Privacy Policy

This English version of our privacy policy is provided for convenience only. In the event of any discrepancy between the German and the English version, the German version shall prevail.

Preamble

With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to as “data”) we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).

The terms used are not gender-specific.

‍

‍

Controller

SmartConnect Technologies GmbH
Kronackerring 35
35260 Stadtallendorf, Germany

‍

‍

Overview of Processing

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

‍

‍

Types of Data Processed

• Master data
• Payment data
• Contact data
• Content data
• Contract data
• Usage data
• Meta, communication and procedural data.

‍

Categories of Data Subjects

• Customers
• Prospective customers
• Communication partners
• Users
• Business and contractual partners.

‍

‍

Purposes of Processing

• Provision of contractual services and customer service
• Contact requests and communication
• Security measures
• Office and organisational procedures
• Management of and responses to enquiries
• Feedback
• Marketing
• Provision of our online offering and user-friendliness
• Information technology infrastructure.

‍

‍

Relevant Legal Bases

Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or registered office. If more specific legal bases apply in individual cases, we will inform you of these in this privacy policy.

• Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• Legal obligation (Art. 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject
• Legitimate interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include in particular the Act on the Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act, BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transfers as well as automated individual decision-making, including profiling. It also governs data processing for employment purposes (Section 26 BDSG), in particular with regard to establishing, carrying out or terminating employment relationships and the consent of employees. Furthermore, the data protection laws of the individual German federal states may apply.

‍

‍

Security Measures

In accordance with the statutory requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, disclosure, availability and separation of the data. Furthermore, we have established procedures that ensure that data subjects’ rights are exercised, data is erased and threats to the data are responded to. We also take the protection of personal data into account when developing or selecting hardware, software and procedures, in line with the principles of data protection by design and by default.

TLS encryption (https): To protect the data you transmit via our online offering, we use TLS encryption. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

‍

‍

Transfer of Personal Data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we comply with the statutory requirements and, in particular, conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

Data transfers within the organisation: We may transfer personal data to other units within our organisation or grant them access to this data. Where this transfer takes place for administrative purposes, it is based on our legitimate business and commercial interests, or it takes place where it is necessary to fulfil our contractual obligations or where the data subjects have given their consent or there is a legal permission.

‍

‍

Data Processing in Third Countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if processing takes place in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies, this is done only in accordance with the statutory requirements.

Subject to express consent or a transfer required by contract or by law, we process data, or have it processed, only in third countries with a recognised level of data protection, on the basis of a contractual obligation through the so-called standard contractual clauses of the EU Commission, where certifications exist or on the basis of binding corporate rules (Art. 44 to 49 GDPR; information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).

‍

‍

Erasure of Data

The data we process will be erased in accordance with the statutory requirements as soon as the consents permitting its processing are withdrawn or other permissions cease to apply (e.g. if the purpose of processing this data no longer applies or the data is not necessary for the purpose). If the data is not erased because it is required for other, legally permissible purposes, its processing will be restricted to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law, or whose storage is necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Our data protection notices may also contain further information on the retention and erasure of data that takes precedence for the respective processing operations.

‍

‍

Business Services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”), in the context of contractual and comparable legal relationships and associated measures, and in the context of communication with contractual partners (or pre-contractually), e.g. to answer enquiries.

We process this data in order to fulfil our contractual obligations. These include in particular the obligations to provide the agreed services, any obligations to update and remedies in the event of warranty claims and other service disruptions. In addition, we process the data to safeguard our rights and for the purposes of the administrative tasks associated with these obligations and of business organisation. Furthermore, we process the data on the basis of our legitimate interests in proper and economic business management and in security measures to protect our contractual partners and our business operations against misuse and against threats to their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only pass on contractual partners’ data to third parties to the extent that this is necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners are informed about further forms of processing, e.g. for marketing purposes, within this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We erase the data after the expiry of statutory warranty and comparable obligations, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. for as long as it must be retained for legal archiving reasons. The statutory retention period is ten years for documents relevant under tax law as well as for commercial books, inventories, opening balance sheets, annual financial statements, the work instructions and other organisational documents required to understand these documents, and accounting vouchers, and six years for commercial and business letters received and copies of commercial and business letters sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, opening balance sheet, annual financial statements or management report was drawn up, the commercial or business letter was received or sent, or the accounting voucher was created, or in which the record was made or the other documents were created.

Where we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply to the relationship between the users and the providers.

• Types of data processed: master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email, telephone numbers); contract data (e.g. subject matter of the contract, term, customer category).
• Data subjects: prospective customers; business and contractual partners.
• Purposes of processing: provision of contractual services and customer service; contact requests and communication; office and organisational procedures; management of and responses to enquiries.
• Legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

• Provision of software and platform services: We process the data of our users, registered users and any test users (hereinafter uniformly referred to as “users”) in order to provide our contractual services to them and, on the basis of legitimate interests, to ensure the security of our offering and to develop it further. The required information is marked as such when the order, purchase or comparable contract is concluded and includes the information needed to provide and invoice the services as well as contact information so that we can follow up if necessary; legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).

