Privacy Policy

Thank you for visiting our website. The protection of your personal data is important to us. This Privacy Policy explains what personal data we process in connection with the use of our website and the services offered through it, for what purposes and on what legal bases such processing takes place, and what rights you have as a data subject.

1. Controller

The controller responsible for the processing of personal data in connection with this website is:

SmarAct GmbH
Schuette Lanz Str. 9
D-26135 Oldenburg
Germany

Telephone: +49 (0) 441 800 879-0
Fax: +49 (0) 441 800 879-21
Email: info@smaract.com

2. General information

We design and operate our website in accordance with the principle of data minimisation and seek to process as little personal data as possible.

In principle, you may use our website for informational purposes without actively providing personal data. Further processing of personal data may take place in particular when you use certain functions or services, such as contact or enquiry forms, our newsletter or our online application process.

We process personal data only where an appropriate legal basis exists.

We comply in particular with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG) and other applicable data protection regulations.

3. Purposes and legal bases for processing personal data

We process personal data only for specified purposes.

These purposes include in particular:

processing and responding to contact and other enquiries;
preparing and sending quotations upon request;
providing, technically administering and securing our website;
sending our newsletter;
conducting recruitment and selection processes;
analysing and improving our website;
conducting, measuring and optimising digital marketing and advertising activities;
complying with legal obligations and establishing, exercising or defending legal claims.

Where processing is necessary in order to take steps prior to entering into a contract or to perform a contract, the legal basis is Article 6 (1) (b) GDPR.

Where you have given us consent, the legal basis is Article 6 (1) (a) GDPR.

Where processing is necessary for the purposes of our legitimate interests or those of a third party and such interests are not overridden by your interests, fundamental rights or freedoms, the legal basis is Article 6 (1) (f) GDPR.

Where processing is necessary for compliance with a legal obligation, the legal basis is Article 6 (1) (c) GDPR.

Where we engage service providers as processors, they are additionally engaged on the basis of an agreement pursuant to Article 28 GDPR. Article 28 GDPR does not itself constitute the legal basis for the underlying processing activity.

4. Categories of personal data processed

The personal data we process depends on the functions and services that you use.

Contact and enquiries

This may include in particular:

title or salutation;
first name and surname;
company;
postal address;
telephone number;
email address;
content of your message or enquiry;
other information provided voluntarily.

Applications

This may include in particular:

first name and surname;
address;
email address;
telephone number;
curriculum vitae;
qualifications and professional experience;
certificates and references;
application correspondence;
application documents;
information on how you became aware of the vacancy;
other information provided voluntarily.

This may include in particular:

email address;
name, where provided voluntarily;
IP address;
date and time of registration and confirmation;
where applicable, information about newsletter usage.

Website, analytics and online marketing

Depending on the technology used and your consent choices, this may include in particular:

IP address;
cookies and other online identifiers;
browser and device information;
operating system;
date and time;
pages and content accessed;
referrer information;
website interactions;
advertising and campaign information;
conversion events.

5. Processing when visiting our website

If you use our website solely for informational purposes, we process technical information automatically transmitted by your browser to our server.

This may include in particular:

IP address;
date and time of access;
time zone;
requested page or content;
HTTP status code;
amount of data transferred;
referrer URL;
browser type and version;
operating system;
browser language.

The processing is necessary in order to provide our website and ensure its stability and security.

The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest is the secure, stable and technically reliable provision of our website.

We also use cookies and similar technologies in accordance with the provisions below.

6. Integration of third-party services

We use services and technologies provided by external providers on our website.

These may be used in particular for:

technical provision and management of our website;
analysis of website usage;
advertising and performance measurement;
integration of maps and videos;
newsletter distribution;
applicant management;
consent management.

When such services are used, technical information such as your IP address, browser information or device information may be transmitted to the respective provider.

Services requiring consent are activated in accordance with the choices made through our consent management platform.

Further information on individual services is provided below.

7. Cookies and Consent Management

Our website uses cookies and similar technologies.

Cookies are small text files stored on your terminal device. Similar technologies may also store information on your terminal device or access information already stored there.

Some cookies and technologies are strictly necessary for the operation and functionality of our website. Other technologies are used for statistical analysis, performance measurement and marketing.

Where information is stored on or accessed from your terminal device and such storage or access is not strictly necessary, the legal basis is Section 25 (1) TDDDG.

