Data Protection Declaration

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. On the following pages, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Thorsten Nierfeld, Smitey Inh. Thorsten Nierfeld, Einigkeitstrasse 46, 45133 Essen, Germany, Phone.: 0201 - 36803441, e-mail: business@smitey.eu. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When You Visit Our Website

2.1 When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you:

• Our visited website
• Date and time at the moment of access
• Amount of data sent in bytes
• Source/reference from which you came to the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

Data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1 For the hosting of our website and the presentation of the page content, we use a provider that provides its services itself or through selected subcontractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers.

We have concluded an order processing contract with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties.

3.2 Bunny

We use a content delivery network offered by the following provider: BUNNYWAY d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia

This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) point f GDPR. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

4) Cookies

In order to make your visit to our website more attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. In some cases, these cookies are automatically deleted again after the browser is closed (so-called "session cookies"), in other cases, these cookies remain on your end device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the duration of the storage in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies set by us, the processing is carried out either in accordance with Art. 6 (1) point b GDPR for the performance of the contract, in accordance with Art. 6 (1) point a GDPR in the case of consent given or in accordance with Art. 6 (1) point f GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser in such a way that you are informed about the setting of cookies and you can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting Us

5.1 Smitey's Ticket-System

To process customer requests, we use our own e-mail ticketing system, Smitey's Ticket-System.

If you send us contact requests via the form or by e-mail on our website, these are stored and organised in the ticketing system to enable chronological processing and to improve the service experience. Each request is assigned an individual ticket number, which facilitates internal allocation and ensures complete processing.

For the organisation and processing of requests, personal data is collected according to the scope of its provision, but in any case surname, first name and e-mail address.

The legal basis for the processing of this data is our legitimate interest in the efficient design of our customer service, in answering your request as quickly as possible and in optimising our service offer in accordance with Art. 6 (1) point f GDPR.

Smitey's Ticket-System is hosted on a cloud server of the following provider: netcup GmbH, Emmy-Noether-Strasse 10, 76131 Karlsruhe, Germany

We have concluded an order processing agreement with netcup GmbH, which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

5.2 When you contact us (e.g. via contact form or e-mail), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration.

The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR. Your data will be deleted after final processing of your enquiry; this is the case if it can be inferred from the circumstances that the facts in question have been finally clarified, provided there are no legal storage obligations to the contrary.

6) Processing of Data for the Purpose of Order Handling

6.1 Insofar as necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned credit institution in accordance with Art. 6 Para. 1 lit. b GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data (name, address, e-mail address) provided by you when placing the order in order to inform you personally by suitable means of communication (e.g. by post or e-mail) about upcoming updates within the legally stipulated period of time within the framework of our statutory duty to inform pursuant to Art. 6 Para. 1 lit. c GDPR. Your contact details will be used strictly for the purpose of informing you about updates owed by us and will only be processed by us for this purpose to the extent that this is necessary for the respective information.

In order to process your order, we also work together with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

6.2 Use of Payment Service Providers

• Paddle

A checkout system from the following provider is available on this website: Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London, EC1V 8BT, United Kingdom

When you initiate the ordering process, you will be redirected to a web interface operated by the provider, where you can complete and pay for the order by entering your billing and delivery address and your payment details. The provider is originally responsible for collecting this data and processes the payment in its own name.

After placing and paying for the order, the provider transmits the order data and transaction details to us in accordance with Art. 6 para. 1 lit. b GDPR to the extent necessary for contract processing so that we can fulfil the order.

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

An adequate level of data protection is guaranteed at the provider's location by an adequacy decision of the European Commission.

7) Web Analysis Services

Umami

This website uses the web analytics software Umami from the following manufacturer: Umami Software, Inc, 1362 42nd Ave, San Francisco, CA 94122, USA. We run the software on a server we rent from the following provider: Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. The server is located in a data centre in Germany (Frankfurt am Main); no service provided by the manufacturer of the software is used. We have concluded a data processing agreement with the provider of the server that ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

To protect site visitors, Umami uses a so-called 'Distinct ID’ to enable various analyses of site usage within a short time window of up to 24 hours. The 'Distinct ID’ is a randomly set, time-limited hash of a limited set of visitor settings and attributes, which is calculated based on the visitor's operating system, browser, browser plugins, previously anonymised IP address and browser language.

