Privacy Policy

Protecting your personal data matters to us at Smartboatia GmbH (“Smartboatia”, also “we”, “us”, “our”). We process your personal data only in accordance with the law, in particular Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the German Federal Data Protection Act (BDSG).

This privacy policy covers our site at www.smartboatia.com. It tells you how we process your personal data and what rights you have when you use this website, log in, subscribe to our newsletter, use our support chat with Lotte, or contact us through one of the ways offered here.

Our products (Smartboatia Hub, app and cloud) are covered separately. This policy will be extended as those functions become available on this website. Our shop is described in section 2.7. Logging in with Smartboatia ID is described in section 2.8, the support chat with Lotte in section 2.10.

1. Controller

The controller for the processing described in this privacy policy is

Smartboatia GmbH
Teutendorfer Weg 37
23570 Lübeck
Germany
info@smartboatia.com

Commercial register

District Court Lübeck, HRB 21352 HL

VAT ID

DE343788075

Managing Director

Sina Pieritz

2. Purposes and legal bases of our processing

2.1 Connection data and hosting

When you open our website we collect and process your connection data (for example date, time, the page requested, browser type, volume of data transferred, the requesting provider and your IP address), which your browser transmits automatically to our server. We need this information to make the website usable for you. To detect and fix malfunctions we store this data for a limited period.

Hosting: our website runs on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Processing takes place exclusively in Germany; no transfer to a third country occurs. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Hetzner privacy policy: hetzner.com/legal/privacy-policy

2.2 Cookies and consent

Without consent. Until you have decided, this website stores nothing on your device and reads nothing from it. There are three exceptions that we store and read: if you add something to the cart in the shop, we store your cart’s identifier in your browser (section 2.7). If you log in, we set the cookie __Host-sb_session (section 2.8). We also automatically set the language cookie sb_lang on every page view, as described below. Audience measurement with Umami (section 2.3) runs in this state as well: it works without cookies, without recognition and without personal data, and therefore requires no consent.

The consent banner. On your first visit we show you a banner with three categories:

• Necessary — required for operation, cannot be switched off. This covers only the storage of your cookie decision itself.
• Statistics — analysis of how the website is used.
• Marketing — measuring Google Ads campaigns and conversions, and remarketing: personalised Google ads after you have visited our website (through Google Analytics 4 and Google Ads).

Only Necessary is preselected. Rejecting is exactly as easy as accepting: both buttons stand side by side with equal weight, and nothing is pre-ticked.

With consent. When you allow Statistics, we load Google Analytics 4 by Google Ireland Limited for advertising attribution (section 2.9). If you also allow Marketing, we use it to measure Google Ads campaigns and conversions and use your visits for remarketing, that is, for personalised ads in the Google advertising network. Without Statistics consent we load no Google service, even if you allow Marketing alone. Data may be transferred to Google LLC in the USA (EU-U.S. Data Privacy Framework).

The consent cookie. We record your decision in a cookie called sb_consent, set exclusively by our own domain. It contains the categories you chose, the time of your decision, the time of the last change, the version number of our consent configuration, the language of the interface, and a randomly generated identifier that serves solely to evidence your consent. Lifetime 180 days — the same after a rejection as after an acceptance. No transfer to third parties.

The language cookie. The cookie sb_lang contains only de or en. It makes language-neutral links, for example from Smartboatia ID pages and emails, open in your language. We set it on every page view to the language of that page; its lifetime is 1 year from the last page view. It applies only to the host that sets it (host-only) and carries the attributes Secure and SameSite=Lax. Your browser sends it with every request to our website; it is evaluated only at the language-neutral addresses. It is not logged, used for analytics or passed to third parties. You can delete it in your browser at any time. Like the login cookie, it sits outside the consent categories.

Withdrawal. You can change or fully withdraw your decision at any time via “Cookie settings” in the footer of every page. Withdrawal takes effect immediately and for the future; the lawfulness of processing carried out until then is unaffected.

Changes. If we change the categories, their purposes or the services used within them, we raise the version number. Your previous decision then ceases to be valid and we ask you again.

2.3 Audience measurement with Umami

For audience measurement we use Umami, open-source analytics software that we host ourselves on our own servers in Germany. No data is sent to an analytics provider.

Umami works without cookies and without any recognition identifier. It records aggregate information about a page view — the page requested, the referrer, approximate location at country level, browser and device type, and screen size. Your IP address is not stored; it is used transiently only to derive that information. The data is not combined with other records and does not allow recognition across visits; no personal reference is established.

Because no information is stored on or read from your device and no personal data is processed, neither consent under § 25 TDDDG nor consent under Art. 6(1)(a) GDPR is required.

