Privacy Policy

III. Use of our online offer

1. Contacting us

When you contact us (e.g. online contact form, via our chat function, e-mail, telephone or via social media) and as part of an existing customer and business relationship with us, your data will be processed to the extent necessary to respond to your contact enquiry and any requested measures. 

Regardless of the selected communication method, we collect the content of your enquiry (e.g. entries in online contact forms, including first and last name, email address, availability, desired workshop room). 

We process your data for the following purposes: individual communication with you, administration and answering of enquiries, feedback (e.g. obtaining feedback via online forms), provision of our online offer and user-friendliness. 

We process your data to safeguard our legitimate interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR to respond appropriately to contact enquiries. If you inquire about an offered product or service, the processing is carried out for the purpose of pre-contractual measures in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR. 

2. Newsletter / e-mail marketing

You have the option of subscribing to our newsletter. Our newsletter will keep you informed about us and our offers. Your e-mail address is required to subscribe to the newsletter. If you register for the newsletter, your e-mail address will be transmitted to us (or our e-mail provider) and stored there. After registering, you will receive an e-mail to confirm your registration ("double opt-in").  

Our newsletter is sent on the basis of your prior express consent, Art. 6 para. 1 sentence 1 lit. a GDPR. Unsubscribing from the newsletter is possible at any time and can be done either by sending a message to the contact options described in this privacy policy or via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your email address from the recipient list, unless you have expressly consented to further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this privacy policy. 

If we receive your e-mail address in connection with the sale of a product or service and you have not objected to this, we reserve the right to regularly send you offers for similar products or services to those you have already purchased / ordered from our range by e-mail on the basis of § 7 para. 3 of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG). This serves to safeguard our legitimate interest in carrying out direct marketing, which predominates in the context of a balancing of interests, Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to this use of your e-mail address at any time by sending a message to the contact options described in this privacy policy or via a link provided for this purpose in the marketing e-mail (see also below on the right to object), without incurring any costs other than the transmission costs according to the basic tariffs.  

3. Job application

You can apply for open positions by e-mail or via our career portal. In order to process your application, we collect the data you provide (usually: first and last name; e-mail address; telephone number; application documents such as certificates and CV; earliest possible starting date).  

We use the Personio software from Personio GmbH, Rundfunkplatz 4, 80335 Munich to provide our career portal at https://smartvillage.jobs.personio.de/ and to manage applications.  

If you apply via our career portal, the data entered in the input mask will be transmitted to Personio and stored there. We have concluded a data processing agreement (DPA) with Personio. Your application data will be stored by Personio in encrypted form within Germany or the European Union (EU) and transmitted securely. If Personio works with sub-processors whose parent company is based outside the EU, the adequacy decision for the USA (EU-US Data Privacy Framework, DPF) applies to US companies certified under the EU-US Data Privacy Framework. In addition, Personio and its sub-processors have entered into standard contractual clauses (SCCs) and implemented additional safeguards, including encrypting the data with a master encryption key created by Personio. 

Further information on data processing by Personio can be found in Personio's privacy policy. 

The legal basis for the processing of your application documents and data is Art. 6 para. 1 sentence 1 lit. b and Art. 88 para. 1 GDPR in conjunction with § 26 para. 1 sentence 1 of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). We process your data exclusively for the purpose of handling the application process and for the implementation of pre-contractual measures. 

We store your personal data from the time we receive your application. If your application is accepted and an employment relationship is established, we will store your application data for as long as it is required for the processing of the employment relationship and for as long as there are statutory retention obligations. In the event of a rejection, we will store your data for a maximum of three months after the rejection, unless you give us your consent to store it for longer. With your separate consent, we will store your data submitted as part of the application in our applicant pool for a further twelve months in order to be able to offer you any suitable job offers. The data will then be deleted. You can withdraw your consent at any time using the contact options described in this privacy policy. 

IV. Use of service providers

As part of our business activities and to provide certain services, we use service providers as processors. This includes areas such as marketing, customer support, the display of videos, the operation of the website (including the cookie consent banner, security and provision of the website), application management (see also the "Job application" section) and others. We have concluded data processing agreements (DPAs) with the respective service providers. When transferring your data to third countries, we ensure that an appropriate level of protection is guaranteed. This is done either by recognising the countries concerned as safe by the EU (adequacy decision), specific approved contracts (standard contractual clauses, SCCs) or, if necessary, by obtaining your express consent.  

1. Tracking and analysis services

a. Google Analytics

If you have given your consent, Google Analytics, a web analysis service, is used on this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. 

This service creates pseudonymised user profiles and uses cookies (see under "Cookies"). The information generated by the cookie about your use of this website (browser type/version, operating system used, time of the server request, referrer URL (the previously visited page), host name of the accessing computer (IP address)) is transmitted to a Google server in the USA and stored there.  

Google processes the data in the USA. The data is used to analyse the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and the needs-based design of this website. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data. The IP addresses are anonymised so that they cannot be assigned (IP masking). 