The 'Distinct ID’ is thus created exclusively on the basis of information that cannot be used to personally identify the visitor.

If the information processed in this way should exceptionally include personal user data, the processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes. In this case, you can permanently object to the collection and storage of your visitor data for the future by notifying us.

No information collected via the software is transmitted to the manufacturer. The data remains on our server.

As no data is transmitted, a data processing agreement with the manufacturer is not required.

No data is transferred to the USA as part of the reach measurement.

8) Tools and Miscellaneous

8.1 Lexware Office

For the execution of the accounting, we use the service of the cloud-based accounting software of the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

The provider processes incoming and outgoing invoices and, if applicable, also the bank transactions of our company in order to automatically record invoices, match them to the transactions and create the financial accounting from this in a semi-automated process.

Insofar as personal data is also processed in this context, the processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions.

8.2 This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "cookie consent tool" is displayed to users in the form of an interactive user interface when they access the page, on which consent for certain cookies and/or cookie-based applications can be given by ticking the appropriate box.

Using the tool, all cookies/services requiring consent are only loaded if the respective user provides the corresponding consent by ticking the corresponding box. This ensures that such cookies are only set on the respective end device of the user if consent has been granted.

The tool sets technically necessary cookies to save your cookie preferences. Personal user data is generally not processed. If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Art. 6 (1) point f GDPR based on our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website. Further legal basis for the processing is Art. 6 (1) point c GDPR. As the responsible party, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent. Further information on the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

9) Rights of the Data Subject

To exercise your data subject rights and for any other data protection matters, you can reach us informally at privacy-protection@smitey.eu. This address is intended exclusively for data protection matters; please send general business enquiries to the address stated in section 1.2.

9.1 The applicable data protection law grants you the following comprehensive rights of data subjects (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data:

• Right of access by the data subject pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure (“right to be forgotten”) pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to be informed pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw a given consent pursuant to Art. 7 (3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

The right to lodge a complaint applies without prejudice to any other legal remedy. You may contact the supervisory authority of your place of residence, your place of work or the place of the alleged infringement. The authority responsible for us as the controller is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Telefon: 0211 38424-0, www.ldi.nrw.de

9.2 RIGHT TO OBJECT

IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA WHICH ARE USED FOR DIRECT MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

10) Duration of Storage of Personal Data

The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and - if relevant – on the respective legal retention period (e.g. commercial and tax retention periods).

If personal data is processed on the basis of express consent pursuant to Art. 6 (1) point a GDPR, this data is stored until the data subject revokes his consent.

If there are legal storage periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 (1) point b GDPR, this data will be routinely deleted after expiry of the storage periods if it is no longer necessary for the fulfillment of the contract or the initiation of the contract and/or if we no longer have a justified interest in further storage.

When processing personal data on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection in accordance with Art. 21 (1) GDPR, unless we can provide compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

If personal data is processed for the purpose of direct marketing based on Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the information contained in this declaration on specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.

11) Validity and changes to this privacy policy

The current version published on this page applies. As we develop our website further or use new services, this policy may need to be adapted; we reserve the right to make such changes with effect for the future. The version date can be found at the end of this page.

12) Licence and activation server (use of the software)

Sections 1 to 11 describe this website. The two sections below concern the software: the licence and activation server we operate, and the data that arises in an installation you run yourself. Two roles have to be told apart – for section 12 we are the controller, for section 13 you are, as the operator.

12.1 Controller

The controller is the provider named in section 1.2. For data protection matters you can reach us at privacy-protection@smitey.eu (see section 9). No data protection officer has been appointed; there is no obligation to appoint one.

12.2 Purposes and categories of data

If online activation is enabled in the ticket system installation, we process the following data via the licence server:

The GeoIP lookup is performed offline against a local database; no request is made to any third-party service.

12.3 Legal basis

• Art. 6 (1) point b GDPR (performance of a contract: licence management/activation).
• Art. 6 (1) point f GDPR (legitimate interest: protection against licence abuse and unauthorised multiple use). The legitimate interest lies in enforcing the licence terms and in product security.

