Privacy policy

As at: 01.11.2026

1. Controller and contact

The controller responsible for processing personal data on this website is:

SLS - Smartlightsolutions GmbH

Linsenkamp 8b, 22175 Hamburg, Germany

Email: smartkeeper@smartlightsolutions.de

For questions about data protection or to exercise your rights, you can contact us at this email address.

2. Scope and purposes

This policy explains the processing of personal data when visiting the SMARTKEEPER website and making contact, product and support enquiries. It applies to SMARTKEEPER PRO and SMARTKEEPER ESSENTIAL and the language versions of this website.

The website provides product information and a means of contact. It does not offer an online shop, user registration or online payment. If your enquiry results in a business transaction, we also process the necessary data to prepare quotations, perform contracts, arrange delivery and fulfil statutory obligations.

3. Hosting, content delivery and security

We use Cloudflare to host and deliver the website through Cloudflare Workers and a content delivery network and to protect against technical attacks. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Technically necessary connection data is processed when you access the website. This may include your IP address, time of access, requested resources, HTTP status, data volume transferred, browser and device information and the referring website, insofar as your browser transmits it. Processing serves to provide content, analyse errors and protect against misuse and attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the website. Where accessing or storing information on your device is strictly necessary to provide a service expressly requested by you, section 25(2) TDDDG applies.

When Cloudflare is used, connection and security data may also be processed outside the EU or EEA. Section 10 explains possible transfers and the legal requirements.

Further information: https://www.cloudflare.com/privacypolicy/

4. Contact, product advice and support

If you contact us using a form, by email or by telephone, we process the information you provide to answer your enquiry. This may include your name, company, email address, telephone number, message, product or model details and, where applicable, address details needed to send a sample. Required fields are marked on the form. Other information is optional.

For enquiries concerning a contract with you or pre-contractual steps at your request, Article 6(1)(b) GDPR is the legal basis. For general enquiries or communication with employees and representatives of a company, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is responding to enquiries and maintaining business contacts. Article 6(1)(c) GDPR applies to statutory retention obligations.

We use Cloudflare Turnstile to protect the contact form against automated requests. Your browser connects to Cloudflare, and the verification token is checked on the server when you submit the form. We use Brevo to deliver the request to our company mailbox. The contact details and message entered are transmitted to Brevo and then to our mailbox at united-domains. Authorised staff access them as needed to handle the request. If a delivery is made, the delivery providers used receive the data needed for it. Telephone numbers and email addresses are not routinely disclosed to all delivery providers.

We retain personal data while needed to handle your request and, where applicable, for other lawful purposes. We then delete it unless a legal retention obligation or another lawful reason applies in the individual case. Data forming part of a business relationship or a record subject to retention is assessed separately from a standalone enquiry. The person responsible for our company mailbox reviews completed enquiries once per quarter to assess whether they need to be retained further.

We use united-domains (ud-mail.de) for our company email account.

Contact information necessary for processing must be provided so that we can answer your enquiry. A simple contact enquiry does not require consent to advertising or statistics.

5. Search, downloads and locally provided resources

Product and document searches use a search function running locally in your browser. Search terms are not transmitted to an external search provider. Loading search files and requesting product pages, images or downloads creates the technical connections described in section 3.

Font files, icons and images are provided through our website. No font files are loaded in your browser from Google Fonts or any other external font provider.

The legal basis for the necessary processing is Article 6(1)(f) GDPR; our legitimate interest is a usable website and providing the information requested. Browser access or storage strictly necessary for an expressly requested service is governed by section 25(2) TDDDG.

6. Cookies, local storage and consent

Our website may use cookies or comparable storage mechanisms. Technically essential functions are used only to the extent necessary. This may include storing your privacy choice so that we can respect it on subsequent page visits.

Non-essential storage on or access to your device takes place only with your consent under section 25(1) TDDDG. Where personal data is processed, Article 6(1)(a) GDPR is the legal basis. Merely using the website, scrolling or a preselected checkbox does not replace consent.

You may reject optional functions and continue using the website. You can change your decision at any time through “Cookie settings” in the website footer and withdraw consent with effect for the future. The lawfulness of processing before withdrawal remains unaffected.

Services used, purposes and retention periods are explained in the cookie settings and the following service-specific sections. Your selection is stored insofar as necessary to implement and demonstrate your decision.

7. External links and media

Our website may contain links to other websites. With an ordinary link, the external website is accessed only when you select it. Its operator is responsible for subsequent processing.

