Data Protection Declaration

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. On the following pages, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Thorsten Nierfeld, Smitey Inh. Thorsten Nierfeld, Einigkeitstraße 46, 45133 Essen, Germany, Phone: +49 201 36803441, e-mail: business@smitey.eu. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When You Visit Our Website

2.1 When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you:

• Our visited website
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/reference from which you came to the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

Data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1 For the hosting of our website and the presentation of the page content, we use a server of the following provider: netcup GmbH, Emmy-Noether-Strasse 10, 76131 Karlsruhe, Germany. The provider provides its services itself or through selected subcontractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers.

We have concluded an order processing contract with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties.

3.2 Bunny

We use a content delivery network offered by the following provider: BUNNYWAY d.o.o., Dunajska c. 165, 1000 Ljubljana, Slovenia

Our entire website is delivered via this network of regionally distributed servers, i.e. page content, graphics, scripts and videos, as well as our installation files and updates. The server that answers your request processes your IP address and the information listed in section 2.1. The processing is carried out to protect our legitimate interest in fast, stable and reliable delivery of our website pursuant to Art. 6 (1) point f GDPR.

We have configured the network so that only servers within the European Union deliver content. Requests from other countries are also answered by a server in the EU. Your data is not transferred to countries outside the EU in this process.

We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

4) Cookies

In order to make your visit to our website more attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. In some cases, these cookies are automatically deleted again after the browser is closed (so-called "session cookies"), in other cases, these cookies remain on your end device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the duration of the storage in the overview of the cookie settings of your web browser.

Our website only stores the following information on your device:

These items are strictly necessary to display our website as you request it (Section 25 (2) No. 2 TDDDG) and are stored without consent. Our reach measurement (section 7) does not set any cookies. If you start a purchase, Paddle's checkout opens (section 6.2), which sets its own cookies.

If personal data is also processed by individual cookies set by us, the processing is carried out either in accordance with Art. 6 (1) point b GDPR for the performance of the contract, in accordance with Art. 6 (1) point a GDPR in the case of consent given or in accordance with Art. 6 (1) point f GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser in such a way that you are informed about the setting of cookies and you can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting Us

5.1 Smitey's Ticket-System

To process customer requests, we use our own e-mail ticketing system, Smitey's Ticket-System.

If you send us requests by e-mail, these are stored and organised in the ticketing system to enable chronological processing and to improve the service experience. Each request is assigned an individual ticket number, which facilitates internal allocation and ensures complete processing.

For the organisation and processing of requests, personal data is collected according to the scope of its provision, but in any case surname, first name and e-mail address.

The legal basis for the processing of this data is our legitimate interest in the efficient design of our customer service, in answering your request as quickly as possible and in optimising our service offer in accordance with Art. 6 (1) point f GDPR.

Smitey's Ticket-System is hosted on a cloud server of the following provider: netcup GmbH, Emmy-Noether-Strasse 10, 76131 Karlsruhe, Germany

We have concluded an order processing agreement with netcup GmbH, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

5.2 When you contact us by e-mail, personal data is collected. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration.

The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR. Your data will be deleted after final processing of your enquiry; this is the case if it can be inferred from the circumstances that the facts in question have been finally clarified, provided there are no legal storage obligations to the contrary.

6) Processing of Data for the Purpose of Order Handling

6.1 Insofar as necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned credit institution in accordance with Art. 6 Para. 1 lit. b GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data (name, address, e-mail address) provided by you when placing the order in order to inform you personally by suitable means of communication (e.g. by post or e-mail) about upcoming updates within the legally stipulated period of time within the framework of our statutory duty to inform pursuant to Art. 6 Para. 1 lit. c GDPR. Your contact details will be used strictly for the purpose of informing you about updates owed by us and will only be processed by us for this purpose to the extent that this is necessary for the respective information.

In order to process your order, we also work together with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

6.2 Use of Payment Service Providers

• Paddle

A checkout system from the following provider is available on this website: Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London, EC1V 8BT, United Kingdom

When you initiate the ordering process, you will be redirected to a web interface operated by the provider, where you can complete and pay for the order by entering your billing and delivery address and your payment details. The provider is originally responsible for collecting this data and processes the payment in its own name.

After placing and paying for the order, the provider transmits the order data and transaction details to us in accordance with Art. 6 para. 1 lit. b GDPR to the extent necessary for contract processing so that we can fulfil the order.

