Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

SmartDocs, owner Ahmet Zambak
Sömmeringstraße 18
10589 Berlin
Germany
Email: kontakt@smartdocs.de

2. Overview and scope

This privacy policy provides information about the processing of personal data:

• when you visit this website (smartdocs.de), covered in sections 3 to 6;
• when you use the SmartDocs application, that is, the web application at app.smartdocs.de, the SmartDocs Kiosk App for tablets (iOS and Android) and the signing interface that signers use via an invitation link in the browser or directly on a kiosk tablet, covered in sections 7 to 13.

We use analytics and ad measurement only on the website, and only if you have consented to them via our consent banner (details in section 6). We load fonts and other design resources from our own servers, not from third-party servers.

3. Hosting of the website

This website is delivered as a static website via Cloudflare Pages. The provider is Cloudflare Germany GmbH, Rosental 7, 80331 Munich, as the European branch of Cloudflare, Inc. (USA). When the website is accessed, Cloudflare processes technically necessary connection data (in particular IP address, date and time of access, resource requested, amount of data transferred, browser identifier) in order to deliver the website and protect it against attacks.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and high-performance delivery of the website). A data processing agreement is in place with Cloudflare; insofar as data is transferred to third countries, this takes place on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

Independently of this, the documents and signature data of our customers in the SmartDocs product are processed on servers in Germany and at storage locations in the European Union (section 12).

4. Server logs

When the website is accessed, technically necessary data is stored in log files (IP address, time, page requested, status code, browser identifier). This data serves to ensure operation and to analyze errors and is automatically deleted after a short time. The legal basis is Art. 6 (1) (f) GDPR.

5. Contact form

If you use our contact form, we process the data you provide (name, email address, optionally company, content of the message) exclusively to handle your inquiry. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in responding to inquiries).

Your inquiry data is deleted as soon as it is no longer required to handle your inquiry and no statutory retention obligations prevent deletion.

5.1 Spam protection with Cloudflare Turnstile

To protect the form against automated access, we use Cloudflare Turnstile, a cookieless security check. In doing so, Cloudflare processes technical characteristics of your browser in order to distinguish between humans and bots. The legal basis is Art. 6 (1) (f) GDPR (protection against misuse).

5.2 Delivery via Resend

Form messages are delivered to our mailbox via the email service Resend (Resend, Inc., USA), with data processing in the EU region. A data processing agreement is in place with the provider; insofar as access from a third country cannot be ruled out, such access takes place on the basis of the EU Standard Contractual Clauses.

6. Cookies, consent and website measurement

6.1 Consent banner

When you first visit this website, a notice (consent banner) appears in which you decide separately whether we may use website analytics and the measurement of our Google search ads. We store your choice in a cookie named sd-consent (valid for smartdocs.de including subdomains; lifetime: 12 months if you consent, 60 days if you reject everything). This cookie is technically necessary to remember your decision and contains no identifiers relating to you as a person. Without your consent, no optional cookies are set.

The legal basis for the technically necessary consent cookie is § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). For the consent-based storage of information on your device and access to information stored there, it is § 25 (1) TDDDG; for the subsequent data processing, it is Art. 6 (1) (a) GDPR (consent). You can change or withdraw your consent at any time with effect for the future via the "Cookie settings" link in the page footer.

6.2 Microsoft Clarity

To improve our website, we use Microsoft Clarity, a web analytics service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). Clarity is used exclusively on this website, not in the SmartDocs application and not in the signing process.

Without your consent, Clarity is not loaded: before you consent, no script is retrieved from Microsoft, no connection to Microsoft is established and no cookies are set. Only after you consent does Clarity collect pseudonymized usage data, including pages visited, time spent on the page, referrer, browser and device type, approximate origin (derived from the IP address) and interactions such as mouse movements, clicks and scrolling behavior. From this, Microsoft creates heatmaps and recordings of individual sessions for us. Microsoft uses the IP address only to determine your approximate location and does not store it.

