Information on the processing of personal data under the GDPR.
This English version is a translation provided for information only. The legally binding text is the German version: Datenschutzerklärung.
This privacy policy covers only the public website schmitko.com (Schmitko OHG as controller for website visitors), not the processing of customer data in the M365 agent, via WhatsApp or via AWS Bedrock; there, Schmitko is the processor and the respective data processing agreement with the customer applies.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Schmitko OHG
Heilig-Brünnle-Straße 50
72461 Albstadt
Germany
Represented by the partners Dominik David Steko, David Noa Steko and Luke Pablo Schmitt.
Phone: +49 151 23892373
Email: info@schmitko.com
Schmitko OHG is not legally obliged under § 38 BDSG (German Federal Data Protection Act) to appoint a data protection officer (fewer than 20 persons constantly engaged in the automated processing of personal data on the website). For data protection matters, you can reach us at info@schmitko.com.
Scope. As a rule, we process personal data of our users only insofar as this is necessary to provide a functional website and our content and services.
Legal bases. Where consent is given: Art. 6(1)(a) GDPR. For the performance of a contract or for pre-contractual measures: Art. 6(1)(b) GDPR. For compliance with legal obligations: Art. 6(1)(c) GDPR. For the protection of legitimate interests: Art. 6(1)(f) GDPR.
Storage period and erasure. Personal data is erased or blocked as soon as the purpose of storage ceases to apply or a statutory retention period expires.
Each time the website is accessed, our system automatically records:
Page or file accessed and amount of data transferred
This data is technically necessary to deliver the website, to ensure its stability and security and to prevent misuse.
Legal basis: Art. 6(1)(f) GDPR (secure, stable operation).
Storage period: We do not store any log files. For technical reasons, Cloudflare processes connection data for a limited period in accordance with its own privacy policy. No trackers or analytics services run on this website; our server functions log only the error class, status and error code of the respective provider, never form contents or transcripts.
This website is hosted and delivered as a static export via Cloudflare Pages; we do not operate a server of our own. In doing so, Cloudflare processes on our behalf the data that your browser automatically transmits with every access: IP address, time of access, page accessed, amount of data transferred, referrer and browser and operating system information (see also section 4).
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and reliable operation of the website. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare: Cloudflare's Data Processing Addendum forms part of the contractual relationship via the terms of use. A transfer to the USA is possible; Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised by adequacy decision of 10 July 2023.
Fonts. This website serves the “Switzer” typeface from its own domain; the font file is stored on our hosting at Cloudflare Pages. No connection to an external font provider is made when a page is accessed; no data is transferred to third parties.
Images and videos. All images and videos on this website are likewise stored on our own domain and delivered from there. Here too, no connection to an external provider is made.
This website does not embed any maps, video platforms, social media buttons or other third-party content. The references to Instagram, LinkedIn, WhatsApp and Google Maps (route planning) are simple links; you only leave our website when you click on them. Merely visiting the site therefore does not involve any transfer to third parties, which is why this website does not display a consent banner.
Contact form. The form collects exactly three mandatory fields: name, email address and message (free text). You may also provide your company and a telephone number on a voluntary basis.
Processing route. The form message is delivered via a Cloudflare Function (transport only) to the Microsoft 365 mailbox address info@schmitko.com and stored exclusively in the mailbox. There is no database and no external form service provider. Recipients within the meaning of data protection law are therefore Cloudflare (transmission or transport of the message) and Microsoft (provision of the mailbox in which the message is held).
Data processing agreements pursuant to Art. 28 GDPR are in place or required with both. The legal entity for the mailbox is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. As both companies have US parent companies, any transfer to a third country is based on the EU-US Data Privacy Framework or standard contractual clauses. The legal entity on the Cloudflare side is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA; it is also the sole contracting party to the data processing agreement.
Contact by email. If you write directly to info@schmitko.com instead, the data transmitted will be stored in order to process your enquiry.
Legal basis. If your enquiry is aimed at concluding or initiating a contract: Art. 6(1)(b) GDPR. Otherwise, our legitimate interest in responding to your enquiry: Art. 6(1)(f) GDPR. Consent is not the legal basis, so a consent checkbox is neither necessary nor useful.
Storage period. Erasure as soon as the enquiry has been conclusively dealt with and no statutory retention obligations prevent this.
You can send us a voice message via the website and either type in your contact details or speak them as well. Use is voluntary; the contact form and the email address remain available.
Processing. The recording is transmitted to Cloudflare (Workers AI, Whisper model) for conversion into text. A recording of spoken contact details is additionally transmitted in text form to Amazon Web Services (Amazon Bedrock, Frankfurt data centre), where the AI model Claude is operated, in order to extract name, email address, phone number and, where applicable, company and address from it. You confirm these details before the enquiry is sent. The enquiry is then sent as an email, with the recording as an attachment and the text, to our mailbox at Microsoft 365.
No storage on the server. The recording and text are not stored on our servers; they exist only for the duration of processing and afterwards solely in the email in our mailbox.
Legal basis. Art. 6(1)(b) GDPR (initiation of a contract) and Art. 6(1)(f) GDPR (legitimate interest in a simple way of getting in touch).
Recipients. Cloudflare, Inc. (USA) for the transcription; the transfer is based on the standard contractual clauses of the EU Commission or, where certified, the EU-U.S. Data Privacy Framework. Amazon Web Services EMEA SARL (Luxembourg) for the extraction of contact details; processing takes place in the AWS Frankfurt region, and inputs are neither stored there nor used for training. Cloudflare declares its certification under the EU-U.S. Data Privacy Framework including the Swiss and UK extensions; in addition, the standard contractual clauses of the EU Commission apply. A data processing agreement with Amazon Web Services is in place via the existing account.
Storage period. As for other contact enquiries, see above.
This website does not set any cookies, does not use any tracking and does not display a cookie banner.
For security reasons, this site uses SSL or TLS encryption, recognisable by “https://” in the address bar.
You have the following rights in relation to us:
Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR, see section 11)
Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
An informal message to info@schmitko.com is sufficient to exercise these rights.
Right to lodge a complaint with the supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI; State Commissioner for Data Protection and Freedom of Information Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.
If data is processed on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. Informally to info@schmitko.com.
Last updated: 11 September 2026. Further development of the website or changes to statutory requirements may make an amendment necessary.