For the payment, billing and tax data collected during the ordering process, the provider is an independent controller within the meaning of Art. 4 No. 7 GDPR. When the checkout starts, we transmit to the provider the selected product, the version and time of your acceptance of the terms and conditions and licence terms and, if you have entered it, the identifier of your installation (Instance ID). The legal basis is Art. 6 (1) point b GDPR. Further information can be found in the provider's privacy policy: https://www.paddle.com/legal/privacy

An adequate level of data protection is guaranteed at the provider's location by an adequacy decision of the European Commission.

7) Web Analysis Services

Umami

This website uses the web analytics software Umami from the following manufacturer: Umami Software, Inc, 1362 42nd Ave, San Francisco, CA 94122, USA. We run the software on a server we rent from the following provider: Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. The server is located in a data centre in Germany (Frankfurt am Main); no service provided by the manufacturer of the software is used. We have concluded a data processing agreement with the provider of the server that ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

When you open a page, your browser transmits to our analytics server the address visited, the page title, the referring page, the screen size and the language setting of your browser. From your IP address and your browser identifier (user agent), the server creates a hash that allows visits by the same visitor to be grouped. The hash is created with a new random value every day. The IP address itself is not stored. Umami does not set any cookies.

Reach measurement only takes place if you have agreed to the category "Anonymous usage statistics" in the consent dialog. The legal basis is your consent pursuant to Art. 6 (1) point a GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via the "Cookie/privacy settings" link at the bottom of every page.

Independently of this, we count downloads of our installation files. If you click a download on our website, our server reports the download with your IP address and browser identifier to our analytics server. Downloads not started via our website are recorded from the logs of our download server (section 3.2). We evaluate these once a day and transmit the file and the shortened IP address for each download to our analytics server. There, the country and the hash are derived; the IP address itself is not stored. If you have agreed to reach measurement, a download can be linked to your page views on the same day. The legal basis for counting downloads is our legitimate interest in knowing how often our software is downloaded (Art. 6 (1) point f GDPR). Your device is not accessed in the process.

No information collected via the software is transmitted to the manufacturer. The data remains on our server.

As no data is transmitted, a data processing agreement with the manufacturer is not required.

No data is transferred to the USA as part of the reach measurement.

8) Tools and Miscellaneous

8.1 Lexware Office

For the execution of the accounting, we use the service of the cloud-based accounting software of the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

The provider processes incoming and outgoing invoices and, if applicable, also the bank transactions of our company in order to automatically record invoices, match them to the transactions and create the financial accounting from this in a semi-automated process.

Insofar as personal data is also processed in this context, the processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions.

8.2 On your first visit, our website asks in a dialog whether you agree to reach measurement (section 7). The dialog is part of our website and not a third-party service. Services requiring consent are only loaded after you have agreed.

We store your decision in your browser's storage (local storage, key "smitey-consent") so that the dialog does not reappear on every visit. It is not transmitted to us. The legal basis is Art. 6 (1) point c GDPR in conjunction with Section 25 (2) No. 2 TDDDG: we are obliged to use services requiring consent only with your consent and must store your decision for this purpose.

You can change your decision at any time via the "Cookie/privacy settings" link at the bottom of every page.

8.3 We operate a public live demo of our ticket system at demo.smitey.eu. You reach it via the "Live demo" page of our website after confirming the notes there. The demo runs on the same server as our website (section 3.1).

Please do not enter any real personal data in the demo. All visitors use the same accounts. Other visitors can see what you enter until the next reset. Every hour on the hour, the demo is reset to its initial state. All entries are deleted in the process.

After your confirmation, the demo sets the cookie "smitey_live_demo" for eight hours. It contains only an expiry time and a checksum and unlocks the demo for your browser. The legal basis is Section 25 (2) No. 2 TDDDG.

If you send an e-mail to demo@smitey.eu, it becomes a ticket in the demo. In doing so, we process your e-mail address, your sender name and the subject and content of the e-mail. We send a confirmation to your sender address and, once the ticket is resolved, a closing message. The mailbox demo@smitey.eu is operated by the following provider: ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. We have concluded a data processing agreement with the provider. We keep the e-mail itself in the demo mailbox for no longer than 30 days. To detect misuse, we log every e-mail sent with the recipient address and time, likewise for no longer than 30 days.

The legal basis is Art. 6 (1) point b GDPR, because you want to try our software before a purchase. For the logs, it is Art. 6 (1) point f GDPR, our legitimate interest in preventing misuse.

9) Rights of the Data Subject

To exercise your data subject rights and for any other data protection matters, you can reach us informally at privacy-protection@smitey.eu. This address is intended exclusively for data protection matters; please send general business enquiries to the address stated in section 1.2.

