This privacy policy explains which personal data we process when you visit our website www.smgsociety.com, place an order with us or contact us, what we use it for and what rights you have.

1. Controller

Stamnitz Automotive GmbH
Griembergweg 30
12305 Berlin
Germany

Represented by the managing directors Dominik Stamnitz, Ralf Stamnitz and Philipp Stamnitz
Phone: +49 30 585839000
Email: info@smgsociety.com

We have not appointed a data protection officer, as we are not required to do so. If you have any questions about data protection, please use the contact details above.

2. Legal bases

We only process personal data if one of the following legal bases of the General Data Protection Regulation (GDPR) permits it:

  • Consent (Art. 6(1)(a) GDPR), for example for statistics and advertising. Where we store or read information on your device for this purpose, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) is an additional legal basis. You can withdraw your consent at any time with effect for the future.
  • Contract and pre-contractual measures (Art. 6(1)(b) GDPR), for example to process your order or to answer an enquiry about products and repairs.
  • Legal obligation (Art. 6(1)(c) GDPR), for example retention obligations under commercial and tax law.
  • Legitimate interest (Art. 6(1)(f) GDPR), for example for the secure and reliable operation of the website or the prevention of payment fraud. We state our specific interest in the following sections.

Information on your device that is strictly necessary for a service you have requested (for example the shopping cart) is stored without consent on the basis of Section 25(2) No. 2 TDDDG.

3. Hosting and server log files

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, on servers in data centres in Dresden, Germany. The host processes data on our behalf; we have concluded a data processing agreement with it in accordance with Art. 28 GDPR. Emails from the shop, such as order confirmations, are also sent via our own mail server.

Each time you visit our website, your browser automatically transmits information that is stored in log files (server log files):

  • IP address
  • date and time of access
  • page accessed and amount of data transferred
  • website from which you came to us (referrer)
  • browser type and version, operating system

We need this data to deliver the website, to ensure its stability and security and to fend off attacks. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). The log files are stored only for a limited period and are then deleted automatically, unless a security incident requires them to be kept longer.

The website is transmitted in encrypted form via HTTPS.

4. Cookies and consent management

We use cookies and similar technologies (for example your browser’s local storage). These are small data records that are stored on your device and read again on later visits.

Strictly necessary cookies are set without consent, for example for the shopping cart, the customer account, the selected language and storing your cookie choices (Section 25(2) No. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).

All other cookies and services (statistics, advertising and Google Maps) are only loaded after you have consented in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, these services are not loaded and no data is transmitted to them.

We use the WordPress plugin Complianz to manage consent. It stores your choices in cookies on your device (names starting with “cmplz_” or “wp_consent_”) for 365 days. Your choices are not transmitted to Complianz and are not logged on our server.

Changing or withdrawing consent: You can change or withdraw your choices at any time via our Cookie Policy. There you will also find a complete list of the cookies used, with their purpose and storage period.

5. Orders and customer account

When you place an order in our shop or commission a repair, we process the data we need for the contract: name, billing and delivery address, email address, telephone number, for businesses the VAT identification number, the items ordered and the payment method. The legal basis is Art. 6(1)(b) GDPR. Mandatory fields are marked; without this information we cannot process the order.

We check VAT identification numbers via the European Commission’s VAT Information Exchange System (VIES) to determine whether the conditions for a tax-exempt supply are met (Art. 6(1)(c) GDPR).

You can create a customer account. In it we store your details and orders so that you do not have to enter them again for future purchases. You can have your account deleted at any time; data that we must keep for commercial or tax law reasons remains stored in restricted form until the end of the retention period.

6. Payment

Depending on the payment method you choose, we pass on the data required for payment to the respective payment service provider (Art. 6(1)(b) GDPR):

  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. You will be redirected to PayPal for payment. PayPal may transmit data to credit agencies for identity and credit checks. PayPal’s privacy policy applies.
  • Credit and debit card via Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your card details directly into an input field provided by Stripe; they do not reach our server. To prevent fraud, Stripe loads a script from Stripe servers in the shopping cart and at checkout and sets cookies (“__stripe_mid”, “__stripe_sid”). The legal basis for this is our legitimate interest in secure payments (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG). Stripe’s privacy policy applies.
  • Bank transfer (prepayment): Payment is processed via your bank and ours.
  • Cash payment on collection: No data is transmitted to third parties.

7. Shipping

For delivery, we pass on your name and delivery address to the shipping company you have chosen (Art. 6(1)(b) GDPR): DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, or DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany. For shipments outside the EU, we also transmit the information required for the customs declaration, including to the customs authorities (Art. 6(1)(c) GDPR).

We also pass on your email address and telephone number to DHL so that DHL can notify you of the delivery, contact you with any questions and handle customs clearance for international shipments. The legal basis is Art. 6(1)(b) GDPR insofar as the information is required for delivery or customs clearance, and otherwise our legitimate interest in smooth delivery (Art. 6(1)(f) GDPR).

8. Contact

If you contact us by email, telephone, fax or via a form on the website (contact form, service order form), we process your details in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract or an order, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The forms store the details on our server and send them to us by email.

