Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Smack That GbR

Represented by the partners Ussama Hemdan, Haroun Khalil Ibrahim and Bilal Bouamama

Email: info@smackthat.de

No data protection officer has been appointed.

2. Hosting

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes the data generated when the pages are accessed on our behalf. This is based on a data processing agreement pursuant to Art. 28 of the General Data Protection Regulation, GDPR (DSGVO).

This may involve data being transferred to the USA. Vercel bases this transfer on the European Commission’s Standard Contractual Clauses (SCC). The server-side functions of this website run in Vercel’s Frankfurt am Main region; the pages are delivered via Vercel’s global network.

The legal basis is our legitimate interest in operating the website securely and efficiently, Art. 6(1)(f) GDPR.

3. Access data and server log files

When you visit this website, data sent by your browser is transmitted automatically. This includes in particular:

• the address (URL) accessed and the date and time of access
• the amount of data transferred and a notification of successful retrieval
• browser type and version, operating system used
• IP address of the requesting device

This data is technically necessary to deliver the site and serves to keep it operating securely. The legal basis is Art. 6(1)(f) GDPR. This data is not combined with other data sources.

When you submit a form, the server counts requests per IP address to prevent misuse. This happens in memory only; the IP address is not stored permanently.

4. Contact by email and contact form

If you send us an email, we process the information you give us solely to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual measures, otherwise Art. 6(1)(f) GDPR.

You can also write to us using the form on the contact page. In this case, we process your name, your email address, the topic you choose and your message. The sole purpose is to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at a contract, for example for catering, otherwise our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR.

The message is sent as an email to our mailbox and is not stored on the website’s server. We use Resend as a processor to send it (see section 7).

We delete your enquiry once it has been dealt with, unless statutory retention obligations apply.

5. Application form

You can apply to us using the form on the careers page. In this case, we process your name, your contact details, the position you are applying for, your message and, if you upload one, your application document as a PDF.

The sole purpose is to carry out the application process. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26(1) of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

The application is sent as an email to our mailbox. We use Resend as a processor to send it (see section 7). An uploaded file is not stored on the server but passed on directly as an attachment to the email.

We delete application data once the process is complete, at the latest six months after a rejection, unless you have consented to longer storage.

6. Notifications about new locations

When we announce a new location, you can leave your email address on its page to be informed when it opens. For this, we only process this email address. No new location is currently announced and the form is not active.

The website does not store your address but sends it to us by email. You will receive an email with a confirmation link. Only after you have confirmed do we add your address for this purpose. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, informally by email to us. We will then delete your address.

7. Sending emails via Resend

To send form and confirmation emails, we use the Resend service (Resend, Inc., USA) as a processor pursuant to Art. 28 GDPR. Resend processes the sender, recipient, subject, content and attachments of the message.

This may also involve a transfer to the USA, based on the European Commission’s Standard Contractual Clauses.

8. Social media, links, maps and fonts

We do not embed any social media plugins, like buttons, tracking pixels or analytics services, and we do not set any cookies for audience measurement. The links to Instagram, TikTok, YouTube and the delivery service Wolt are simple links. Only when you click on them do the respective providers process your data in accordance with their own terms.

On the Locations page, you can load a map. It comes from OpenFreeMap; the map data comes from OpenStreetMap. As long as you do not click “Load map”, no connection to OpenFreeMap is established. When you click, your browser loads map tiles, fonts and the map style from its servers; in doing so, your IP address, information about your browser and the map section displayed are transmitted. The legal basis is your consent given by the click, Art. 6(1)(a) GDPR. It applies only to the page view in question.

The small map excerpts on the location pages are images stored on our own server. No connection to a map service is established for them.

You open directions via a link to Google Maps; your browser only connects to Google when you click it.

The fonts used (Archivo, Poppins) are stored on our own server. No connection to Google Fonts is established when you visit the site.

9. Google reviews (Places API)

On the homepage, we show our reviews on Google. Our server retrieves the data once a day via the Google Places API (New) from Google LLC or Google Ireland Ltd. and caches it for 24 hours. Your browser does not connect to Google in the process: neither your IP address nor your browser type nor any other data about you is transmitted to Google, and no script or widget from Google is loaded.

We display the overall rating, the number of reviews and individual reviews with the reviewer’s name, profile picture, stars, text and time information. The reviewers have published this information publicly on Google themselves. Our server also loads the profile pictures; they are delivered via our own image proxy so that your browser does not connect to Google for them either.

The legal basis for retrieving and displaying the reviews is our legitimate interest in presenting publicly available reviews of our business, Art. 6(1)(f) GDPR. Processing by Google itself is governed by Google’s privacy policy. Google only processes your data under these terms once you click one of the links to Google Maps or to the review form.

10. Instagram feed (Meta Graph API)

When the Instagram feed is active, we show our own Instagram posts on the homepage and, where available, our current stories. Otherwise, images from our own server are shown there. Our server retrieves the data via the Instagram API with Instagram Login from Meta Platforms Ireland Ltd. It caches posts for one hour and stories for 15 minutes.

When the feed is displayed, your browser does not connect to Meta: neither your IP address nor your browser type nor any other data about you is transmitted to Meta. No script or embed code from Instagram is loaded, and there are no like buttons and no pixels. Our server also loads the images; they are delivered via our own image proxy. Only content that we have published ourselves on our own account is shown.

Video playback is an exception. If you click on a tile, the post opens in a window on our site; images are delivered via our image proxy there too. A video, however, is loaded by your browser directly from Meta’s servers, and only after you have clicked “Play video” in the notice. In doing so, your IP address, information about your browser and the time of access are transmitted to Meta. The legal basis is your consent, Art. 6(1)(a) GDPR. Your consent applies only to the current page view and is not stored in a cookie or anywhere else in your browser. You can withdraw it at any time with effect for the future by reloading the page.

The legal basis for retrieving and displaying the posts is our legitimate interest in presenting our own current content, Art. 6(1)(f) GDPR. Processing by Meta itself is governed by Instagram’s privacy policy. Meta only processes your data under these terms once you play a video or click one of the links to Instagram.

11. Your rights

You have the following rights with regard to your personal data:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7 GDPR)

To exercise these rights, please use the contact details above. You can also lodge a complaint with a supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany.