Data privacy

This privacy policy explains how personal data is processed when you visit smart-product-people.com, contact us or purchase our services.

The controller is:
Andreas Kogler
Probsteiweg 5
69181 Leimen
Germany

E-mail: hallo@smart-product-people.com
Phone: +49 (0) 6224 98 79 880

If you have questions about the processing of your data or wish to exercise your rights, you can contact us directly.

Our website is delivered through Cloudflare. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare delivers the pages and files and protects the infrastructure against attacks.

Cloudflare processes, in particular, your IP address, requested URLs, access times and technical information about your browser, connection and traffic. The purpose is to provide the website reliably, quickly and securely. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to maintain a functioning and protected website.

Cloudflare processes data worldwide, including in the USA. For international transfers, Cloudflare provides, in particular, EU Standard Contractual Clauses and relies on its EU–US Data Privacy Framework certification for covered transfers to the USA. Information about these safeguards is available in the Cloudflare Data Processing Addendum. Further details about data processing and storage are provided in the Cloudflare Privacy Policy.

Access and security data is retained only for as long as necessary to deliver and operate the website and investigate disruptions or attacks. Specific security incidents may require longer retention for investigation or legal proceedings.

We use CCM19 to obtain and store your choices regarding optional services. The provider is Papoo Software & Media GmbH, Germany. Your selection, a consent identifier and technical information about your visit are processed for this purpose. Your preference is stored in local browser storage; the configured validity period is up to 365 days.

The management and documentation of your consent are based on Article 6(1)(c) GDPR in conjunction with our documentation obligations. Technically necessary storage is covered by Section 25(2) TDDDG. Information: CCM19 privacy information.

We load Hotjar and Amplitude only if you consent to the respective service. The existing bundle of Google Analytics, Google Ads, Meta Pixel and Brevo website tracking is loaded through Google Tag Manager and starts only if you give full consent in the cookie dialog. If you reject or give only partial consent, this bundle remains disabled. The legal basis is Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. You can change or withdraw your consent at any time using the Cookie settings here in this privacy policy. Processing carried out before withdrawal remains lawful. Our content and services remain available without consent.

On the training page, you can separately enable our LinkedIn feed through Elfsight. The external widget loads only after you do so. Elfsight receives technical data such as your IP address, operating system and browser type and may use the “elfsight_viewed_recently” cookie to count views. Permission applies only to the current page visit. You can withdraw it using “Hide feed & withdraw permission” below the feed; the page reloads and the widget remains disabled. Further information is available in the Elfsight Privacy Policy.

Fonts and images are served locally with the website. Payment and appointment booking services are not embedded as external forms on these pages.

With your consent, we use Hotjar, provided by Hotjar Limited, Malta, to improve the usability of our website. Hotjar can analyse page views and interactions, such as clicks, scrolling and mouse movements, as heatmaps and session recordings. Device and browser information, usage identifiers and technical connection data are also processed. Cookies and similar storage technologies enable visits to be recognised.

Retention of analytics data depends on the functions and retention settings selected in the Hotjar account. Information about processing, international transfers and deletion is available in the Hotjar Privacy Policy and the Data Processing Agreement. You can stop further collection by withdrawing consent in our cookie settings.

With your consent, we use Amplitude, Inc., USA, to analyse the use of our website. The integration records, in particular, page views, sessions, referral information, file downloads and form interactions where these occur on the pages you visit. Device and browser information and a pseudonymous device or session identifier are processed. Cookies and browser storage may be used for recognition.

The existing integration uses the US region. Personal data may therefore be processed in the USA. Amplitude provides safeguards including Standard Contractual Clauses and is certified under the EU–US Data Privacy Framework. Information about processing and transfer safeguards is available at Amplitude privacy and security. Retention depends on the project's selected retention settings. You can withdraw consent to further collection at any time through our cookie settings.

We use Google Tag Manager to deliver Google Analytics 4, Google Ads, Meta Pixel and Brevo website tracking. Google Tag Manager and Google's analytics services are provided by Google Ireland Limited, Ireland. Tag Manager loads and manages the respective scripts. Google receives technical connection data, particularly your IP address, as soon as it loads. We therefore load Tag Manager itself only after your full consent.

Google Analytics 4: We use this service to analyse page views, referral sources and interactions to improve our content and services. Data processed includes visited pages, events, device and browser information and cookie identifiers. Cookies such as “_ga” enable visits and sessions to be associated.

Google Ads: We use the existing Google Ads integration to measure the impact of our advertising and attribute visits or conversions to ads. This may involve processing ad click identifiers, page views, conversion events and technical connection data, and using cookies for recognition.

The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Google companies and service providers, including in the USA. Information about processing, retention and transfer safeguards is available in the Google Privacy Policy, den Google cookie information and the Google Analytics privacy information. Specific retention depends on the settings of the Google accounts used. You can withdraw consent to further collection through our cookie settings.