Objection: you can object to audience measurement at any time, informally, at info@smartboatia.com.

Retention: we keep the event data for 14 months and delete it afterwards. That period allows a year-on-year comparison and goes no further.

2.4 Fonts

Every font used on this website is served from our own server. There is no connection to Google Fonts or any other external provider. No IP address is transmitted to a third party for fonts.

2.5 Contacting us

By email. If you contact us by email, we process the data you provide in order to handle your enquiry.

Through our contact forms. You can write to us through a contact form for private customers or one for business customers. We process:

• as required information, your name, your email address and your message, and in the business form additionally your company,
• optionally, the reason for your enquiry, and in the business form also the number of your boats and your country or region,
• technically, to route your enquiry correctly: whether it comes from our pages for private or business customers, the page from which you submit the form, and its language.

We cannot handle your enquiry without the required information. We do not ask for any other data.

How your enquiry reaches us. Your input is transmitted encrypted (HTTPS) to our web server at Hetzner. From there we forward it, encrypted, to a function at Amazon Web Services (AWS) in its Frankfurt am Main data centre. That function turns it into an email and sends it through the AWS service Amazon Simple Email Service (SES) to the responsible mailbox of our sales team, which we operate on Microsoft 365. We set your email address as the reply-to address so that we can answer you directly.

No storage along the way. AWS does not store your form data; it processes it only to send it. The logs of this function contain technical outcome codes only, neither form content nor your IP address, and are deleted after 14 days. To limit abuse, we count how many enquiries are sent in total per hour and per day, without recording you or your device. If a delivery problem occurs, for example because a message cannot be delivered, we receive an automatic technical notification. It may contain the headers of the affected email and therefore your email address. We use such notifications solely to fix the problem.

Spam protection without tracking. We protect the forms with an additional field that is invisible to humans and with a check that the enquiry comes from our own website. We use no cookies, no CAPTCHA and no third-party service for this.

Storage period. Your enquiry is kept as an email in our sales team’s mailbox. We keep it for as long as is necessary to handle your enquiry and any business relationship that results from it. If your enquiry serves to prepare or carry out a business transaction, it is a commercial or business letter. We retain such letters for six years from the end of the calendar year under section 257 of the German Commercial Code (HGB) and section 147 of the German Fiscal Code (AO), and delete them afterwards. We delete enquiries without such a connection once they have been dealt with.

2.6 Newsletter

If you sign up for our newsletter or our business newsletter, we process your email address; your first name is optional. We also store which of the two newsletters and which language you chose.

Delivery provider. For delivery we use Sendinblue SAS (Brevo), 17 rue Salneuve, 75017 Paris, France (RCS Paris 498 019 298), as our processor. The data processing agreement is Annex 2 of Brevo’s terms of service. Brevo uses sub-processors that partly process data outside the EU/EEA, in particular in the United States. There, the basis is the EU-US Data Privacy Framework or EU standard contractual clauses (Art. 46(2)(c) GDPR).

Double opt-in. After you submit the signup form we send you a confirmation email with a confirmation link. Your signup only takes effect once you click that link, and only then do you receive the newsletter. To evidence your consent we store the time of your signup, the time of your click on the confirmation link, and the IP address used for each.

Tracking in emails. Newsletter emails contain a personalised tracking pixel and personalised links (Brevo). This lets us see whether and when you opened a newsletter email and which links in it you clicked. This serves to improve the newsletter. The confirmation email technically also contains a pixel and redirected links; however, Brevo records opens and clicks of this email only anonymously, without attributing them to you, and we do not evaluate them on a per-person basis.

Retention. If you do not confirm your signup, the confirmation link expires after 30 days; your address is then not added to the newsletter list and receives no further emails. The signup data remains only in Brevo’s sending logs until Brevo deletes it as part of its regular log rotation. We keep confirmed signups for as long as you receive the newsletter. After an unsubscription we delete your address from the list; we keep the evidence of your consent (the times of signup and confirmation, the IP address, the form) for a further three years from the end of the year of the unsubscription in order to be able to prove your earlier consent, and delete it afterwards.

Unsubscribing. You can unsubscribe from the newsletter at any time via the unsubscribe link in every email, or informally at info@smartboatia.com. Unsubscribing also ends the evaluation of your opening and click behaviour.

2.7 Shop

In our shop at /en/shop/ you can buy Smartboatia products and subscriptions. The following applies:

Provider. We run the shop on the Shopify platform. Shopify processes the data named in this section on our behalf. The contracting party is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. A data processing agreement under Art. 28 GDPR is in place with Shopify; it forms part of Shopify’s Terms of Service as the “Shopify Data Processing Addendum”.