Where personal data is subsequently processed on the basis of your consent, the legal basis is Article 6 (1) (a) GDPR.

You may change or withdraw your consent choices at any time with effect for the future via the consent settings available on our website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Cookiebot Consent Management Platform

We use Cookiebot CMP to obtain, manage and document your consent choices concerning cookies and similar technologies.

The provider is:

Usercentrics A/S
Havnegade 39
1058 Copenhagen
Denmark

Cookiebot processes information required to manage and document your consent decision. This may include your consent status, the date and time of your decision, technical browser information and other information required for documentation purposes.

Cookiebot processes this data on our behalf in accordance with Article 28 GDPR.

Where the processing is required in order to comply with our legal obligations relating to obtaining and documenting consent, the legal basis is Article 6 (1) (c) GDPR.

Where information is stored on or accessed from your terminal device solely for the purpose of saving and managing your privacy and consent settings, Section 25 (2) TDDDG applies.

8. Contacting us

You may contact us by email or via the contact, enquiry and quotation forms provided on our website.

We process the personal data provided by you in order to handle your enquiry and, where necessary, contact you in connection with it.

Depending on the type of enquiry, this may include:

name and salutation;
company;
postal address;
telephone number;
email address;
content of your message or enquiry;
other information provided voluntarily.

Information required in order to process your request is marked as mandatory.

Where your enquiry relates to entering into or performing a contractual relationship, the legal basis is Article 6 (1) (b) GDPR.

For other enquiries, the legal basis is Article 6 (1) (f) GDPR. Our legitimate interest is the efficient processing and answering of enquiries addressed to us.

Where processing is based on consent, the legal basis is Article 6 (1) (a) GDPR.

9. Application process and d.vinci applicant management

You may apply for vacancies at SmarAct through our online application process.

We use the d.vinci applicant management system to administer and process applications.

The provider is:

d.vinci HR-Systems GmbH
Nagelsweg 37–39
20097 Hamburg
Germany

d.vinci processes personal data on our behalf in accordance with Article 28 GDPR.

During the application process, we may process in particular:

name and contact details;
address;
telephone number and email address;
curriculum vitae;
qualifications and professional experience;
certificates and references;
application correspondence;
information on how you became aware of the vacancy;
other information and documents provided voluntarily.

Technical information required to provide and secure the online application system may also be processed.

The purpose of the processing is to receive, administer and assess applications, communicate with applicants and conduct recruitment and selection procedures.

The legal basis for processing for the purpose of deciding whether to establish an employment relationship is Section 26 (1) sentence 1 BDSG.

Where continued processing is necessary following completion of the application process in order to establish, exercise or defend legal claims, the legal basis is Article 6 (1) (f) GDPR.

If your application is unsuccessful, your application data will generally be deleted once it is no longer required for the application process or for the defence against potential legal claims. Unless a longer period is required in an individual case, deletion generally takes place no later than six months after completion of the application process.

If you consent to being considered for future vacancies, we may retain your application data beyond this period. The legal basis is Article 6 (1) (a) GDPR in conjunction with Section 26 (2) BDSG.

Where you voluntarily provide special categories of personal data within the meaning of Article 9 GDPR, such data will only be processed where an appropriate legal basis exists under Article 9 GDPR and Section 26 BDSG.

10. Google Tag Manager

We use Google Tag Manager to centrally manage and technically control tags and technologies used on our website.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Tag Manager enables us to technically manage the services described in this Privacy Policy.

When Google Tag Manager is loaded, technical connection data, in particular the IP address, may be transmitted to Google. We do not use Google Tag Manager itself to create user profiles or analyse website usage.

Our legitimate interest is the efficient and technically reliable management of technologies used on our website. The legal basis is Article 6 (1) (f) GDPR.

Services requiring consent and managed through Google Tag Manager are controlled in accordance with your consent choices.

Google may process personal data outside the European Economic Area. International data transfers are made in accordance with Articles 44 et seq. GDPR.

11. Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics enables us to analyse the use of our website and improve its content, structure, usability and performance.

Depending on the technical configuration, the following information may in particular be processed:

pages and content accessed;
date and time;
website interactions;
approximate geographical information;
browser and device information;
operating system;
referrer information;
campaign information;
pseudonymous identifiers.

Google Analytics uses cookies and similar technologies for these purposes.

The use of Google Analytics requiring consent takes place on the basis of your consent.