YouTube videos load only after you consent. Only then does your browser connect to YouTube via youtube-nocookie.com. Technically necessary connection data, such as the IP address, is then transmitted to the provider. You can withdraw consent in Cookie settings; the embedded players are then removed.

8. Quotations, contracts and business processing

For quotations and business transactions, we process the necessary company, contact, delivery, billing and payment data and related communications. Recipients may include contracted shipping companies, payment institutions, tax advisers and authorities insofar as disclosure is necessary or legally required.

The legal bases are Article 6(1)(b) GDPR where natural persons are contracting parties, Article 6(1)(f) GDPR for business contacts and Article 6(1)(c) GDPR for statutory obligations. Our legitimate interest is the proper processing and documentation of business relationships and protection of our rights. Information required by law or contract is necessary for the relevant transaction; without it, a transaction may not be possible.

9. No blanket consent to advertising

Making contact, accessing product information or placing an order does not constitute blanket consent to advertising emails or tracking. This version does not provide for a newsletter subscription or disclosure of form data for advertising purposes. Introducing a newsletter would require separate information and an appropriate subscription process.

10. Recipients, processing on our behalf and transfers to third countries

Personal data is disclosed only insofar as needed for the stated purposes, with valid consent or on another legal basis. Service providers processing personal data on our behalf are subject to the requirements of Article 28 GDPR.

Transfers to a country outside the EU or EEA must additionally meet the requirements of Articles 44 et seq. GDPR. Depending on the recipient and processing, a valid adequacy decision or appropriate safeguards, particularly EU standard contractual clauses with any necessary supplementary measures, may safeguard the transfer.

For US recipients, the EU-US Data Privacy Framework is relevant only if the specific recipient is currently certified and the processing concerned is covered. A US address or the name of a service alone is not evidence of this. The former EU-US Privacy Shield is not used as a transfer basis.

Cloudflare describes international data processing in its privacy policy and refers to the EU-US Data Privacy Framework or standard contractual clauses, with supplementary measures where needed, for transfers. The Cloudflare Data Processing Addendum (DPA), in particular section 6.2, provides for the relevant EU standard contractual clauses and supplementary safeguards for restricted transfers. The EU-US Data Privacy Framework applies only to covered transfers to appropriately certified recipients; it does not automatically cover all processing or every sub-processor. The basis and safeguards for a particular transfer depend on the recipient, the processing and the applicable contractual terms. Information and the list of sub-processors:

https://www.cloudflare.com/privacypolicy/

https://www.cloudflare.com/cloudflare-customer-dpa/

https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/

For questions about recipients and possible transfers, please contact us using the details in section 1.

11. Retention periods

We store personal data only as long as necessary for the relevant purpose or to fulfil statutory obligations. Data is then deleted or anonymised unless further retention is permitted.

Business records and certain transactions may be subject to statutory retention duties depending on their content and legal basis. Whether a duty applies and its duration depend on the individual case.

Where data is needed to establish or defend legal claims, it may be retained until the applicable limitation period expires or proceedings conclude. Data subject to retention obligations is restricted for other purposes where required. Storage and deletion of logs and backups also depend on the technical conditions of the providers used.

12. Your rights

Under the GDPR, you may in particular request access to your personal data (Article 15), correction of inaccurate data (Article 16), erasure (Article 17) and restriction of processing (Article 18).

Where the conditions are met, you have a right to data portability (Article 20). You may withdraw consent at any time with effect for the future (Article 7(3)). Statutory exceptions and other people's rights may limit the scope of individual rights.

You also have the right to complain to a data protection supervisory authority (Article 77), particularly at your habitual residence, workplace or the place of the alleged infringement. The Hamburg Commissioner for Data Protection and Freedom of Information is generally responsible for our company: Ludwig-Erhard-Straße 22, 20459 Hamburg; email: mailbox@datenschutz.hamburg.de; website: https://datenschutz-hamburg.de/

13. Right to object

Where we process your data on the basis of Article 6(1)(e) or (f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or processing serves to establish, exercise or defend legal claims.

You may object at any time to processing for direct marketing, including related profiling. Following such an objection, we no longer process your data for these purposes. You may submit your objection without a prescribed form to the address stated in section 1.

14. Automated decisions and amendments

We do not use solely automated decisions in the contact and contract processing described here that produce legal effects concerning you or similarly significantly affect you. We use Cloudflare Turnstile to protect the contact form. Details can be found in section 4. If you are blocked by mistake, you can contact us by email.

This privacy policy is updated when processing or legal requirements change. The version published on the website applies. A new purpose or optional service is not legitimised solely by amending the text without the necessary information or consent.