By default, Clarity masks input in form fields as well as numbers and email addresses and does not transmit them to Microsoft. The content of your message in the contact form is therefore not part of the recording.

After you consent, Clarity sets the first-party cookies _clck (recognition of pseudonymous user identifiers) and _clsk (combining several page views into one session). In addition, we transmit to Clarity the signal that advertising-related storage has been declined; this is intended to prevent advertising-related third-party cookies from Microsoft (including CLID, MUID, ANONCHK, MR and SM via the domains clarity.ms and bing.com) from being set. Microsoft determines the lifetimes of these cookies; Microsoft maintains a current overview in its Clarity documentation.

Session recordings are deleted after 30 days; recordings and labels marked as favorites or selected by random sampling are retained for up to nine months. Processing takes place in the Microsoft Azure cloud. A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft; beyond that, according to its own statements, Microsoft also processes data in part for its own purposes. A transfer of data to Microsoft Corporation in the USA cannot be ruled out; Microsoft Corporation is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the EU Standard Contractual Clauses apply in addition. For details, see the Microsoft privacy statement .

The legal basis for the processing is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time with effect for the future via the "Cookie settings" link in the page footer; the cookies set by Clarity are then deleted and the service is no longer loaded.

6.3 Google Ads: click on the registration link

With your separate consent to ad measurement, we use Google Ads from Google Ireland Limited, Ireland. We measure whether, after a click on one of our search ads, the link to create a SmartDocs account is clicked. This click is not confirmation of a completed registration. The Google script is only loaded after you consent; without your consent, no ad measurement requests are sent to Google.

In doing so, Google may process connection data such as IP address, time, browser identifier, website visited and ad click identifiers, and may set cookies with the prefix _gcl_. Google describes lifetimes and further details in its information on advertising. We do not transmit account details, form input, documents or signatures with this click event. We do not use this measurement in the SmartDocs application. Personalized advertising, remarketing and the transfer of customer data for enhanced conversions are disabled for this measurement.

The legal basis is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). Processing by Google LLC in the USA is possible. For details on the legal bases for the transfer and on the processing, see the Google privacy policy. You can withdraw your consent at any time with effect for the future via "Cookie settings" in the page footer. The Google service is then no longer loaded, and the _gcl_ cookies on smartdocs.de that are accessible to us are removed.

7. SmartDocs application: allocation of roles

SmartDocs is a platform with which companies and organizations (our customers) have documents signed electronically. Under data protection law, the roles are allocated as follows:

• We are the controller for the processing of the account and usage data of our customers and their team members (sections 8 and 9).
• We are a processor under Art. 28 GDPR for the content that our customers process via SmartDocs, in particular documents and the data of signers (section 10). The controller for this data is the respective organization that started the signing process. We conclude a data processing agreement with every organization.

If you have signed a document via SmartDocs and have questions about the processing of your data or wish to exercise your rights as a data subject, please contact, in the first instance, the organization from which you received the document. We forward requests that reach us directly to the responsible organization.

8. Account and registration data

For the registration and use of a SmartDocs account, we process the following data: name, email address, password (stored exclusively as a cryptographic hash), organization membership and role, language setting and billing information. The legal basis is Art. 6 (1) (b) GDPR (performance of the user agreement).

Session tokens are generated when you log in. In the Kiosk App, these tokens are stored exclusively in the secure storage of the device (iOS Keychain or Android Keystore); in the browser, they are stored in your user profile. The tokens serve solely for authentication and are deleted when you log out.

To process paid plans, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). The data required for payment processing is transmitted to Stripe (name, email address, billing address, VAT identification number and payment data); payment data such as card numbers is collected and stored exclusively by Stripe, not by us. The legal basis is Art. 6 (1) (b) GDPR. Stripe may transfer data to Stripe, Inc. (USA); this takes place on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. A data processing agreement is in place with Stripe.

9. Technical usage data of the application

When our servers (api.smartdocs.de) are accessed, technically necessary data is processed in log files: IP address, time of access, endpoint called, status code and client identifier. This data serves to ensure operation, to analyze errors and to fend off attacks, and is automatically deleted after a short time. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).