9.1 The applicable data protection law grants you the following comprehensive rights of data subjects (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data:

• Right of access by the data subject pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure (“right to be forgotten”) pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to be informed pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw a given consent pursuant to Art. 7 (3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

The right to lodge a complaint applies without prejudice to any other legal remedy. You may contact the supervisory authority of your place of residence, your place of work or the place of the alleged infringement. The authority responsible for us as the controller is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Telefon: 0211 38424-0, www.ldi.nrw.de

9.2 RIGHT TO OBJECT

IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA WHICH ARE USED FOR DIRECT MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

10) Duration of Storage of Personal Data

The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and - if relevant – on the respective legal retention period (e.g. commercial and tax retention periods).

If personal data is processed on the basis of express consent pursuant to Art. 6 (1) point a GDPR, this data is stored until the data subject revokes his consent.

If there are legal storage periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 (1) point b GDPR, this data will be routinely deleted after expiry of the storage periods if it is no longer necessary for the fulfillment of the contract or the initiation of the contract and/or if we no longer have a justified interest in further storage.

When processing personal data on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection in accordance with Art. 21 (1) GDPR, unless we can provide compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

If personal data is processed for the purpose of direct marketing based on Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the information contained in this declaration on specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.

11) Validity and changes to this privacy policy

The current version published on this page applies. As we develop our website further or use new services, this policy may need to be adapted; we reserve the right to make such changes with effect for the future. The version date can be found at the end of this page.

12) Licence and activation server (use of the software)

Sections 1 to 11 describe this website. The two sections below concern the software: the licence and activation server we operate, and the data that arises in an installation you run yourself. Two roles have to be told apart – for section 12 we are the controller, for section 13 you are, as the operator.

12.1 Controller

The controller is the provider named in section 1.2. For data protection matters you can reach us at privacy-protection@smitey.eu (see section 9). No data protection officer has been appointed; there is no obligation to appoint one.

12.2 Purposes and categories of data

On activation and on the regular check of a purchased licence, we process the following data via the licence server:

The GeoIP lookup is performed offline against a local database; no request is made to any third-party service.

12.3 Legal basis

• Art. 6 (1) point b GDPR (performance of a contract: licence management/activation).
• Art. 6 (1) point f GDPR (legitimate interest: protection against licence abuse and unauthorised multiple use). The legitimate interest lies in enforcing the licence terms and in product security.

For purchased licences, the online check is part of the licence agreement. It therefore cannot be switched off. The details are set out in the EULA, sections 3.4 and 9.2. The data protection guide for operators describes the transmission in chapter E. It is included with the installation as the file OPERATOR-GUIDE.txt.

12.4 Storage period

• Active activations: for the duration of the installation/licence.
• IP addresses and location: 12 months after the installation's last contact we erase the IP addresses, including the IP history, as well as region and city. Only the country remains, with no link to an IP address.
• Log of licence transactions (such as issue, binding, upgrade, refund): it contains no IP addresses. We keep it as long as the e-mails under section 12.8.
• Inactive activations are released automatically after 14 days without a heartbeat (slot reclaim).

12.5 Recipients / processors

Hosting of the licence server: Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus; the server is located in a data centre in Germany (Frankfurt am Main). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. No transfer to third countries takes place.

12.6 Offline operation

Licences in offline mode are issued on request. They are not activated or checked online. The installation checks them purely locally via the cryptographic signature. An installation with an offline licence nevertheless sends a report to our licence server once a day. The report contains the installation identifier, the licence ID, the product version, the operating system of the server and the number of administrators, agents and teams. We process this data and the IP address as described in sections 12.2 to 12.4. If the installation cannot reach the licence server, nothing reaches us. This is the case, for example, in a network without internet access. The installation then still works normally. This is to be distinguished from the non-binding demo/trial version, which sends us a daily report (see section 12.7).

12.7 Demo/trial version

The time-limited demo/trial version (30 days, without a purchased licence) sends a short report to our licence server once a day. You can switch the report off at any time. Your e-mail address is only included if you expressly choose so during installation. Neither affects the term or the functionality of the demo.

a) Daily report

Legal basis: Art. 6 (1) point f GDPR. Our legitimate interest is to know the number of trial installations and to detect abuse of the free trial. The report contains no content from your installation and no name.