The legal basis for storing information on or accessing information from your terminal device is Section 25 (1) TDDDG. The legal basis for subsequent processing of personal data is Article 6 (1) (a) GDPR.

You may withdraw your consent at any time with effect for the future via the consent settings on our website.

The storage period depends on the respective type of data and the settings of our Google Analytics property. Data is deleted when it is no longer required for the purposes described above, unless statutory retention obligations apply.

Google may process personal data outside the European Economic Area. International data transfers are made in accordance with Articles 44 et seq. GDPR on the basis of an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

12. Google Ads and conversion measurement

With your consent, we use Google Ads and related technologies for advertising, conversion measurement and, where applicable, remarketing.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

We use Google Ads to advertise our products and services and to measure whether users interact with our advertisements and subsequently perform certain actions on our website.

Depending on the configuration, the following information may in particular be processed:

advertising and campaign information;
advertisements viewed or clicked;
pages visited;
website interactions;
conversion events;
browser and device information;
IP address;
pseudonymous advertising identifiers.

Google Ads may use cookies and similar technologies, including technologies associated with Google advertising services and domains such as DoubleClick.

Where enabled and covered by your consent, these technologies may also be used to create audiences and for remarketing.

You may withdraw your consent at any time with effect for the future via the consent settings on our website.

Google may process personal data outside the European Economic Area. International data transfers are made in accordance with Articles 44 et seq. GDPR.

13. Microsoft Advertising

With your consent, we use Microsoft Advertising, including Universal Event Tracking (UET), to measure the effectiveness of our advertising campaigns and, where applicable, for remarketing.

The provider for users in the European Economic Area is:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

Microsoft Advertising enables us to determine whether users reached our website through a Microsoft advertisement and subsequently performed certain actions.

The following information may in particular be processed:

advertising and campaign information;
pages visited;
website interactions;
conversion events;
browser and device information;
IP address;
pseudonymous identifiers.

Microsoft Advertising uses cookies and similar technologies. Where enabled and covered by your consent, information collected through UET may also be used to create remarketing audiences.

You may withdraw your consent at any time with effect for the future.

Microsoft may process personal data outside the European Economic Area. International data transfers are made in accordance with Articles 44 et seq. GDPR.

14. Microsoft Clarity

With your consent, we use Microsoft Clarity, a web analytics service provided by:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

Microsoft Clarity helps us understand how visitors interact with our website in order to improve its usability and performance.

Depending on the configuration, the following information may in particular be processed:

pages visited;
clicks;
scrolling and navigation behaviour;
session information;
browser and device information;
IP address;
pseudonymous identifiers.

Clarity may also generate heatmaps and session recordings.

Content in input fields and other website elements containing personal or sensitive information is masked or excluded from recording where required.

Microsoft Clarity uses cookies and similar technologies.

You may withdraw your consent at any time with effect for the future.

According to Microsoft, playback data is generally retained for 30 days. Click and heatmap data and labelled or favourited sessions may be retained for up to nine months.

Microsoft may process personal data outside the European Economic Area. International data transfers are made in accordance with Articles 44 et seq. GDPR.

15. SalesViewer®

We use SalesViewer® technology provided by SalesViewer® GmbH on this website for marketing, market research and optimisation purposes.

JavaScript-based code is used to collect company-related data and corresponding website usage information.

The collected information is processed using a non-reversible one-way function known as hashing. The data is pseudonymised and is not used by us to personally identify individual website visitors.

Our legitimate interest is the analysis of our B2B website, identification of potential business interest and improvement of our marketing and sales activities.

The legal basis is Article 6 (1) (f) GDPR.

Data processed through SalesViewer® is deleted as soon as it is no longer required for the intended purpose and no statutory retention obligations apply.

You may object to the processing at any time with effect for the future. SalesViewer provides an opt-out mechanism for this purpose.

16. OpenAI Ads Conversion Measurement

With your consent, we use conversion measurement technology provided by OpenAI to measure the effectiveness of advertisements displayed through OpenAI advertising services.

For users in the European Economic Area and Switzerland, the relevant entity is:

OpenAI Ireland Limited
1st Floor, The Liffey Trust Centre
117–126 Sheriff Street Upper
Dublin 1, D01 YC43
Ireland

When you click on a SmarAct advertisement displayed through OpenAI and subsequently visit our website, an OpenAI click reference known as oppref may be transmitted as part of the landing page URL.

