Privacy policy

1. Controller

SMD GmbH, Detmolder Str. 67, 33175 Bad Lippspringe, Germany. E-mail info@smd-tech.de, telephone +49 176 6486 0639.

2. Visiting this website

When you open a page, our hosting provider processes the connection data that is technically necessary: IP address, time of access, the file requested, the volume of data transferred, the browser identifier and the page you came from. This is required to deliver the pages and to keep the service secure. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in stable and secure operation. This data is not combined with other sources and is deleted after a short period.

The website itself sets no cookies, embeds no fonts or scripts from third-party servers and uses no analytics or tracking tools. The separate business customer shop sets one technically necessary session cookie (see section 6).

Hosting: the pages are delivered by Vercel Inc. and its European infrastructure. We have a data processing agreement with the provider under Article 28 GDPR. Any transfer to a third country takes place on the basis of the EU standard contractual clauses.

3. Getting in touch and forms

If you contact us through a form, by e-mail, by telephone or over WhatsApp, we process the details you give us in order to deal with your enquiry. The legal basis is Article 6(1)(b) GDPR (entering into or performing a contract), or Article 6(1)(f) GDPR for other matters.

Mandatory fields are marked as such; without those details we cannot deal with the enquiry. We keep enquiries for as long as we need them for processing and to meet retention periods under commercial and tax law.

To keep automated bulk submissions out, we check whether a field that is invisible to people has been filled in and how much time passed between the page loading and the form being sent. No additional personal data arises from this.

4. Warranty claims (RMA)

To handle a warranty claim we process your contact details, the document number and the device identifiers (IMEI or serial number). The legal basis is Article 6(1)(b) GDPR. The details are attached to the case and kept for the retention periods under commercial law.

5. Newsletter

To send our newsletter we process your e-mail address. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw that consent at any time — through the unsubscribe link in every e-mail or by sending us a message. Withdrawal does not affect the lawfulness of processing carried out up to that point.

Sending is handled by Brevo (Sendinblue GmbH / Brevo SAS, Paris, France) as a processor. Your e-mail address and details of the sending process are stored there. A data processing agreement is in place.

6. Business customer shop and stock API

For a business customer account we process the company name, address, VAT identification number, the name and contact details of the person we can speak to, and your orders. The legal basis is Article 6(1)(b) GDPR, and for retention additionally Article 6(1)(c) GDPR together with the retention obligations under commercial and tax law.

Verification of the VAT identification number: before we activate an account we verify the number given and the associated company name through the confirmation procedure of the European Commission (VIES) or of the German Federal Central Tax Office. The company details provided are transmitted to the competent body for this purpose. The legal basis is Article 6(1)(c) GDPR — we are obliged to carry out the check. We store the result and the consultation number as evidence.

The shop sets one technically necessary session cookie so that you stay signed in and your basket is kept. It contains no advertising identifiers and is deleted when you sign out. The legal basis is Section 25(2) no. 2 TDDDG together with Article 6(1)(b) GDPR.

We log sign-ins and changes to accounts so that we can detect misuse and trace what happened (Article 6(1)(f) GDPR).

7. WhatsApp

Our pages contain a link to WhatsApp. Your device only connects to WhatsApp Ireland Ltd. once you click it; nothing is transmitted before that. The provider is responsible for any processing inside WhatsApp — its terms and privacy notices apply. If you would rather not use it, you can reach us just as well by telephone or e-mail.

8. Disclosure to third parties

We pass your data on only where it is necessary to perform the contract (to a carrier, for example), where we are legally obliged to do so, or where you have consented. We do not sell data.

9. Your rights

You have the right of access (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20) and to object to processing based on legitimate interests (Article 21 GDPR). You can withdraw consent you have given at any time.

Please write to info@smd-tech.de to exercise these rights. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

10. Changes

We update this policy when our processing changes. The version published on this page is the one that applies.