WhatsApp: You can send us messages via WhatsApp at +49 30 585839000, for example diagnostic videos. In this case, WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, processes your data under its own terms. Only use WhatsApp if you agree to this; other ways of contacting us are available to you.

Contact buttons: The buttons at the edge of the page (Chaty plugin) are simple links to Facebook Messenger and to our email address. A connection to Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) or to your email program is only established when you click on them. The plugin merely stores in your browser whether the window is open.

9. Statistics with Google Analytics

Only if you have consented to the Statistics category in the cookie banner do we use Google Analytics 4, integrated via the MonsterInsights plugin. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics analyses how visitors use our website: pages viewed, time spent, source of the visit, device and browser, approximate location, clicks, scroll depth and shop activity (items viewed, shopping cart, orders with order value). We use this to create aggregated reports in order to improve our offering. Google Analytics 4 does not store IP addresses. We filter out personal information such as email addresses before transmission.

Google Analytics sets the cookies “_ga” and “_ga_<ID>” with a lifetime of up to 2 years. Google deletes individual event data after 2 months and user-level data 14 months after your last visit. Google processes the data on our behalf; we have concluded a data processing agreement with Google. Data may be transferred to Google LLC in the USA (see section 16).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the Cookie Policy.

10. Advertising with Google Ads

We place advertisements via Google Ads. Only if you have consented to the Marketing category do we load the Google Ads tag for this purpose. It serves two purposes:

  • Conversion tracking: We find out whether visitors who come via one of our ads make a purchase. This is how we measure the success of our ads. For this purpose, Google sets the cookie “_gcl_au” (lifetime 90 days), among others.
  • Remarketing: Google may later show our ads to visitors of our website on other websites or in Google Search.

Google processes some of this data under its own responsibility. Data may be transferred to Google LLC in the USA (see section 16). You can also deactivate personalised advertising from Google at https://adssettings.google.com.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the Cookie Policy.

11. Origin of orders

Only with your consent to the Marketing category does our shop system WooCommerce store in cookies (names starting with “sbjs_”) how you came to us: search engine, advertisement, referring website or direct visit, plus device type and number of pages viewed. If you place an order, we store this information with the order in our shop in order to see which channels lead to sales. The data is not transmitted to third parties. The cookies expire after up to 6 months. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

12. Google Maps

On our workshop map we embed maps from Google Maps (provider: Google, see section 9). The map only loads once you have consented to the Marketing category or enabled it on the map itself. Your browser then transmits, among other things, your IP address to Google; data may be transferred to the USA (see section 16). If you enter a location in the search of the workshop map, this entry is also transmitted to Google. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

13. Fonts

The fonts on our website are stored on our own server. No connection to Google or other font providers is established when the page loads.

14. Links to social networks

On our website, we link to our page on Facebook. This is a simple link, not an embedded plugin: data is only transmitted when you click the link and thereby visit the page of Meta Platforms Ireland Limited. Meta’s privacy policy applies there.

15. Recipients

Your data is only received by parties that need it for the purposes stated:

  • Service providers who work on our behalf and according to our instructions (Art. 28 GDPR): hosting (section 3), inventory management and order processing, customer communication and telephony. We have concluded data processing agreements with these service providers.
  • Payment service providers and shipping companies (sections 6 and 7)
  • Google, insofar as you have consented (sections 9, 10 and 12)
  • our tax advisors within the scope of statutory obligations
  • authorities, insofar as we are legally obliged to do so, for example tax and customs authorities

We do not sell your data.

16. Transfers to countries outside the EU

Some of the providers mentioned (Google, Meta, PayPal, Stripe) belong to groups of companies based in the USA. Data may be transferred to the USA in this context. On 10 July 2023, the European Commission adopted an adequacy decision for the USA (EU-US Data Privacy Framework). It applies to companies certified under this framework. Where certification does not apply, the providers base the transfer on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

If we ship goods to countries outside the EU, we transmit the data required for delivery and customs clearance to the destination country, as this is necessary for the performance of the contract (Art. 49(1)(b) GDPR).

17. Storage period

We only store personal data for as long as is necessary for the respective purpose or required by law:

  • Orders and invoices: 10 years for accounting records, 6 years for commercial and business correspondence (Section 147 German Fiscal Code, Section 257 German Commercial Code), in each case from the end of the calendar year
  • Enquiries without an order: until the enquiry has been dealt with; we then delete them unless there is a retention obligation
  • Customer account: until you have it deleted
  • Cookies: as stated in the Cookie Policy

18. Your rights

You have the right

  • to information about your data stored by us (Art. 15 GDPR),
  • to rectification of inaccurate data (Art. 16 GDPR),
  • to erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
  • to data portability (Art. 20 GDPR),
  • to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: If we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

For all requests, a message to the contact details in section 1 is sufficient.

19. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin, Germany.

20. Obligation to provide data, automated decision-making, status

For an order, we need the information marked as mandatory; without it, we cannot conclude the contract. Beyond that, you are not obliged to provide us with any data. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We will update this privacy policy if our website or the legal situation changes.

Status: October 2026