privacy policy

summary

This policy covers the “SMYRNA Design” app (iOS and Android) and the public pages at dpp.smyrna-design.de, where the digital product passport of an ALLinOne kitchen opens. You do not need an account. The app contains no components for advertising, tracking, usage analytics or crash reporting and uses no advertising ID; the pages set no cookies. The only exception: on Android, Google’s built-in scanning component sends performance and usage data to Google (see “scanning the qr code”).

controller

Smyrna Design GmbH, Seesener Straße 39, 10711 Berlin, Germany, represented by its managing director Pürlen Karaçam. E-mail: info@smyrna-design.de, phone: +49 1520 8126653.

In the app stores, the app appears under the developer account of Berk Hatırlı, who develops it on our behalf. The controller for the processing described here is Smyrna Design GmbH.

downloading the app

When you download the app from the App Store or Google Play, Apple or Google process data such as your account details, the time of download and device identifiers under their own responsibility. We only receive aggregated statistics from them, such as download numbers, and – if you allow it in your device settings – operating system crash reports without names or contact details. On iOS, after installation and regularly thereafter (according to Apple, about once a week), the operating system asks Apple which links to dpp.smyrna-design.de may open in the app. For technical reasons, Apple receives your device’s IP address in the process. Apple obtains this information from our server itself; we receive no data about you.

scanning the qr code

To scan, the app uses your device’s camera. The image is analysed only on the device and only while scanning; the app stores no photos or videos and sends no images to us or anyone else. You grant camera access through the operating system and can withdraw it in your device settings at any time. You can also enter the code by hand.

iOS: the code is recognised with Apple’s functions built into the device. No third parties are involved.

Android: the code is recognised with Google ML Kit, which is built into the app and works on the device. According to Google, camera images and scan results are not sent to Google; however, ML Kit may occasionally contact Google servers (for example for bug fixes, updated models or hardware compatibility information) and sends performance and usage metrics to Google, such as the device model, operating system and app version, an installation identifier and error codes. For technical reasons, Google also receives your device’s IP address. Google says it uses this data to measure performance, fix errors, maintain and improve the feature and detect misuse (Google privacy policy). Processing in the USA is possible; Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is fast and reliable code recognition without images leaving your device.

loading a passport in the app or browser

When you scan or enter a code, the app loads the passport from our server dpp.smyrna-design.de over an encrypted connection (HTTPS). If you scan the QR code with your phone’s camera app instead, the passport opens as a web page in your browser – or, on iOS, in the app if it is installed. In all cases, the passport code (e.g. DPP-4471-EU), which identifies a product and not you, is transmitted along with this connection data:

• IP address
• date and time of the request
• requested address
• status code and amount of data transferred
• user agent (identifier of the requesting software; in a browser, e.g. browser type and operating system)

The server stores the connection data in log files to keep operation secure and stable, fend off attacks and analyse errors. The legal basis is Art. 6(1)(f) GDPR; these purposes are our legitimate interest. The logs are deleted after 14 days at the latest; individual entries are kept longer only if and as long as we need them to investigate a specific security incident. We do not create profiles or combine the connection data with other data.

If an error occurs while a request is being processed, the web server and the application additionally write an entry to an error log. Besides a description of the error, such an entry may contain your IP address, the time, the requested address, the host name and, if your browser sends it, the address of the page you came from (referrer). We use these entries only for the purposes and on the legal basis stated above and delete them after 14 days at the latest.

The public pages set no cookies, use no analytics or tracking services and load no third-party content; even the fonts come from our own server.

saved passports

If you save a passport in the app, the app stores the passport code, the product name, the configuration and a copy of the passport data, with the time it was last updated, on your device so that you can view the passport without an internet connection. The app sends none of this to us or anyone else; we have no access to it. If you open a saved passport while online, the app loads it again as described above and updates the copy. The app keeps no history of the passports you open. You can delete saved passports at any time on the start screen or in the passport; if you delete the app, they are also deleted from your device. If you use your device’s backup (for example via iCloud or Google), they are included in it. Storing them on your device happens only at your request and is strictly necessary for this function (Section 25(2) no. 2 TDDDG).

requests by e-mail

The buttons for requesting a repair, take-back / resale or recycling in the app and on the passport page open your own e-mail program with a prepared message to info@smyrna-design.de whose subject contains the type of request and the passport code. Only when you send the e-mail do we receive its content, such as your name, e-mail address, message and the code. The same applies if you write to us directly.

We use this information only to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the information once the request has been dealt with, unless statutory retention obligations apply: e-mails that qualify as commercial or business letters are generally kept for six years under German commercial and tax law (Section 257 HGB, Section 147 AO; Art. 6(1)(c) GDPR).

hosting and recipients

Our server runs on Oracle Cloud Infrastructure in a data centre in Paris; the data is stored in the EU. A technical service provider operates the server for us. The service provider and the hosting provider process the data only on our behalf and on our instructions (Art. 28 GDPR).

Oracle may also access the server and the data stored on it from outside the EU, for example for support, incident handling or recovery, including through Oracle companies in third countries such as the USA or India. These are transfers to third countries (Art. 44 et seq. GDPR). For them, Oracle relies on its binding corporate rules for processors, approved by the European data protection authorities (Art. 47 GDPR), and on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

The technical service provider administers the server remotely from Türkiye and can access the connection data in doing so. This is a transfer to a third country (Art. 44 et seq. GDPR); there is no adequacy decision of the European Commission for Türkiye. We have therefore concluded the European Commission’s standard contractual clauses with the service provider (Art. 46(2)(c) GDPR); you can request a copy at info@smyrna-design.de.

We use Google Workspace for our e-mail mailbox info@smyrna-design.de. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google processes our e-mail correspondence with you: the content of the messages including attachments, your e-mail address and metadata such as the time and the mail servers involved. This happens only on our behalf and on our instructions (Art. 28 GDPR), under Google’s data processing agreement (Cloud Data Processing Addendum).

Google may also process the data in countries outside the EU where Google or its subprocessors maintain facilities, in particular through Google LLC in the USA. These are transfers to third countries (Art. 44 et seq. GDPR). Google LLC is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR); Google relies on this decision for transfers to the USA. For transfers to other countries without an adequacy decision – and to the USA, should Google no longer rely on the Data Privacy Framework – the European Commission’s standard contractual clauses apply between Google and its subprocessors under Google’s data processing agreement (Art. 46(2)(c) GDPR). Google publishes them at cloud.google.com/terms/sccs.

Recipients of personal data are therefore the technical service provider and Oracle (connection data), Google Cloud EMEA Limited as the provider of our e-mail mailbox, together with subprocessors such as Google LLC (your e-mails), and, on Android, Google (ML Kit). Others receive data only where we are legally obliged to disclose it. We do not sell data.

your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 18, 20 and 21 GDPR). You can withdraw camera access in your device settings at any time. An informal message to info@smyrna-design.de is sufficient.

You are not obliged to provide us with data. Without the connection data, however, the passport cannot be displayed, and without contact details we cannot reply to you. We do not use automated decision-making, including profiling.

right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular where you live. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, www.datenschutz-berlin.de).