Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

iSmart Repair
Owner: Can Grüner
Grindelhof 7
20146 Hamburg
Germany

Phone: 040 64888674
Email: ismart_repair@outlook.com

For all questions about data protection and to exercise your rights, you can contact us directly using the contact details above.

Personal data is any information relating to an identified or identifiable natural person, such as name, address, phone number, email address or the IP address of your device. We process personal data exclusively within the framework of the statutory provisions, in particular the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG). We only collect data that is required for the respective purpose and do not pass it on to third parties for advertising purposes.

Legal bases

• Art. 6(1)(a) GDPR: consent, for example when you voluntarily contact us via WhatsApp or when services that require consent are embedded.
• Art. 6(1)(b) GDPR: performance of a contract or implementation of pre-contractual measures, for example for a repair enquiry, a cost estimate or a repair order.
• Art. 6(1)(c) GDPR: compliance with a legal obligation, for example retention obligations under commercial and tax law.
• Art. 6(1)(f) GDPR: protection of legitimate interests, for example in the secure and stable operation of the website and in fending off attacks.

This website is operated on servers within the European Union. The hosting provider processes the resulting data exclusively to provide the website and on our instructions. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

Hosting provider:
Lovable Labs Incorporated or Lovable AB, Stockholm, Sweden
Server location: European Union

The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in a reliable, secure and high-performance provision of our online offering.

Server log files

Each time this website is accessed, information transmitted by your browser is automatically recorded. This is in particular:

• shortened or full IP address of the requesting device
• date and time of access
• name and URL of the retrieved file
• amount of data transferred and notification of successful retrieval
• browser type and version used as well as operating system
• referrer URL, i.e. the previously visited page

We cannot assign this data to any specific user, and it is not merged with other data sources. The processing serves to deliver the website, to ensure system security and to investigate cases of misuse on the basis of Art. 6(1)(f) GDPR. The log files are deleted after 30 days at the latest, unless they are exceptionally still required to investigate a specific security incident.

Encryption

For security reasons, this website uses TLS encryption (recognisable by “https://” and the lock symbol in your browser bar). This means the data you send to us cannot be read by third parties.

Technically necessary storage

To operate this website, we use technically necessary cookies and comparable storage technologies (for example Local Storage or Session Storage). They serve the basic functions, security, load balancing, the login function in the internal price backend and the storage of your cookie decision. This storage is permitted without consent under Section 25(2) No. 2 TDDDG; we base the subsequent processing on Art. 6(1)(f) GDPR.

Services requiring consent

All non-essential services, currently the map display from Google Maps and the review widget from Trustindex, are only loaded after you have given your consent via our consent banner. Until then, only a placeholder is shown in their place and no data is transferred to the providers. The legal basis for storing or reading information on your device is Section 25(1) TDDDG, and for the subsequent processing your consent under Art. 6(1)(a) GDPR.

We distinguish between the categories Necessary (always active), Functional (Google Maps, Trustindex), Statistics and Marketing. No service is currently active in the Statistics and Marketing categories; they are technically prepared and will only be used after corresponding consent.

Google Maps

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a map is loaded, your IP address and usage data are transferred to Google; a transfer to the USA cannot be ruled out. Google is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply. More information at policies.google.com/privacy.

Trustindex (Google reviews)

The provider is Trustindex Kft., Hungary. When the widget is loaded, your IP address and technical connection data are transferred to the provider in order to display the reviews. More information at trustindex.io/privacy-policy.

Withdrawing and changing your consent

You can withdraw or adjust your consent at any time with effect for the future, just as easily as you gave it. To do so, use the “Cookie settings” link in the footer of every page or the following button. The lawfulness of the processing carried out until the withdrawal remains unaffected. Your decision is stored locally in your browser for 12 months; after that we ask again. You can also set your browser to reject cookies in general or to delete them when it is closed.

You can reach us via contact form, email, phone or WhatsApp. We process the data you provide exclusively to handle your request.

5.1 Contact form and repair enquiry

If you contact us via a form on this website, we process the information you enter, usually name, email address, phone number, device type and description of the fault as well as the time of the enquiry. Mandatory fields are marked as such; all other information is voluntary.