12.4 Storage period

• Active activations: for the duration of the installation/licence.
• IP history and audit entries: up to 12 months, then erased or anonymised, unless statutory retention obligations apply.
• Inactive activations are released automatically after 14 days without a heartbeat (slot reclaim).

12.5 Recipients / processors

Hosting of the licence server: Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus; the server is located in a data centre in Germany (Frankfurt am Main). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. No transfer to third countries takes place.

12.6 Offline operation

If the licence is run in offline mode (activationMode = offline), no activation data is transmitted to us; the check is performed purely locally via the cryptographic signature. This is to be distinguished from the non-binding demo/trial version, which – after your consent during installation – transmits demo telemetry (see section 12.7).

12.7 Demo/trial version (processing based on consent)

The time-limited demo/trial version (30 days, without a purchased licence) sends a sign of life to our licence server once a day. During installation you are asked for your consent to the processing described below; without that consent the demo/trial version cannot be used. We process:

The transmission is best effort for the demo to work (an unreachable server is only logged locally and has no effect on the term or the functionality). The GeoIP lookup is performed offline against a local database; no request is made to any third-party service.

Legal basis: Art. 6 (1) point a GDPR (the consent you gave during installation) as well as Art. 6 (1) points b and f GDPR (performance of the (pre-)contractual trial relationship, and legitimate interest in licence and abuse control as well as in evaluating trial use).

Storage period: contact-related and IP-related information for up to 12 months after the last contact, then erased or anonymised, unless statutory retention obligations conflict (e.g. for invoicing records if a licence is purchased afterwards).

Withdrawal: you can withdraw your consent at any time with effect for the future (contact: privacy-protection@smitey.eu); the lawfulness of the processing carried out until then remains unaffected. On request we erase the data stored about your trial installation. In addition, the right to object under Art. 21 GDPR applies (see section 9.2).

12.8 Purchase and licence e-mails (retention)

When you purchase through our distribution partner Paddle, Paddle provides us with the details required to issue the licence (name, e-mail address, country). For licence events (purchase, activation code, upgrade, downgrade, re-issue) we send you e-mails containing your licence and the associated contract documents. We retain these e-mails, including their attachments, unchanged.

Purposes: compliance with statutory retention obligations for commercial correspondence (§ 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO)), proof of the contract and licence documents provided to you, and support.

Legal bases: Art. 6 (1) point b GDPR (issuing the licence), point c GDPR (statutory retention obligations) and point f GDPR (legitimate interest in proof and support).

Storage period: for the duration of the statutory retention periods, as a rule six years from the end of the calendar year in which the e-mail was sent. After these periods expire, we erase the e-mails unless other legal grounds require further retention.

13) Processing in your own installation

13.1 Controller

The controller for the personal data processed in the application is the operator (licensee) who hosts the software themselves – not us. Who that is in the individual case, and how they can be reached, follows from the legal notice or the privacy policy of the installation in question.

13.2 Data processed (typical)

• Accounts/users: name, e-mail address, user name, role, password hash, where applicable 2FA data, SSO/LDAP identifiers.
• Tickets/communication: content, subject, attachments, categories, statuses, assignments, timestamps; for incoming e-mail also sender and header data.
• Logs: sign-in and activity logs, technical logs.

13.3 Purposes and legal bases

• Providing the ticket/support operation (Art. 6 (1) point b or f GDPR).
• Compliance with legal obligations (Art. 6 (1) point c GDPR), e.g. retention obligations.
• For employee data, where applicable, § 26 BDSG / Art. 88 GDPR.

13.4 Obligations of the operator

The operator determines storage periods, erasure concepts, access rights and technical and organisational measures themselves, and fulfils data subject rights. The software supports this through role-based permissions, audit logs and encryption of stored credentials (password hashing, DataProtection keys), among other things.

13.5 Who to address your rights to

The data subject rights set out in section 9 also apply to the processing described in sections 12 and 13. The addressee is always the respective controller: for section 12 that is us (privacy-protection@smitey.eu), for section 13 the operator of the installation in question.

Version: 11.08.2026, 08:19:59