With your consent, Meta Pixel is loaded through Google Tag Manager. The provider is Meta Platforms Ireland Limited, Ireland. It records, in particular, page views and configured conversion events, along with technical information including IP address, browser data and cookie identifiers. We use this analysis to measure the impact of our advertising. Meta may associate the data with an existing Facebook or Instagram account and process it for advertising purposes.

The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. Collection and transmission of event data are subject to joint controllership with Meta under Article 26 GDPR; details are set out in the Joint Controller Addendum. Further processing by Meta, international transfers including to the USA, retention and data subject rights are explained in the Meta Privacy Policy. You can stop further collection on our website by withdrawing consent in our cookie settings.

In addition to contact management, we use the website tracker provided by Brevo GmbH, Germany, with your consent. It is loaded through Google Tag Manager. Brevo can record page views, visit identifiers and technical usage information. Cookies and similar technologies enable recognition. Where Brevo can identify a visitor, events may be associated with that visitor's contact profile.

This helps us understand website use and how visitors become interested in our services. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. The tracker does not load without full consent in the cookie dialog. Rejecting website tracking does not prevent us from handling a request you explicitly send us.

Information about how it works is available in the Brevo tracker documentation. Information about processing, recipients, international transfers and storage is provided in the Brevo Privacy Policy. You can withdraw consent to further collection at any time through our cookie settings.

When you contact us, we process the information you provide, particularly your name, email address or telephone number and the content of your message, to handle your request.

For enquiries about our services or an existing contract, processing is based on Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to respond appropriately to your request.

You decide what information to provide. Without a way to contact you and the information necessary to handle your request, we may be unable to respond.

Our email mailbox is operated by 20i Ltd, Hawthorn House, Southwell Road West, Mansfield, Nottinghamshire, NG21 0HJ, United Kingdom. For this purpose, 20i processes message content, sender and recipient addresses and technical delivery information. Transfers to the United Kingdom are covered by a European Commission adequacy decision under Article 45 GDPR. Information: 20i privacy information and 20i data processing information.

We use Brevo to manage prospective and existing customer contacts. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

We manage contact details and information necessary to handle enquiries or customer relationships, such as processing status and previous communications. This contact management is separate from the optional Brevo website tracking described below. Sending newsletters and measuring email opens and clicks are not part of this integration.

For pre-contractual enquiries and existing contracts, the legal basis is Article 6(1)(b) GDPR. Otherwise, structured contact handling is based on Article 6(1)(f) GDPR. Our legitimate interest is clear and reliable communication.

Further information about the service and its data processing is available in the Brevo Privacy Policy.

Purchase buttons lead to external Stripe payment pages. Simply visiting our service pages does not load Stripe payment software.

If you open a payment link and purchase a service, Stripe processes the contact, order and payment data necessary for payment, along with technical connection information. For European users, Stripe Payments Europe, Limited, Ireland, is involved in particular. Stripe also processes data to prevent fraud and meet its own legal obligations.

We receive the information needed to identify and fulfil your order, particularly contact and order details and payment status. The legal basis for our contract and payment processing is Article 6(1)(b) GDPR; legal documentation and retention obligations are based on Article 6(1)(c) GDPR. An order cannot be processed without the necessary information.

Stripe also processes data outside the European Economic Area. Information about the companies involved, transfer safeguards and retention is available in the Stripe Privacy Policy.

Our pages link to other services, including the Job Leveling Matrix at jlm.smart-product-people.com. This privacy policy describes the website provided here. For separate applications and linked pages, please refer to the privacy information provided there. When you open a linked page, its operator receives, in particular, the technical data required to establish the connection.

We store personal data for as long as necessary for the relevant purpose. We delete enquiry and contact management data once the matter is fully resolved and no ongoing customer relationship or other legal basis requires its retention.

Contract, payment and business records may be subject to statutory retention obligations. During these periods, we restrict processing to the necessary purposes. Further retention may be required to assert or defend legal claims; the applicable limitation periods then determine retention. The data is deleted once these reasons no longer apply.

Subject to the applicable legal requirements, you have the following rights:

• Access to information about the processing of your data under Article 15 GDPR,
• Rectification of inaccurate data and completion of incomplete data under Article 16 GDPR,
• Erasure under Article 17 GDPR,
• Restriction of processing under Article 18 GDPR,
• Data portability under Article 20 GDPR, where processing is based on consent or a contract and carried out by automated means.

Where processing is based on your consent, you may withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.

Right to object: Where we process data on the basis of Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.

To exercise your rights, simply send a message to hallo@smart-product-people.com.

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work or the alleged infringement.

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg is responsible for our registered location in Baden-Württemberg. Contact details and complaint options are available at www.baden-wuerttemberg.datenschutz.de/beschwerde/.

Last updated: 11 September 2026.

We update this privacy policy if the processing of your data or legal requirements change. The version published on this page applies.