Privacy policy

1. Controller

smiit GmbH, represented by its managing directors Sebastian Grab and Noah Neßlauer

Reiherweg 96, 89584 Ehingen, Germany

If you have any questions about data protection or wish to exercise your rights, you can reach us using the contact details above.

2. General information on data processing

Personal data is any information relating to an identified or identifiable natural person, e.g. name, email address, or IP address.

The fonts used on this website are served locally by our hosting provider; no connection to Google Fonts servers is established.

3. Purposes of processing and legal bases

a) Provision and operation of the website (hosting via GitHub Pages)

This website is hosted via GitHub Pages, a service provided by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (“GitHub”).

When you access the website, GitHub automatically processes technically necessary data in server log files, in particular the IP address, date and time of access, page requested, referrer URL, browser type, and operating system. This data is processed to deliver the website and to ensure its technical operation and security. We ourselves have no access to these log files.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a secure and functional website.

b) Contact requests via form or email

If you contact us by email or via the contact form, we process the data you provide to handle your request and any follow-up questions. For the contact form, this is your first and last name, email address, topic of interest, message, and optionally your phone number.

For the technical delivery of form data, we use the service EmailJS provided by EmailJS Pte. Ltd., Singapore (“EmailJS”). Only when you submit the form is the data you entered, together with technical connection data (in particular your IP address), transmitted to EmailJS and then forwarded to us by email.

Legal basis: Art. 6(1)(b) GDPR where your request relates to an existing contract or to taking steps prior to entering into a contract (e.g. an inquiry about our services). In all other cases, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in effectively handling the requests addressed to us.

c) Appointment scheduling via Calendly

To schedule appointments online, we use the service Calendly provided by Calendly LLC, USA (“Calendly”).

Calendly is not loaded when you visit our website. Only when you actively click a button or link to book an appointment are Calendly scripts loaded and the booking window opened. In doing so, in particular your IP address, browser and device information, and the page visited are transmitted to Calendly. Calendly may use cookies or similar technologies within the booking window.

If you book an appointment, we process the data you enter (in particular name, email address, selected time slot, and any information about your request) to organize and conduct the appointment.

The legal basis for opening the booking window is Art. 6(1)(f) GDPR; our legitimate interest lies in offering simple online appointment scheduling. Where information is stored on or read from your device in this context, this is done, to the extent strictly necessary for the booking function you have expressly requested, on the basis of Section 25(2) No. 2 TDDDG. The legal basis for processing your booking data is Art. 6(1)(b) GDPR where the appointment serves to initiate or perform a contract, and Art. 6(1)(f) GDPR otherwise.

d) Google Ads – conversion tracking

We use the service Google Ads provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) to measure the effectiveness of our online advertising (conversion tracking). On certain interactions (clicking an email address, starting an appointment booking via Calendly, or opening our LinkedIn profile), it is recorded whether you previously reached the website via one of our ads.

For this purpose, Google sets cookies (e.g. “_gcl_au”) and transmits data to Google, in particular the IP address, a click or cookie identifier, information about the interaction, and browser and device information. We do not link this data to your identity.

Google’s scripts are only loaded after you have given your consent via our cookie banner. Without your consent, no cookies are set and no data is transmitted to Google. You can withdraw your consent at any time with effect for the future by reopening the cookie banner via the “Cookie settings” link in the footer and choosing “Decline”. The cookies set by Google are deleted in the process.

Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent).

e) Google Analytics 4

We use the web analytics service Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) to analyze the use of our website statistically (e.g. pages viewed, time on site, approximate origin, devices used). This helps us improve our offering.

For this purpose, Google sets cookies (e.g. “_ga”) and transmits usage data to Google, in particular a pseudonymous identifier, information about your usage behavior, and browser and device information. Your IP address is technically transmitted to Google; however, according to Google, IP addresses are not logged or stored in Google Analytics 4 but are only used to derive approximate location data and then discarded. We do not link this data to your identity.

Google Analytics is only loaded after you have given your consent via our cookie banner. Without your consent, no cookies are set and no data is transmitted to Google. You can withdraw your consent at any time with effect for the future by reopening the cookie banner via the “Cookie settings” link in the footer and choosing “Decline”. The cookies set by Google are deleted in the process.

Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent).

4. Recipients of data

To provide our services, we use the following service providers:

GitHub, Inc., USA – GitHub Pages (hosting)
EmailJS Pte. Ltd., Singapore – delivery of contact form messages
Calendly LLC, USA – appointment scheduling
Google Ireland Limited, Ireland, and Google LLC, USA – Google Ads (conversion tracking, only with consent)
Google Ireland Limited, Ireland, and Google LLC, USA – Google Analytics 4 (web analytics, only with consent)

5. Transfers to third countries

Some of the service providers listed process data outside the EU/EEA. We base these transfers on the following safeguards:

GitHub (USA): GitHub, Inc. is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses are used.
EmailJS (Singapore): There is no adequacy decision for Singapore. Transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of EmailJS’s data processing agreement.
Calendly (USA): Calendly LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); in addition, the EU Standard Contractual Clauses are used.
Google (USA): Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); in addition, the EU Standard Contractual Clauses are used.
You can view the certifications at https://www.dataprivacyframework.gov/list. The text of the EU Standard Contractual Clauses is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj; you can also request a copy of the safeguards used from us at any time using the contact details above.

6. Cookies and similar technologies

We store your cookie banner choice locally in your browser (local storage, entry “smiit-consent-v1”) so that the banner does not reappear on every page view. This is strictly necessary to store the choice you have requested (Section 25(2) No. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

We use marketing, conversion, and analytics cookies from Google Ads and Google Analytics exclusively on the basis of your consent. Until you consent, these services are not loaded at all. You can change your choice at any time via the “Cookie settings” link in the footer.

Calendly is only loaded when you actively start an appointment booking; within the booking window, Calendly may use its own cookies or similar technologies (see section 3 c).

7. Storage period

We only store personal data for as long as necessary for the respective purpose or as required by statutory retention obligations. In detail:

Server log files: stored by GitHub to the extent and for as long as necessary for delivering, operating, and securing the website; we do not store this data ourselves.
Contact requests: deleted no later than 12 months after your request has been fully handled. Where EmailJS keeps a sending history, it is deleted automatically in accordance with the provider’s retention periods.
Appointment data (Calendly): until the appointment and any follow-up communication have been completed, no later than 12 months after the appointment.
Business correspondence: if a request or appointment results in a business relationship or correspondence relevant under commercial or tax law, we retain it for the statutory periods (in particular Section 257 HGB, Section 147 AO; generally six years).
Google Analytics 4: user- and event-level data is deleted automatically according to the retention period configured in our account, at the latest after 14 months. The “_ga” cookie has a lifetime of up to 2 years.
Google Ads: the “_gcl_au” cookie has a lifetime of up to 90 days.
Google cookies are also deleted immediately if you withdraw your consent. Your cookie choice remains stored until you change it or clear your browser data.

8. Data subject rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, simply contact us using the details in section 1.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

10. Requirement to provide data

Providing your data is neither a statutory nor a contractual requirement. However, without the required data (e.g. your email address), we cannot process your request or appointment booking.

11. Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

12. Last updated

This privacy policy was last updated in September 2026.