The processing is carried out to answer your enquiry and to implement pre-contractual measures in accordance with Art. 6(1)(b) GDPR. If your enquiry is not aimed at a contract, we process the data on the basis of our legitimate interest in answering enquiries in accordance with Art. 6(1)(f) GDPR.

5.2 Email

For our email communication we use a service of Microsoft Corporation or Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you write to us by email, your email address, the content and the metadata of the message are stored on the provider's servers. Processing on servers outside the European Union, in particular in the USA, cannot be ruled out. Microsoft is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission exists for transfers to the USA. In addition, standard contractual clauses under Art. 46(2)(c) GDPR apply.

Please note that unencrypted emails can be read by third parties during transmission. Therefore, do not send us any particularly sensitive information by email. The legal basis is Art. 6(1)(b) or (f) GDPR.

5.3 Phone

When you contact us by phone, we process your phone number and the information you give us during the call, in particular name, device type and request. This information is stored to handle your request. We do not record phone calls. The legal basis is Art. 6(1)(b) or (f) GDPR.

5.4 WhatsApp

You can voluntarily contact us via the messenger service WhatsApp. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of the Meta group. When you write to us via WhatsApp, the provider processes in particular your mobile number, your profile picture, your profile name, status information, device and usage data and the metadata of your messages. The message content is end-to-end encrypted; the metadata is not.

We have no influence on the data processing by WhatsApp. A transfer of data to the USA and other third countries cannot be ruled out. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Please also note that contact data from your device's address book may be transferred to the provider if you have enabled address book access in the app.

The use of WhatsApp is voluntary and based on your consent in accordance with Art. 6(1)(a) GDPR and for the implementation of pre-contractual measures in accordance with Art. 6(1)(b) GDPR. You can always reach us instead by email, phone or in person in our stores. We recommend that you do not send any particularly sensitive data via WhatsApp.

5.5 Storage period for enquiries

We delete enquiries as soon as they have been fully processed and no statutory retention obligations prevent deletion. Enquiries that have led to an order are subject to the retention periods under commercial and tax law (see section 11). We delete other correspondence no later than six months after final processing, provided that no further questions are to be expected.

If you hand over or send us a device for diagnosis or repair, we process the data required to handle the order. This is in particular:

• name, address, phone number and email address
• device manufacturer, model, serial number or IMEI and accessories
• description of the defect, diagnosis result and work carried out
• order and receipt numbers, date of acceptance and return
• cost estimate, invoice amount and payment method
• if necessary and only with your express approval: device code, PIN or unlock pattern, insofar as this is technically required for the function test

The legal basis is Art. 6(1)(b) GDPR for the performance of the contract and Art. 6(1)(c) GDPR for compliance with statutory retention obligations.

Data on your device

During a repair it cannot be completely ruled out for technical reasons that our employees become aware of data stored on the device, for example when testing the screen, camera or speaker. We only access the device to the extent required for the repair and the function test. Your personal content is not viewed, analysed, copied or passed on. All employees are bound to confidentiality and data secrecy.

We strongly recommend that you make a full backup before handing over the device and, where possible, remove personal content from it. To the extent permitted by law, we accept no liability for data loss that may occur for technical reasons in the course of the repair. Device codes you give us are deleted once the order has been completed.

Pickup and mail-in service

If you use our pickup or mail-in service, we additionally process your pickup or delivery address and preferred dates. We pass this data on to the commissioned transport or shipping company insofar as this is required for delivery. The legal basis is Art. 6(1)(b) GDPR.

Payment processing

When you pay by card or via a payment service provider, the payment data is processed directly by the respective payment service provider or card terminal operator. We do not store complete card data. We only receive the information that the payment was successful and the receipt data required for accounting. The legal basis is Art. 6(1)(b) and (c) GDPR.

We use Google Search Console from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Search Console is a tool for website operators that allows us to analyse which search terms our site appears for in Google Search, how often it is accessed and whether technical errors occur when it is retrieved.