Product pages. When you open a page of the shop, your browser loads the product images directly from Shopify at cdn.shopify.com. On the individual product pages your browser also retrieves current product data such as prices, availability and subscription options directly through Shopify’s Storefront interface at smartboatia.myshopify.com. With both connections Shopify receives your IP address and the usual technical details of your browser.

Cart. When you add something to the cart, your browser creates a cart at Shopify through the same interface and updates it with every change. In doing so it transmits your IP address, the chosen products, variants, subscription options and quantities, and the attributes of the cart. If your cart contains a subscription and you expressly request that we begin the digital service before the withdrawal period expires, we store the time of that declaration as the attribute _sb_withdrawal_waiver on your cart. If you then change a subscription in the cart, we remove this attribute again and you make the declaration anew if needed. As long as a cart exists, your browser retrieves it from Shopify when you open our consumer pages, in order to show the number of items. Without a cart, our pages outside the shop make no connection to Shopify. Shopify automatically deletes carts that are not completed no later than 30 days after they were created, and deletes a cart as soon as its checkout is completed.

Storage in your browser. After the first addition we store, in your browser’s local storage under the name sb_shop_cart, only the identifier of your cart at Shopify, so that it is still there the next time you open a page. The entry contains nothing else, has no expiry date and is used only to retrieve your cart from Shopify. We delete it automatically as soon as Shopify no longer knows the cart. You can delete it yourself at any time by clearing the site data for www.smartboatia.com in your browser.

Checkout. With “Checkout” you leave our website and move to Shopify’s checkout at shop.smartboatia.com. In doing so your browser also transmits your cart through Shopify’s Storefront interface at smartboatia.myshopify.com. Shopify’s privacy policy applies to the processing on those pages.

Third-country transfers. Shopify may transfer data to countries where Shopify, its affiliated companies or its service providers are located, including Canada and Singapore. For Canada, the European Commission has adopted an adequacy decision (Art. 45 GDPR). Otherwise, Shopify bases transfers on binding corporate rules (Art. 47 GDPR) and on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

2.8 Logging in with Smartboatia ID

You can log in at the top of every page. “Log in” takes you to the Smartboatia ID login at id.smartboatia.com (Keycloak, realm “smartboatia”). You enter your password only there, never on this website. A service of our platform, the website BFF (“backend for frontend”), runs the process. Every request your browser makes for it goes through our own domain.

What we process. After a successful login the website BFF receives from Smartboatia ID your account identifier, your name (if one is on file), your email address, whether that address is confirmed, and your language setting. It stores these details together with the access credentials (tokens) of Smartboatia ID in the login service’s database. The database is stored encrypted (encryption at rest), and we additionally encrypt the tokens ourselves. Your browser never receives the access token or the refresh token. When you log out, your browser passes the ID token once to Smartboatia ID so that it ends the login there. Session times, such as the time of last use, are added. We show your name and email address in the header of the page.

What your browser stores. On www.smartboatia.com we set exactly one cookie for the login: __Host-sb_session. When you start the login we first set it as a temporary cookie (10 minutes; after an abandoned login it can remain in your browser until then), and after a successful login we replace it with the session cookie. It is a random session key with no content of its own, carries the attributes HttpOnly, Secure and SameSite=Lax, and belongs only to the address you are on (no Domain attribute). We set it only when you start the login yourself. Your browser does not store your name, your email address or the credentials, not even in local or session storage. On id.smartboatia.com, Smartboatia ID sets its own strictly necessary cookies. On the login page these are AUTH_SESSION_ID and KC_RESTART (until you close the browser) and KC_AUTH_SESSION_HASH (60 seconds); these three are Secure and limited to the path /realms/smartboatia/. After a successful login, Smartboatia ID keeps you logged in with its own strictly necessary cookies. The Smartboatia ID session ends when you log out, after 14 days without use, at the latest after 30 days.

Check on every page. So the header can show whether you are logged in, your browser asks our server on every page (/api/account/me). Without the cookie the answer is “not logged in”. As with every request, your IP address is processed (section 2.1). The check stores nothing in your browser, and we do not pass details from your account to audience measurement (section 2.3).

Duration and logging out. When you start the login the cookie first lasts 10 minutes. After a successful login it lasts at most 30 days from the login; if you stay inactive for 14 days the session ends sooner. The server enforces both. With “Log out” we delete the session on the server at once and the cookie in your browser, log you out of Smartboatia ID, and send you back to the home page.

