and access technologies require consent unless a PECR exemption applies. Contract necessity for subsequent personal-information processing does not remove this separate check. Ask which app components store or read information on the phone or device, and what supports any claimed exemption.
Do not accept a blanket assurance that all diagnostics are essential or that all analytics always needs consent. Request an assessment for the actual purpose and implementation. Where health or other special category information is involved, a separate processing condition is also needed.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Make the supplier brief testable
Request a purpose register, data-flow diagram, screenshots of choices, component list and a testable app build. Agree who supplies the explanation for each processing purpose and who can change collection settings. Keep the app build and device firmware linked in your approval record; our firmware approval guide helps organise that review.
Use test accounts and simulated information to check collection before a choice, refusal, withdrawal and updates. Ask for evidence of actual transmissions, rather than screenshots alone. If staff or providers in China can access customer information, review that separately with our supplier data-sharing guide.
Frequently asked questions
Does accepting app terms cover analytics?
No. Including analytics in the terms does not establish contract necessity. Assess its purpose separately and identify an appropriate lawful basis.
Do essential app functions need consent?
Contract necessity may cover personal-information processing integral to the user's service. Storage or access technologies still need a separate PECR consent or exemption check.
Can our company contract cover employees' data?
Contract necessity does not apply merely because the contract is with their employer. Check the basis for processing each employee's information separately.
What should we ask the Chinese app supplier for?
Ask for a purpose register, data flows, collection settings, component list and a testable build. Check actual transmissions with optional analytics refused and after consent withdrawal.