Privacy Notice

As you use this website, personal data about you will be processed by us as the data controller and stored for as long as necessary to fulfill the specified purposes and legal obligations. Below, we inform you about the types of data involved, how they are processed, and what rights you have in this regard.

Personal data, as defined in Art. 4 No. 1 of the General Data Protection Regulation (GDPR), refers to any information relating to an identified or identifiable natural person.

1 Scope of Application

This privacy information applies to the data processing on the website https://www.smartid.codes and 'SmartID Product Verifier' App for iOS and Android of Fraunhofer Institut für sichere Informationstechnologie, which refers to this privacy information.

2 Name and Contact Information of the Controller and the Corporate Data Protection Officer

The data protection officer of Fraunhofer can be reached at the above address in Munich, for the attention of: Data Protection Officer or at datenschutz@zv.fraunhofer.de. You can contact our data protection officer directly at any time with questions regarding data protection law or your rights as a data subject.

3 Processing Personal Data and Purposes of Data Processing

When Visiting the Website

When you access our website and retrieve its content, temporary data is stored that may allow identification. The browser used on your device automatically sends the information to the server of our website. The following data is collected:

• Date and time of access
• IP address
• Hostname of the accessing server
• Website from which our website was accessed
• Visited page on our website
• Notification of whether the access was successful
• Volume of data transferred
• Information about the browser type and version used
• Operating system

The temporary storage of data is necessary for establishing the connection and the course of a website visit so that we can provide you with the content on our website.

Further storage in log files occurs to ensure the functionality of the website, the security of the information technology systems, and to enable the uninterrupted provision of our website as well as to track any unlawful attacks if necessary.

If technical data from your device is processed to enable access to our website, this is done because such data is required in accordance with § 25 para. 1 no. 2 TDDDG.

The storage of the IP address is done anonymously by removing the last block of characters.

When using contact forms

We offer you the opportunity to contact us via a form provided on the website. The following information is required:

• Title,
• First and last name, and
• Email address.

We need your data to determine who the inquiry is from and to respond to and process it.

The data processing is carried out at your request and is based on our legitimate interests in answering a contact inquiry according to Art. 6 Abs. 1 S. 1 lit. f GDPR.

The personal data we collect for using the contact form will be deleted after we have completed your inquiry.

When creating a user account

Our website offers the possibility to create a password-protected user account.

To set up the user account, we need the following information from you:

• Title,
• First and last name
• a valid email address.

The processing of this data is carried out to identify you as a user and to create your user account.

Additionally, you must provide a self-chosen password for setting up the user account. Together with your email address, this enables access to your user account. In your user account, you can view and change the data stored about you at any time.

Additionally, you can voluntarily provide the following information:

• GPS data

This information is voluntary and not required for the establishment of the user account. Providing it helps us to view the supply chain

The data processing is done at your request and is necessary for the establishment and use of your user account as well as for the pre-contractual measures according to Article 6(1)(b) of the GDPR. We also use your email address for notification functions, if these are activated.

After the deletion of your user account, your data will be deleted for further use, unless we are obliged to store it longer according to Article 6(1)(c) of the GDPR due to tax and commercial retention and documentation obligations (especially § 147 AO if tax-relevant) or you have consented to a longer storage period according to Article 6(1)(a) of the GDPR.

4 Transfer of Data

If we pass on personal data collected through the website to processors, we will inform you about this in this privacy notice for each data processing procedure, naming the specific recipient.

Otherwise, we will only share your personal data if

• you have given your explicit consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR;
• this is necessary for the fulfillment of a contract with you in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR (for example, when passing on data to shipping companies for the purpose of delivering the goods you have ordered or when passing on payment data to payment service providers or credit institutions to carry out a payment transaction);
• there is a legal obligation for the transfer in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR.

The data passed on may only be used by the recipients for the stated purposes.

5 Rights of the Data Subjects

You have the right to:

• According to Article 7(3) of the GDPR, withdraw your consent at any time. This means that we may no longer continue processing the data based on that consent in the future;
• According to Article 15 of the GDPR, request information about your personal data processed by us. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been disclosed or will be disclosed, the planned storage duration, the existence of the right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint, the origin of your data, if not collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
• According to Article 16 of the GDPR, request the immediate rectification of inaccurate or completion of your personal data stored with us;
• According to Article 17 of the GDPR, request the erasure of your personal data stored with us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
• According to Article 18 of the GDPR, request the restriction of processing of your personal data, as long as you contest the accuracy of the data, processing is unlawful, but you oppose erasure, and we no longer need the data, but you need it for the establishment, exercise, or defense of legal claims or you have objected to processing according to Article 21 of the GDPR;
• According to Article 20 of the GDPR, receive your personal data provided to us in a structured, commonly used, and machine-readable format or request the transfer to another controller;
• According to Article 77 of the GDPR, lodge a complaint with a supervisory authority. In general, you can contact the supervisory authority of your usual residence or workplace or our association's registered office for this purpose.

Information about your right to object under Article 21 of the GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is based on Article 6(1)(e) of the GDPR (processing in the public interest) and Article 6(1)(f) of the GDPR (processing based on legitimate interests); this also applies to profiling based on this provision as per Article 4(4) of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If your objection is directed against the processing of data for direct marketing purposes, we will cease processing immediately. In this case, it is not necessary to specify a particular situation. This also applies to profiling insofar as it is related to such direct marketing.

If you wish to exercise your right to object, it is sufficient to send an email to datenschutzkoordination@zv.fraunhofer.de.

6 Data Security

All your personal data are transmitted in encrypted format, using the widely used and secure TLS (Transport Layer Security) standard. TLS is a secure and proven standard that is also used, for instance, in online banking. You will recognize a secure TLS connection by the additional s after http (i.e., https://...) in the address bar of your browser or by the lock icon in the bottom part of your browser window.

In all other regards, we use suitable technical and organizational security measures to protect your data against accidental or intentional manipulations, partial or complete loss, destruction, or the unauthorized access of third parties. We continuously improve our security measures in accordance with the state of the art.

7 Timeliness and Amendments to this Data Protection Information

The further development of our website and the products and services offered or changed due to statutory or regulatory requirements, respectively, may make it necessary to amend this data protection information. You may access and print out the latest data protection information at any time from our website.