The web application and the Kiosk App contain no third-party analytics, tracking or advertising services. Fonts and other design resources are bundled in the application and are not loaded from third-party servers. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

10. Data in the signing process

On behalf of the respective responsible organization, we process the following categories of personal data of signers as part of a signing process:

• name and contact details (email address and/or mobile phone number),
• the content contained in the document and the content entered by signers,
• the image of the signature provided,
• evidence data for the evidential value of the signature (audit trail): IP address, timestamp, device used, delivery and open events, one-time code verification and the version of the consent and notice texts displayed,
• the status of the signing process (for example viewed, signed, declined).

Depending on the content of the document, special categories of personal data under Art. 9 GDPR may also be affected (for example health data in consent forms and medical history questionnaires of a medical practice). The responsible organization ensures the legal basis: for special categories, usually your explicit consent under Art. 9 (2) (a) GDPR; otherwise, in particular, the performance of a contract under Art. 6 (1) (b) GDPR. We process this data exclusively on the instructions of the responsible organization.

Documents and signatures are not stored permanently on kiosk tablets: the data is displayed during signing and transmitted to our servers via an encrypted connection. After the signature request has been completed, the document views cached during the request are also removed from the device; no documents or signature data remain on the device.

11. Sending of one-time codes and emails

To verify the identity of signers and to deliver invitations, status notifications and account notifications, we use the following service providers:

• SMS delivery of one-time codes (OTP): seven communications GmbH & Co. KG (seven.io), Willestraße 4-6, 24103 Kiel, Germany. The mobile phone number and the message text are processed. A data processing agreement is in place with the provider; processing takes place in Germany.
• Email delivery (invitations, status notifications and account notifications): Postmark (AC PM LLC, an ActiveCampaign, LLC company, USA). The email address and the message content are processed. A data processing agreement is in place with the provider; the transfer to the USA takes place on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR) and the EU Standard Contractual Clauses.

12. Hosting of the application

The SmartDocs application and its database are operated on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (Nuremberg data center). A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

Document files (uploaded PDFs, page previews and completed documents) are stored in the Cloudflare R2 object storage of Cloudflare, Inc. (USA) with a storage location in the European Union and are retrieved via short-lived, signed URLs. A data processing agreement is in place with Cloudflare; insofar as access from a third country cannot be ruled out, such access takes place on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

The web interfaces (app.smartdocs.de and the signing interface) are delivered via Netlify, Inc. (USA); for the signing interface, the API calls are also forwarded to our servers via the Netlify infrastructure. In doing so, Netlify processes technically necessary connection data (in particular the IP address). A data processing agreement based on the EU Standard Contractual Clauses is in place with Netlify.

13. Obtaining the Kiosk App via app stores

The Kiosk App is provided via the Apple App Store (Apple Distribution International Ltd., Ireland) and Google Play (Google Ireland Limited, Ireland). When the app is downloaded and updated, the store operators process data (for example account identifier, device data and download statistics) under their own responsibility; the privacy notices of the respective store operator apply. We do not receive any personal data from this.

14. Retention period

We store account data for the duration of the contractual relationship and delete it afterwards, unless statutory retention obligations (in particular under commercial and tax law) prevent this. As a processor, we store documents and signature data for as long as the responsible organization specifies; after the end of the contract, this data is returned or deleted at the organization's choice. Log data is automatically deleted after a short time.

15. Data security

The transmission of this website and all connections to the SmartDocs application are encrypted via TLS throughout. We take technical and organizational measures pursuant to Art. 32 GDPR to protect the processed data against loss, manipulation and unauthorized access. We provide customers with an overview of our measures (TOM documentation) together with the data processing agreement.

16. Your rights

Under the GDPR, you have the following rights in particular:

• Access to the personal data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)

For data that we process as controller, an informal message to kontakt@smartdocs.de is sufficient. For data from a signing process (section 10), please contact the organization from which you received the document. In addition, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information).

17. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our data processing changes. The version published on this page at the relevant time applies.