The OpenAI Pixel may capture this click reference and store it in a first-party cookie in order to associate subsequent conversion events with the relevant advertising interaction.

The following information may in particular be processed:

OpenAI click reference;
browser and device information;
date and time;
source and landing page information;
website interactions;
defined conversion events;
technical information required for attribution and measurement.

We use this information to measure the effectiveness of our advertising campaigns and analyse whether interactions with OpenAI advertisements result in relevant actions on our website.

OpenAI Ads conversion measurement requiring consent is activated only in accordance with your marketing consent.

You may withdraw your consent at any time with effect for the future via the consent settings on our website.

OpenAI may process personal data outside the European Economic Area. International transfers are made in accordance with Articles 44 et seq. GDPR using applicable adequacy decisions or appropriate safeguards such as Standard Contractual Clauses.

17. StackAdapt – Programmatic Advertising and Conversion Measurement

With your consent, we use the StackAdapt programmatic advertising platform to deliver, manage, optimise and measure the effectiveness of digital advertising campaigns.

The provider is:

StackAdapt Inc.
200 Bay Street – South Tower
Unit #2103, PO Box #94
Toronto, Ontario M5J 2J1
Canada

StackAdapt is a demand-side platform (DSP) through which digital advertising campaigns can be delivered, optimised and analysed using data.

Tracking technologies, in particular pixels and cookies, may be used on our website for this purpose.

Where the relevant marketing consent has been given, the following information may in particular be processed:

IP address;
cookies and other pseudonymous online identifiers;
device and browser information including user agent;
referrer and page URL;
information about pages accessed and website interactions;
information about advertisements displayed or clicked;
conversion and campaign information;
other pseudonymous information required for advertising delivery, attribution, measurement and optimisation.

The processing is used in particular to deliver and optimise advertising campaigns, address relevant audiences and measure advertising interactions and conversion events.

StackAdapt technologies requiring consent are activated only in accordance with your marketing consent.

You may withdraw your consent at any time with effect for the future.

StackAdapt's data protection role depends on the relevant processing activity. Depending on the nature and purpose of the processing, SmarAct and StackAdapt may act as joint controllers or as separate independent controllers. For certain limited processing activities, StackAdapt may act as a processor.

According to StackAdapt, pixel data is generally retained for approximately six months, while cookies and similar identifiers are generally retained for approximately one year. Different retention periods may apply in particular where required for legal, regulatory, backup, archival, accounting or audit purposes.

StackAdapt is headquartered in Canada and may also process personal data in other countries or use service providers located there.

International data transfers are made in accordance with Articles 44 et seq. GDPR, in particular on the basis of applicable adequacy decisions or appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

18. Google Maps

Where indicated on our website, we use Google Maps to display maps and geographical information.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

When Google Maps is activated, your IP address, browser and device information and information about the page accessed may in particular be transmitted to Google.

If you are logged into a Google account, Google may associate your use of Google Maps with your account.

Google Maps is activated only in accordance with the consent required for its use.

The legal basis for storing information on or accessing information from your terminal device, where applicable, is Section 25 (1) TDDDG. The legal basis for subsequent processing of personal data is Article 6 (1) (a) GDPR.

You may withdraw your consent at any time with effect for the future.

Google may process personal data outside the European Economic Area. International data transfers are made in accordance with Articles 44 et seq. GDPR.

19. YouTube

We use YouTube to integrate and display video content on our website.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

When a YouTube video is activated, a connection to YouTube or Google servers may be established.

Your IP address, browser and device information and information about the page accessed may in particular be transmitted.

If you are logged into a YouTube or Google account, Google may associate use of the video with your account.

YouTube content is activated only in accordance with the consent required for its use.

You may withdraw your consent at any time with effect for the future.

Google may process personal data outside the European Economic Area. International data transfers are made in accordance with Articles 44 et seq. GDPR.

20. Social sharing functions

Our website may provide social media or social sharing functions relating to services such as Facebook, Instagram or Pinterest.

Where we use the Shariff solution, merely visiting our website does not initially establish a direct connection to the respective social media provider.

A connection to the third-party provider is established only when you actively use the corresponding social sharing function.

From that point onwards, the relevant provider may process your IP address, information about the page visited and, where applicable, information associated with your account with that provider.

The respective third-party provider's own privacy policy applies to subsequent processing.

21. Newsletter and CleverReach

With your consent, you may subscribe to our newsletter. We use it to inform you about products, services, events and other company news.