The following applies to the transfer of data to the USA: Google is certified under the EU-US Data Privacy Framework (DPF) and has undertaken to comply with the European data protection principles. In addition, we have concluded EU standard contractual clauses (SCCs) with Google in accordance with Art. 46 para. 2 lit. c GDPR, which ensure compliance with the EU level of data protection. 

The use of Google Analytics is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. You can withdraw your consent at any time by clicking on the icon at the right bottom of the screen and making the desired settings in the cookie consent banner that opens.   

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en.  

Further information on data processing by Google can be found in Google's privacy policy.  

b. Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.  

Google Tag Manager allows us to manage tags used for tracking and marketing via a single interface. It allows us to quickly deploy and update JavaScript and HTML tags on our website.  

The Google Tag Manager itself does not store any cookies in your browser and does not collect any data. Its main function is to provide and manage tags that can be used to implement and analyse other services such as Google Analytics. These services may in turn collect data as described in this privacy policy (see under "Google Analytics"). 

Further information on Google Tag Manager can be found here. Further information on data processing by Google can be found in Google's privacy policy.  

c. Hotjar

Our website uses the Hotjar analytics service. The provider is Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta.  

We use Hotjar to better understand the needs of our users and to optimise the offer and experience on this website. Hotjar's technology gives us a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click on, what they like and dislike, etc.) and this helps us to tailor our offering to our users' feedback.  

Hotjar works with cookies and other technologies (see under "Cookies") to collect data about the behaviour of our users and their end devices, in particular IP address of the device (is only recorded and stored in anonymised form during your use of the website), screen size, device type (unique device identifiers), information about the browser used, location (country only), preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymised user profile.  

Hotjar is used on the basis of your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. You can revoke your consent at any time by clicking on the icon at the right bottom of the screen and making the desired settings in the cookie consent banner that opens.   

Further information on data processing by Hotjar can be found in Hotjar's privacy policy. 

2. HubSpot and HubSpot Forms

We use the HubSpot and HubSpot Forms service on our website. The provider is HubSpot Inc, 25 First Street, 2nd Floor, Cambridge, MA 02141, USA. 

HubSpot is an integrated software solution that we use to cover various aspects of our online marketing. This includes our website content management (CMS), email marketing, reporting, social media publishing, contact management (CRM), as well as the provision of any landing pages and contact forms. 

HubSpot uses cookies to analyse and optimise user behaviour on our website (see under "Cookies"). These cookies enable us to collect information about the use of our website, such as pages visited, length of stay and links used. This data helps us to improve our website and our marketing measures.  

By using HubSpot Forms, you can fill out contact forms on our website. The data you enter will be stored on HubSpot's servers. We use this information to contact you and process your enquiry. All data submitted by you will be processed in accordance with our privacy policy and HubSpot's data protection guidelines. 

We use HubSpot on the basis of your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. You can withdraw your consent at any time by clicking on the icon at the right bottom of the screen and making the desired settings in the cookie consent banner that opens. We use HubSpot Forms on the basis of our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, whereby our legitimate interest lies in the provision of any contact forms and simplified communication with interested parties. We would like to point out that when using HubSpot Forms, there is no personal tracking as with HubSpot itself. 

As HubSpot is headquartered in the USA, your data will be processed on servers in the USA. Hubspot is certified under the EU-US Data Privacy Framework (DPF) and has undertaken to comply with European data protection principles. In addition, we have concluded EU standard contractual clauses (SCCs) with Google in accordance with Art. 46 para. 2 lit. c GDPR, which ensure compliance with the EU data protection level. 

Further information on data processing by Google can be found in Hubspot's privacy policy.   

3. Statamic

Our website uses the Statamic cookie consent management tool for the purpose of consent management. The provider is Statamic, LLC, 260 Williamson Blvd Ormond Beach, FL 32174. This tool sets a technically necessary cookie to store your cookie consent (see under "Cookies").  

The cookie stores the consent you gave when you entered the website. If you wish to revoke this consent, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked for your cookie consent again.  

The legal basis for data processing is § 25 para. 2 TDDDG and Art. 6 para. 1 sentence 1 lit. c GDPR. Statamic is used to obtain the legally required consents for the use of technically unnecessary cookies and to prove the corresponding consents (cf. Art. 7 para. 1, Art. 5 para. 2 GDPR). The aim is to know the preferences of our users and to implement them accordingly and to document them for verification purposes. 

[if applicable: As Statamic is headquartered in the USA, your data will be processed in the USA. We have concluded EU standard contractual clauses (SCCs) with Statamic in accordance with Art. 46 para. 2 lit. c GDPR, which ensure compliance with the EU level of data protection]. 

Further information on data processing by Statamic can be found in Statamic's privacy policy.  

4. Embedding of YouTube videos

We embed videos from the YouTube video platform on our website that are not stored on our servers. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. 

Accessing our pages with embedded videos leads to the reloading of content from YouTube. As a result, YouTube receives the information that you have visited our website, as well as the technically necessary usage data. We have no influence on further data processing by YouTube. The videos are embedded on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR and in our overriding legitimate interest in making our website as appealing and informative as possible. 

