Privacy Policy

smartport AG | Last updated: May 2026

1. Data Controller

smartport AG

Gotthardstrasse 14, CH-6300 Zug, Switzerland

Email: [email protected] | [email protected]

For payment processing and as EU representative under the DSA:

smartport Marketplace B.V.

Keizersgracht 452, NL-1016GD Amsterdam, Netherlands (KVK 98714783)

2. Purposes and Legal Bases

3. Data Collected

At account creation and order:

Name, email address, phone number, delivery and billing address, payment data (card data processed exclusively by Mollie B.V.), order history.

Automatically collected:

IP address, date/time of access, browser type, device information, pages and products viewed.

On contact:

Name, email address, message content.

4. Retention Periods

• Customer and order data: 3 years after last contact, then up to 10 years for legal obligations

• Marketing data: 3 years or until withdrawal of consent

• Analytics data: max. 3 years, then pseudonymised for max. 2 further years

• Website statistics: max. 26 months

5. Third-Party Transfers

5.1. Merchants

Order-relevant data (name, delivery address) is shared with the respective merchant. Shipping is handled by the merchant via carriers of their choice (e.g. DHL, GLS).

5.2. Payment Processing – Mollie

Payments are processed via Mollie B.V. (Keizersgracht 126, NL-1015 CW Amsterdam), integrated via the Mollie Connect Marketplace model. smartport Marketplace B.V. is connected to Mollie as platform operator. Merchants may store customer payment data via Mollie for future transactions (Mollie Card Vault). Privacy policy: https://www.mollie.com/en/privacy

Available payment methods: Credit card (Visa, Mastercard, American Express), PayPal, Klarna, bank transfer (SEPA), iDEAL, Satispay, Bancomat Pay and further country-specific methods.

5.3. Klarna

For Klarna payment methods and the Klarna On-Site Messaging Widget, data is transferred to Klarna Bank AB (Sveavägen 46, 111 34 Stockholm, Sweden). Privacy policy: https://www.klarna.com/en/privacy

5.4. Customer Support – Intercom

We use Intercom, Inc. (55 2nd Street, San Francisco, CA 94105, USA) for customer support. Transfer based on SCCs. Privacy policy: https://www.intercom.com/legal/privacy

5.5. Analytics and Tracking

Google Analytics 4 / Google Tag Manager

Google Ireland Limited, Dublin. GTM manages all tracking tags with Consent Mode v2. GA4 collects anonymised usage data (IP anonymisation active). Transfer to USA based on SCCs. Opt-out: https://tools.google.com/dlpage/gaoptout

Google Ads

Conversion tracking and remarketing via Google Ireland Limited.

Contentsquare

Behaviour analytics (heatmaps, session analysis) via Contentsquare SAS, Paris, France. Privacy policy: https://contentsquare.com/privacy-center/

5.6. Google Maps

We use Google Maps (Google Ireland Limited) for address autocomplete in checkout. The entered address is transmitted to Google. Legal basis: Art. 6(1)(b) GDPR.

5.7. Review Services

Trusted Shops / eTrusted – Trust badge and review invitations. Privacy policy: https://www.trustedshops.co.uk/privacy/

Trustpilot – Review import. Privacy policy: https://legal.trustpilot.com/end-user-privacy-terms

Idealo – Price comparison and review invitations. Privacy policy: https://www.idealo.co.uk/privacy.html

Google Reviews – Customer review sync via Google Places API.

5.8. Infrastructure

Cloudflare, Inc. (San Francisco, USA) – WAF, DDoS protection, CDN. Transfer based on SCCs. Privacy policy: https://www.cloudflare.com/privacypolicy/

Railway (EU region) – Server infrastructure. Customer data stored exclusively in the EU.

5.9. Email – Resend

Transactional emails and newsletters via Resend (USA). Transfer based on SCCs. Privacy policy: https://resend.com/legal/privacy-policy

5.10. AI Services – Anthropic

For certain internal processes (support assistance, text generation, translations), we use the API of Anthropic, PBC (San Francisco, USA). Support conversation content may be processed. Transfer based on SCCs and DPA with Anthropic. Privacy policy: https://www.anthropic.com/privacy

5.11. Authorities

Personal data is disclosed to competent authorities upon legal obligation or official order.

6. International Transfers

Transfers to third countries (particularly the USA) occur only on the basis of appropriate safeguards: Standard Contractual Clauses (Art. 46 GDPR) or adequacy decision.

7. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21 GDPR) and to withdraw consent at any time.

Requests to: [email protected]

You have the right to lodge a complaint with the competent supervisory authority.

8. Updates

This privacy policy is updated as necessary. The current version is always available on the platform.