Search Console does not set any cookies on this website and does not load any scripts into your browser. We only receive aggregated, non-personal reports from Google that do not allow any conclusions to be drawn about individual users. To verify our ownership, a verification feature may be stored in the source code or in the DNS entry of the domain, which does not transfer any data about you.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in technical error analysis and the needs-based optimisation of our online offering. Further information can be found in Google's privacy notice at policies.google.com/privacy.

All fonts, scripts and libraries used on this website are embedded locally on our server and delivered from there. As a result, no connection to servers of Google or other third-party providers is established when you access our pages. In particular, your IP address is not transferred to Google Fonts or comparable services.

9.1 Link to Instagram

On our website you will find a link to our Instagram profile. This is a simple hyperlink, not an embedded social media plugin. Data is only transferred to the provider when you actively click the link and open the platform. We have no influence on the subsequent data processing by the provider.

9.2 Our Instagram presence

We maintain a publicly accessible profile on Instagram. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you visit our profile, interact with our content or send us a message, Meta processes your usage data, in particular interactions, device and location information and profile data, and uses it to create statistics, among other things.

With regard to the so-called Insights, i.e. the anonymised usage statistics provided to us by Meta, we are jointly responsible with Meta for the processing within the meaning of Art. 26 GDPR. Meta provides the essential content of the joint controller agreement and a description of the processing for this purpose. Meta has assumed responsibility for handling the rights of data subjects. You can assert your rights both against us and against Meta.

A transfer of data to the USA cannot be ruled out. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. The legal basis for our presence is Art. 6(1)(f) GDPR. Our legitimate interest lies in our public image, customer communication and the acquisition of new customers. More information can be found in Meta's privacy policy at privacycenter.instagram.com/policy.

9.3 Other external links

Our website contains links to third-party websites. The respective providers are solely responsible for their content and data processing. We recommend that you read the privacy notices of the linked services.

Your data is only passed on insofar as this is required to perform the contract, we are legally obliged to do so or you have given your consent. Recipients may in particular be:

• our hosting and IT service provider
• our email provider
• transport and shipping companies as part of the pickup and mail-in service
• spare parts suppliers and external specialist workshops, insofar as forwarding the device is required
• payment service providers and credit institutions
• tax advisers and, in the event of a dispute, legal advisers as well as courts and authorities

Insofar as service providers process personal data on our behalf and on our instructions, we have concluded data processing agreements with them in accordance with Art. 28 GDPR.

We only process personal data for as long as is required for the respective purpose. It is then deleted or blocked. The following periods in particular apply:

• invoices and accounting documents: ten years under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)
• commercial and business letters including order documents: six years
• enquiries without a contract being concluded: up to six months after final processing
• server log files: up to 30 days

During the retention period, the data is blocked for other purposes and deleted when the period expires.

You have the following rights with regard to the personal data concerning you:

• right of access under Art. 15 GDPR
• right to rectification under Art. 16 GDPR
• right to erasure under Art. 17 GDPR
• right to restriction of processing under Art. 18 GDPR
• right to data portability under Art. 20 GDPR
• right to object to processing under Art. 21 GDPR
• right to withdraw consent under Art. 7(3) GDPR with effect for the future

To exercise your rights, an informal message to the contact details stated in section 1 is sufficient.

Right to object

Where we process personal data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with the supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Straße 22, 7th floor
20459 Hamburg
Phone: 040 428540
Email: mailbox@datenschutz.hamburg.de

The provision of personal data is neither required by law nor by contract. However, certain information is required to conclude and carry out a repair order. Without this information, we cannot accept or process the order.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

We take technical and organisational measures in accordance with Art. 32 GDPR to protect your data against accidental or intentional manipulation, loss and destruction and against access by unauthorised persons. These include in particular encrypted data transmission, access restrictions to company systems, the obligation of all employees to maintain confidentiality and the locked storage of devices we have accepted. Our measures are continuously improved in line with technical developments.

Our services are aimed at persons of legal age. Persons under the age of 16 should not send us any personal data without the consent of their parents or guardians.

This privacy policy is currently valid and was last updated in September 2026. Due to the further development of our website and our services or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be viewed on this page at any time.

Last updated: September 2026