Privacy

This privacy policy applies to the website shmt.app and to the demo and showcase subdomains operated by SHMT:

• salon-demo.shmt.app — demo project "Atelier Form"
• fotograf-demo.shmt.app — demo project "Noah Kern"
• elektro-demo.shmt.app — demo project "KLARSTROM"
• pulse-demo.shmt.app — demo project "PULSE"

The demo pages are used solely to present design concepts. The companies and people shown there are fictional. Their contact forms do not submit data: input remains in the browser and is neither transmitted nor stored.

This website deliberately avoids analytics and tracking services, advertising networks, and external font services. No cookies are set unless they are necessary for operating the website. For this reason, there is no consent banner.

Personal data is processed only when you provide it yourself — for example through the contact form or by email.

The controller responsible for data processing on this website is:

A data protection officer has not been appointed because the legal requirements for doing so are not met.

This website is hosted by an external service provider that processes access data on our behalf:

A data processing agreement pursuant to Art. 28 GDPR exists with Vercel. The legal basis is our legitimate interest in the secure and reliable provision of the website (Art. 6 (1) lit. f GDPR).

Data transfer to the USA

Vercel Inc. is based in the United States. Processing of data outside the European Union therefore cannot be ruled out. The transfer is protected by the European Commission's standard contractual clauses, which are part of the data processing agreement. Details on data processing by Vercel can be found in its privacy policy at vercel.com/legal/privacy-policy.

When the website is accessed, the hosting provider automatically records information transmitted by your browser. This usually includes:

• page accessed and time of access
• amount of data transferred and server status message
• browser type, browser version, and operating system used
• referrer URL and IP address of the requesting device

This data is technically necessary for delivering and securing the website and is not merged with other data sources. It is not combined with personal data or evaluated for analytics purposes. The hosting provider keeps the data only as long as necessary for operation and defense against attacks and then deletes it automatically.

If you use the contact form, the information you enter is processed to handle the inquiry: name, email address, project type, and message, plus company and phone number if provided.

The transmission is encrypted to the server of this website. The inquiry is stored there in our internal management system so that its progress can be traced (see Management system for inquiries). In addition, a short notification about the incoming inquiry is sent to info@shmt.app. It is not shared with third parties for advertising purposes.

The legal basis is your consent (Art. 6 (1) lit. a GDPR) and — for inquiries related to a contract or pre-contractual measures — Art. 6 (1) lit. b GDPR. Consent can be withdrawn at any time with effect for the future.

For sending and storing these emails, we use the service of our email provider, with whom a data processing agreement pursuant to Art. 28 GDPR exists.

To protect against automated submissions, only technical measures within this website are used (hidden field, time check, a computational puzzle solved in the browser, and a request limit). No external spam protection service is used.

Inquiries from the contact form are stored in an internal management system so that we can track how far they have been processed. This covers the details entered in the form as well as the time of receipt and the processing status.

Access is limited to SHMT. The area is password-protected, not linked publicly, and excluded from search engines.

The database is operated at Supabase Inc., a provider based in the United States. A data processing agreement pursuant to Art. 28 GDPR exists with Supabase, including the Standard Contractual Clauses of the European Commission. Details can be found at supabase.com/privacy.

The legal basis is Art. 6 (1) lit. b GDPR where the inquiry relates to pre-contractual measures, and otherwise our legitimate interest in handling inquiries in an orderly manner (Art. 6 (1) lit. f GDPR).

When you contact us by email, the transmitted data, including your contact details, is stored to process the inquiry. This data is not shared without your consent.

Inquiries remain stored in the management system and in the email inbox until the respective matter is completed. They are then deleted unless statutory retention obligations prevent deletion.

If an inquiry results in an order, the related documents are subject to the commercial and tax retention periods of six or ten years (Section 257 HGB, Section 147 AO). Deletion then takes place after these periods expire.

This website does not set cookies for analytics, marketing, or tracking purposes. Neither Google Analytics nor comparable services are included.

Fonts are served locally from the site's own server. No connection to external font services is made. No other external scripts, map embeds, or video embeds are loaded.

If external services are added in the future, this policy will be updated accordingly — including consent management where required.

The website uses TLS encryption for security reasons. You can recognize an encrypted connection by "https://" in your browser's address bar. Data you transmit to this website cannot easily be read by third parties.

Under the GDPR, you have the following rights, among others:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of consent (Art. 7 (3) GDPR)

To exercise these rights, an informal message to info@shmt.app is sufficient.

Without prejudice to other legal remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your place of residence or the place of the alleged infringement. The authority responsible for us is:

This privacy policy will be updated if the functions of the website or legal requirements change. Status: September 2026.