Your data may be transferred to countries outside the EU, in particular to the USA. Google is certified under the EU-US Data Privacy Framework (DPF) and is committed to complying with European data protection principles. In addition, we have concluded EU standard contractual clauses (SCCs) with Google in accordance with Art. 46 para. 2 lit. c GDPR, which ensure compliance with the EU data protection level. 

Further information on data processing by YouTube can be found in the privacy policy of YouTube or Google.  

V. Social Media

We have various online presences on social media platforms. We operate these sites with the following providers:  

• LinkedIn, LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland; Website: https://de.linkedin.com/; Privacy Policy: https://www.linkedin.com/legal/privacy-policy    

• YouTube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Website: https://www.youtube.com/; Privacy Policy: https://policies.google.com/privacy  

• Facebook, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com/; Privacy Policy: https://www.facebook.com/privacy/explanation   

• Instagram, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.instagram.com/; Privacy Policy: https://help.instagram.com/519522125107875    

We use the technical platform and services of the respective providers for these information services. We would like to point out that you use our presence on social media platforms and their functions at your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, rating, sharing). 

When you visit our social media accounts, the platform providers collect your IP address and other information that is stored on your device in the form of cookies. This information is used to provide us, as the operator of the accounts, with statistical information about your interactions with our posts. The data collected about you is processed by the platforms and may be transferred to countries outside the EU, in particular to the USA. 

All of the above providers are certified under the EU-US Data Privacy Framework (DPF) and have undertaken to comply with the European data protection principles. In addition, we have concluded EU standard contractual clauses (SCCs) with these providers in accordance with Art. 46 para. 2 lit. c GDPR, which ensure compliance with the EU level of data protection.  

We do not know how the social media platforms use the data from your visit to our account and your interactions with our posts for their own purposes, how long this data is stored and whether it is passed on to third parties. Data processing may differ depending on whether you are registered and logged in to the social network or visit the site as a non-registered and/or non-logged-in user. When you access a post or our account, the IP address assigned to your end device is transmitted to the provider of the social media platform. If you are currently logged in, a cookie on your device can be used to track your online behaviour. Via buttons integrated into websites, the platforms can record your visits to these websites and assign them to your profile in order to offer you targeted content or advertising. To avoid this, you should log out, deactivate the "stay logged in" function, delete the cookies on your device and restart your browser. 

As the provider of the information service, we also only process the data that you make available to us in the context of using our service and that require interaction. For example, if you ask us a question that we can only answer by email, we will store your information in accordance with the general principles of our data processing, which are described in this privacy policy. The legal basis for the processing of your data on the social media platform is Art. 6 para. 1 sentence 1 lit. f GDPR. 

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us. 

The providers of the social media platforms explain in their privacy policies what information they receive and how it is used. These policies (see links above) also contain information on contact options and the setting options for advertising.

C. Storage and deletion of data

The data processed by us will be deleted in accordance with the statutory provisions as soon as your consent to data processing is withdrawn or if the purpose for processing this data no longer applies or the data is no longer required for the purpose. This means that we only store your personal data for as long as is necessary for the respective processing purpose and limit the storage period to the required minimum. In addition, we only store your data if we are authorised or obliged to do so in accordance with the statutory retention periods. 

D. Your rights as a data subject

You have the right to 

• Information according to Art. 15 GDPR,  

• Rectification in accordance with Art. 16 GDPR, 

• Erasure in accordance with Art. 17 GDPR, 

• Restriction of processing in accordance with Art. 18 GDPR, 

• Objection under Art. 21 GDPR (on the right to object, see below) and 

• Data portability from Art. 20 GDPR. 

As already mentioned in the relevant sections of this privacy policy, you can also withdraw any consent given for the processing of personal data at any time. The withdrawal can be made through the contact options described in this privacy policy. Please note that the withdrawal only takes effect for the future. Processing that occurred before the withdrawal is not affected by this.  

In addition, you have a right to complain to a data protection supervisory authority about the processing of your personal data in accordance with Art. 77 GDPR in conjunction with § 19 BDSG.  

To exercise your above rights, you can contact the contact options described in this privacy policy. 

E. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. (e) or (f) GDPR; this also applies to profiling based on this provision within the meaning of Art. 4 (4) GDPR. 

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. 

The objection can be made via the contact options described in this privacy policy. 

F. Data processing when accessing linked content

This website may contain external links or hyperlinks to websites of other providers. These are to be distinguished from our own content. This external content does not originate from us, and we have no influence on the content of third-party websites. If you are redirected to other sites via links on the website, please inform yourself there about the respective handling of your data. 

G. Automated decision making / profiling

No automated decision-making or profiling takes place. 

H. Changes to this privacy policy

Due to the further development of our website and our online offer or due to changed legal and official requirements, it may become necessary to adapt this data protection declaration from time to time.  

If you have any questions regarding the processing of your data, you can contact us at any time.