Switching off (objection): you can object to the report at any time (Art. 21 GDPR, see section 9.2) by switching it off. On Windows, run the setup again and clear the box "Send the daily demo report". On Linux, run install.sh again and answer the question about switching off with yes, or run sudo bash install.sh --demo-report off. The button on the licence page that contacts the licence server immediately sends a single report when you click it, even if the daily report is switched off. This is needed for a licence purchase, because we have to know the installation for it.

b) E-mail address (optional)

If you tick the box "Also send my admin e-mail address" during installation (on Linux: answer the question about it with yes), each report additionally includes:

Legal basis: Art. 6 (1) point a GDPR, i.e. your consent. Without this box we do not send an e-mail address, and the demo works the same.

Withdrawal: you can withdraw your consent at any time with effect for the future. To do so, run the setup or install.sh again and undo the choice (on Linux also sudo bash install.sh --share-email no), or write to privacy-protection@smitey.eu. As soon as a report without an e-mail address arrives, we erase the stored e-mail address and the proof of consent for this installation. The lawfulness of the processing carried out until then remains unaffected.

For a) and b): the transmission is best effort. An unreachable server is only logged locally and has no effect on the term or the functionality. The GeoIP lookup is performed offline against a local database; no request is made to any third-party service.

Storage period: 12 months after the last contact we erase IP addresses, region and city as well as the e-mail address and the proof of consent. Only the country remains, with no link to an IP address. On request we erase all data stored about your trial installation.

12.8 Purchase and licence e-mails (retention)

When you purchase through our distribution partner Paddle, Paddle provides us with the details required to issue the licence (name, e-mail address, country). For licence events (purchase, activation code, upgrade, downgrade, re-issue) we send you e-mails containing your licence and the associated contract documents. We retain these e-mails, including their attachments, unchanged.

Purposes: compliance with statutory retention obligations for commercial correspondence (§ 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO)), proof of the contract and licence documents provided to you, and support.

Legal bases: Art. 6 (1) point b GDPR (issuing the licence), point c GDPR (statutory retention obligations) and point f GDPR (legitimate interest in proof and support).

Storage period: for the duration of the statutory retention periods, as a rule six years from the end of the calendar year in which the e-mail was sent. After these periods expire, we erase the e-mails unless other legal grounds require further retention.

13) Processing in your own installation

13.1 Controller

The controller for the personal data processed in the application is the operator (licensee) who hosts the software themselves – not us. Who that is in the individual case, and how they can be reached, follows from the legal notice or the privacy policy of the installation in question.

13.2 Data processed (typical)

• Accounts/users: name, e-mail address, user name, role, password hash, where applicable 2FA data, SSO/LDAP identifiers.
• Tickets/communication: content, subject, attachments, categories, statuses, assignments, timestamps; for incoming e-mail also sender and header data.
• Logs: security log (sign-in events with IP address and browser, administrator actions), activity logs, technical logs.

13.3 Purposes and legal bases

• Providing the ticket/support operation (Art. 6 (1) point b or f GDPR).
• Compliance with legal obligations (Art. 6 (1) point c GDPR), e.g. retention obligations.
• For employee data, where applicable, § 26 BDSG / Art. 88 GDPR.

13.4 Obligations of the operator

The operator determines storage periods, erasure concepts, access rights and technical and organisational measures themselves, and fulfils data subject rights. The software supports this through role-based permissions, audit logs and encryption of stored credentials (password hashing, DataProtection keys), among other things. For access requests, an administrator can export all data the software stores about a person into one file. After a person leaves, the software can automatically anonymise their data once a period set by the operator has passed; an administrator can also anonymise a person immediately. In addition, the software can anonymise the data of external contacts after a period without contact set by the operator.

Security log: The software keeps a security log. Its purpose is the security of the installation and proof of who changed accounts and permissions (Art. 6 (1) point f GDPR). It records failed sign-ins, account lockouts, wrong two-factor codes and password changes. It records successful sign-ins only for administrators and after previous failed attempts. This applies to local accounts, LDAP and single sign-on. For these sign-in events it stores the IP address and the browser. It also records administrator actions on accounts, permissions, security settings and archives. These entries contain no IP address. The log never stores passwords, codes or the content of tickets or e-mails. The log is not an attendance or working-time record. The operator sets the storage period. By default, the software deletes sign-in events after 90 days and administrator actions after 12 months. Deletion runs every night.

13.5 Who to address your rights to

The data subject rights set out in section 9 also apply to the processing described in sections 12 and 13. The addressee is always the respective controller: for section 12 that is us (privacy-protection@smitey.eu), for section 13 the operator of the installation in question.

Version: 11.08.2026, 08:19:59 · last amended: 06.10.2026