Place of processing and retention. We run Smartboatia ID and the website BFF at Amazon Web Services (section 3) in the Frankfurt am Main region, Germany. Smartboatia ID logs logins and logouts including your IP address; we delete these entries after 30 days. We keep the data of your Smartboatia ID account for as long as your account exists. You can have your account deleted by writing to us at info@smartboatia.com.

2.9 Google Analytics 4

With your consent we use Google Analytics 4 (GA4) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its purpose is to attribute visits to Google Ads campaigns and import conversions to measure the effectiveness of our advertising. With your Marketing consent, remarketing is added as a purpose of its own (see below). Our independent audience measurement with Umami (section 2.3) is unaffected.

Data and consent. GA4 processes details of pages viewed, interactions, referrers and campaigns, device and browser information, and cookie identifiers. Google also receives your IP address when a connection is made. We send no Smartboatia ID, user ID or properties from your account to GA4. The loader script comes from www.googletagmanager.com.

We load it only after you allow Statistics. Before that there is no connection to Google and no GA4 cookie, including no consent-free measurement signals to Google. Before loading, we set every Google Consent Mode v2 signal to “denied”. We then grant only the categories you allow: Statistics permits analytics storage; Marketing additionally permits advertising storage, use of data for advertising and personalisation of advertising. Without Marketing consent these three advertising signals remain denied. Marketing alone does not load GA4. Google Signals is switched off: GA4 does not link your visits across devices through signed-in Google accounts.

Remarketing. If you also allow Marketing, we use your visits for remarketing as a purpose of its own: from visits to our website we build audiences in GA4 and use them through the link with Google Ads to show people who have visited our website personalised ads from us in the Google advertising network. For this, Google may set or read its own cookies on Google domains (for example doubleclick.net); their lifetime is set by Google, not by us. Without Marketing consent there is no remarketing.

Cookies. GA4 cookies are set only for the host you are visiting, not for parent domains.

With additional Marketing consent, cookies with the prefixes _gcl_* and _gac_* may be used for advertising attribution; for remarketing, Google may also use its own cookies on Google domains (see above). When you withdraw the relevant category, we delete its cookies on our domain. We cannot delete cookies on Google domains; you can do so in your browser.

Retention and export. Retention in GA4 is 2 months. For analysis we export event data daily to Google BigQuery in the EU multi-region. We retain this data for 14 months and then delete it.

Withdrawal. You can change your choice at any time through “Cookie settings” in the footer. If you withdraw Statistics, we set all signals to “denied”, disable GA4 for this page and delete the statistics cookies. If you withdraw Marketing, we set all three advertising signals (advertising storage, advertising data and advertising personalisation) to “denied”, send no further data for remarketing and delete the marketing cookies on our domain. Data already collected remains stored until the stated retention periods end. The lawfulness of processing before your withdrawal is unaffected.

2.10 Support chat with Lotte

On this website you can ask our AI assistant Lotte questions about the Hub, the app, subscriptions and the shop. Lotte is an AI system, not a person. Her answers are generated by a language model from Anthropic. Lotte can make mistakes; our handbook and our terms and conditions are binding.

What we process. Your messages and Lotte’s answers, the language of the page, the page from which you open the chat, and the time. Please do not enter passwords, payment details or other sensitive information in the chat. Before we store a conversation, we automatically remove email addresses and phone numbers from the text. This filter does not catch everything, for example names or postal addresses.

No identifier, no cookie. The chat sets no cookies and stores no identifier that recognises you. To limit misuse, we count requests per sender. For this we derive a pseudonym from your IP address that changes daily (a cryptographic hash). We do not store the IP address itself; the pseudonym expires after 25 hours at the latest.

In the Smartboatia app. In the app’s chat you are logged in with your Smartboatia ID. So that Lotte can answer to the point, the app also sends the version of the app and of your Hub, your subscription tier and, where set, your boat type with your question. Instead of an IP pseudonym, we store a hash of your account identifier to limit misuse and to assign your conversations, never the identifier itself, your name or your email address.

Processing by Anthropic. For each answer we send the conversation so far and our website knowledge to Anthropic. Anthropic processes this data as our processor solely to generate the answer and may not use it to train its models. Processing takes place in the USA (section 3). Anthropic deletes inputs and outputs within 30 days unless longer retention is required to prevent misuse or by law.

Handover to our team. If Lotte cannot help, she offers to hand your request over to our team. Only if you want this do you enter your name and email address in a separate form. Lotte then summarises the conversation. Our support team receives the summary and your contact details as a ticket in Jira by Atlassian (technical requests), or our sales team receives them by email (purchase, order, invoice). You receive a confirmation by email. After the handover we delete the conversation in the chat system; the chat system does not store your name or email address.