For technical administration and distribution we use:

CleverReach GmbH & Co. KG
Schafjückenweg 2
26180 Rastede
Germany

CleverReach processes personal data on our behalf in accordance with Article 28 GDPR.

We use the double opt-in procedure for registration. After registration, we send an email to the address provided asking you to confirm your subscription. Your address is added to the newsletter distribution list only after confirmation.

The following information may in particular be processed:

email address;
name, where voluntarily provided;
IP address;
date and time of registration;
date and time of confirmation.

The legal basis for sending the newsletter is Article 6 (1) (a) GDPR.

You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link contained in each newsletter or by contacting us.

Where newsletter analytics are enabled and covered by your consent, information concerning delivery, openings, link clicks, bounced emails and unsubscribes may in particular be processed.

The purpose is to evaluate and improve our newsletter content and communication.

The legal basis for personalised newsletter analytics is Article 6 (1) (a) GDPR.

After unsubscribing, your personal data will no longer be used to send newsletters. Data may continue to be stored where necessary to document consent or withdrawal, comply with legal obligations or establish, exercise or defend legal claims.

22. Rights of data subjects

Under the GDPR, you have in particular the following rights:

Right of access pursuant to Article 15 GDPR
Right to rectification pursuant to Article 16 GDPR
Right to erasure pursuant to Article 17 GDPR
Right to restriction of processing pursuant to Article 18 GDPR
Right to data portability pursuant to Article 20 GDPR
Right to withdraw consent pursuant to Article 7 (3) GDPR
Right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR

You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to object

Where we process your personal data on the basis of Article 6 (1) (e) or (f) GDPR, you have the right under Article 21 GDPR to object at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

To exercise your right of withdrawal or objection, an email to the following address is sufficient:

data.privacy@smaract.com

23. Recipients and international data transfers

We may disclose personal data to processors and other service providers where necessary for the purposes described in this Privacy Policy.

Processors process personal data only in accordance with our instructions and on the basis of an agreement pursuant to Article 28 GDPR.

Recipients may include in particular:

hosting and IT service providers;
analytics and consent management providers;
advertising and measurement providers;
newsletter service providers;
applicant management providers;
other service providers required to provide our website.

Personal data may also be disclosed where we are legally obliged to do so, where disclosure is necessary to establish, exercise or defend legal claims or where another legal basis applies.

Some service providers belong to international groups or use service providers outside the European Economic Area.

Transfers outside the European Economic Area are governed by Articles 44 et seq. GDPR.

Where the European Commission has adopted an adequacy decision, the transfer may be based on Article 45 GDPR.

Otherwise, appropriate safeguards such as Standard Contractual Clauses pursuant to Article 46 GDPR and, where necessary, additional safeguards may be used.

Further information concerning the applicable transfer mechanisms may be requested using the contact details provided in this Privacy Policy.

24. Data security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Data transmitted between your browser and our website is protected in particular by SSL/TLS encryption.

Our security measures are regularly reviewed and adapted in accordance with technological developments and the respective risks.

Completely secure transmission of data over the Internet cannot, however, be guaranteed.

25. Storage period

Unless a specific retention period is stated in the relevant section, we retain personal data only for as long as necessary for the relevant processing purpose.

Longer storage may be required in particular due to statutory retention obligations or for the establishment, exercise or defence of legal claims.

Where processing is based on consent, the relevant processing ceases following withdrawal unless another legal basis permits or requires continued storage.

Once the processing purpose no longer applies and there is no legal basis for continued storage, the data will be deleted or anonymised.

26. External links

Our website may contain links to websites and online services operated by third parties.

When you access an external website, the respective third party is responsible for personal data processing carried out there.

This Privacy Policy does not apply to processing activities carried out independently by external website operators.

We recommend reviewing the privacy information of the relevant third party before providing personal data.

27. Changes to this Privacy Policy

We may amend this Privacy Policy where necessary due to changes to our website, the services we use, our processing activities or applicable legal requirements.

The version published on our website at the time of your visit is the applicable version.

Where a change requires additional consent, we will obtain such consent before the relevant processing takes place.

28. Data Protection Officer

We have appointed a data protection officer:

D & C Datenschutz und Consulting
Dirk Borbe
Belemannweg 15
22419 Hamburg
Germany

Telephone: +49 162 5817253
Email: data.privacy@smaract.com
Website: www.DundC.org

As of August 2026