‍

‍

Providers and Services Used in the Course of Business

In the course of our business, and in compliance with the statutory requirements, we use additional services, platforms, interfaces or plug-ins from third-party providers (“services” for short).

• Types of data processed: master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); contract data (e.g. subject matter of the contract, term, customer category)
• Data subjects: customers; prospective customers; users; business and contractual partners
• Purposes of processing: provision of contractual services and customer service; office and organisational procedures
• Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

‍

‍

Provision of the Online Offering and Web Hosting

We process users’ data in order to provide our online services to them. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status); content data (e.g. entries in online forms)
• Data subjects: users (e.g. website visitors, users of online services)
• Purposes of processing: provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures
• Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

• Provision of the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also called a “web host”); legal bases: legitimate interests (Art. 6(1)(f) GDPR).
• Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, a notification of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, e.g. to avoid overloading the servers (especially in the event of abusive attacks, so-called DDoS attacks), and to ensure the utilisation and stability of the servers; legal bases: legitimate interests (Art. 6(1)(f) GDPR); erasure of data: log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is required for evidence purposes is excluded from erasure until the respective incident has been finally resolved.
• Content delivery network: We use a “content delivery network” (CDN). A CDN is a service that helps deliver the content of an online offering, in particular large media files such as graphics or program scripts, faster and more securely by means of regionally distributed servers connected via the internet; legal bases: legitimate interests (Art. 6(1)(f) GDPR).

‍

‍

Contact and Enquiry Management

When you contact us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information provided by the persons making the enquiry is processed to the extent necessary to answer the contact requests and carry out any requested measures.

• Types of data processed: contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status)
• Data subjects: communication partners
• Purposes of processing: contact requests and communication; management of and responses to enquiries; feedback (e.g. collecting feedback via an online form); provision of our online offering and user-friendliness
• Legal bases: legitimate interests (Art. 6(1)(f) GDPR); performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR)

Further information on processing operations, procedures and services:

Contact form: When users contact us via our contact form, email or other communication channels, we process the data provided to us in this context in order to handle the matter communicated; legal bases: performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

‍

‍

Plug-ins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may be, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content”).

Integration always requires that the third-party providers of this content process the users’ IP address, as they could not send the content to the users’ browsers without it. The IP address is therefore required to display this content or these functions. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to analyse information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the users’ devices and may contain, among other things, technical information about the browser and operating system, referring websites, the time of the visit and other information about the use of our online offering, and may also be combined with such information from other sources.

• Types of data processed: usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status)
• Data subjects: users (e.g. website visitors, users of online services)
• Purposes of processing: provision of our online offering and user-friendliness
• Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

Google Fonts (obtained from the Google server): Fonts (and symbols) are obtained for the purpose of a technically secure, maintenance-free and efficient use of fonts and symbols with regard to currency and loading times, their uniform display and consideration of possible licensing restrictions. The user’s IP address is communicated to the provider of the fonts so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted that is necessary to provide the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA. When users visit our online offering, their browsers send HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving the fonts). The Google Fonts Web API provides users with the Google Fonts cascading style sheets (CSS) and then with the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the internet, (2) the requested URL on the Google server and (3) the HTTP headers, including the user agent, which describes the browser and operating system versions of the website visitors, and the referrer URL (i.e. the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers, and they are not analysed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how often a particular font family is requested. With the Google Fonts Web API, the user agent must adapt the font generated for the respective browser type. The user agent is logged primarily for debugging and used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the “Analytics” page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and an aggregated report on the top integrations based on the number of font requests can be generated. According to Google, it does not use any of the information collected by Google Fonts to create profiles of end users or to serve targeted ads; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: legitimate interests (Art. 6(1)(f) GDPR); website: https://fonts.google.com/; privacy policy: https://policies.google.com/privacy; further information: https://developers.google.com/fonts/faq/privacy?hl=en.

‍

‍

Changes and Updates to this Privacy Policy

We ask you to check the content of our privacy policy regularly. We will adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or another individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that addresses may change over time, and please check the information before contacting them.

‍

‍

Rights of Data Subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to access this data, as well as further information and a copy of the data in accordance with the statutory requirements.
• Right to rectification: In accordance with the statutory requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be rectified.
• Right to erasure and restriction of processing: In accordance with the statutory requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the statutory requirements, to request that the processing of the data be restricted.
• Right to data portability: In accordance with the statutory requirements, you have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller.
• Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.