Retention. We automatically delete conversations without a handover after 90 days. During that time we use them to find errors and improve Lotte’s answers. Handed-over requests are retained like enquiries from the contact form (section 2.5). For cost control we store only technical usage figures per answer, without content.

Place of processing. We run the chat system on Amazon Web Services in the Frankfurt am Main region, Germany.

3. Recipients of your personal data and third-country transfers

In connection with this website we use the following processors. A data processing agreement under Art. 28 GDPR is in place with each of them.

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — hosting of this website (section 2.1). Processing exclusively in Germany.
• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg — forwarding and sending of enquiries from the contact forms (section 2.5). Processing in the Frankfurt am Main data centre, Germany. Also operation of Smartboatia ID and the website BFF for the login (section 2.8) and of the support chat (section 2.10), each in the Frankfurt am Main region. Privacy notice: aws.amazon.com/privacy
• Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland — email mailboxes (Microsoft 365) in which your enquiry arrives, whether by email or through a contact form (section 2.5). Processing within the EU. Privacy statement: microsoft.com/en-us/privacy/privacystatement
• Sendinblue SAS (Brevo), 17 rue Salneuve, 75017 Paris, France — delivery of the newsletter, if you subscribe to it (section 2.6).
• Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland: product images, product data, cart and checkout of the shop (section 2.7).
• Anthropic Ireland, Limited, Dublin, Ireland: generating the answers in the support chat (section 2.10). Processing in the USA. Privacy policy: anthropic.com/legal/privacy
• Atlassian Pty Ltd, Sydney, Australia: support tickets from a handover in the support chat (Jira, section 2.10). The storage location is not limited to the EU. Privacy policy: atlassian.com/legal/privacy-policy

Further recipient with consent. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, receives data for Google Analytics 4 and for conversion measurement and remarketing with Google Ads (section 2.9). Data may be transferred to Google LLC in the USA. The basis is the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR), supplemented by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Third-country transfers. AWS and Microsoft process your data in the EU. Both, however, belong to groups headquartered in the USA (Amazon.com, Inc. and Microsoft Corporation respectively). Access from the USA, for example in the course of support or on the basis of orders from public authorities, therefore cannot be entirely ruled out. For that case both parent companies are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision under Art. 45 GDPR. In addition, the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR apply; they form part of the data processing agreements with both providers. Brevo also uses sub-processors that partly process data outside the EU/EEA, in particular in the United States; there, the basis is likewise the EU-US Data Privacy Framework or EU standard contractual clauses (Art. 46(2)(c) GDPR). For transfers by Shopify, see section 2.7. Anthropic processes the content of the support chat in the USA; the basis is the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR, which form part of the data processing agreement with Anthropic. Atlassian may process ticket data outside the EU/EEA, in particular in the USA and Australia; the basis is the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) and, for transfers to the USA, Atlassian’s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

4. Erasure of your personal data

We erase your personal data as soon as processing it is no longer necessary for the purposes described in this privacy policy. Where statutory retention obligations prevent erasure, we restrict processing to that archiving purpose and erase the data once the retention period expires. Special retention periods for newsletter signup data are described in section 2.6; for session and account data of the login, section 2.8 applies. We delete support chat conversations after 90 days, and immediately after a handover to our team (section 2.10). We retain GA4 data for 2 months and event data exported to BigQuery for 14 months (section 2.9), including after withdrawal.

Under German commercial and tax law such obligations exist in particular for business correspondence, for six years to the end of the year, and for accounting records, for eight years to the end of the year.

5. Your rights

As a data subject you have the following rights, subject to the applicable statutory conditions:

• the right to confirmation as to whether we process your personal data, and to access that data and a copy of it (Art. 15 GDPR);
• the right to rectification where your personal data is inaccurate (Art. 16 GDPR);
• the right to erasure of your personal data (Art. 17 GDPR);
• the right to restriction of processing (Art. 18 GDPR);
• the right to data portability (Art. 20 GDPR).

Where processing is based on Art. 6(1)(e) or (f) GDPR you may also object to that processing under the conditions of Art. 21(1) GDPR.

You also have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR). The authority responsible for us is: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

To exercise your rights, please contact: info@smartboatia.com

6. No automated individual decision-making

Your personal data is not used for automated individual decision-making within the meaning of Art. 22(1) GDPR. Lotte (section 2.10) does not make decisions about you either: she answers questions; only our team makes commitments, refunds or contract changes.

7. Changes to this privacy policy

New legal requirements, business decisions or technical developments may make changes to this privacy policy necessary. The policy will then be amended accordingly. The current version is always available on our website.