Privacy policy

The controller responsible for data processing on this website is: Schmitz Universe, owner Jonas Schmitz (sole proprietorship), Friedrich-Mohr-Straße 1, 56070 Koblenz, Germany. Email: info@schmitzuniverse.com.

A data protection officer has not been appointed, as the legal requirements for this are not met. For any questions regarding data protection you can reach us using the contact details above.

We process personal data only where necessary and where a legal basis exists. The relevant legal bases are in particular: your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR).

When you access the site, technically necessary data transmitted by your browser is processed: IP address, date and time, requested resource, status code, volume of data transferred, referrer and user agent. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure, stable and attack-resistant operation of the website.

This access data is generated at the hosting provider and stored only briefly to ensure operation and security, and is then deleted or anonymised. It is not combined with other data or used to identify individuals.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. On our behalf, as a processor, Vercel processes the data required to deliver the website (in particular access data). A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel.

Where data is transferred to the USA in this context, this is safeguarded by the Standard Contractual Clauses adopted by the EU Commission (Art. 46(2)(c) GDPR) and supplementary measures. Further details on third-country transfers can be found below.

If you contact us via a form or by email, we process the data you provide (e.g. name, email address, company, phone number, subject and message text) to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contract-related enquiries, otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR).

To protect against automated abuse (spam), we process technical auxiliary features such as a hidden check field, the time of submission and a limit on requests per sender. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

For the reliable delivery of form and confirmation emails we use the service Resend (Resend, Inc., USA) as a processor. The content submitted in the form is transmitted to Resend and transferred to the USA; the transfer is safeguarded by Standard Contractual Clauses. Your enquiry is then received in a business email inbox through which we process it.

Your details are deleted once the enquiry has been finally handled and no statutory retention obligations apply.

If you send us an application (for example via the careers form), we process your details and documents solely to carry out the application process. The legal basis is Section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. If no employment relationship is established, the data is deleted no later than six months after the process ends, unless you have consented to longer storage and no statutory obligations apply.

For the newsletter we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). Subscription uses a double opt-in procedure: you first receive an email containing a confirmation link; your address is only added after confirmation. To document consent we store the times of subscription and confirmation.

You can unsubscribe at any time via the link in every email or by informal message to us; your address is then deleted. The email service provider used will be named here once the newsletter has been set up. Until then, subscriptions are merely noted and no mailings are sent.

For protected areas, a technically necessary signed session cookie is set after a successful login. It contains no personal content and expires after eight hours. The legal basis is Art. 6(1)(b) and (f) GDPR.

Your browser's local storage only records that you have acknowledged the cookie notice; after signing in to a protected area, a technically necessary signed session cookie is added. These technically necessary storages are based on Section 25(2) TDDDG and Art. 6(1)(f) GDPR.

This website currently sets no analytics or marketing cookies. Should analytics services be added in future, this will happen exclusively after your explicit consent.

The contact page can embed a location map from OpenStreetMap. It only loads when you actively click “Load map”. Only then is a connection to servers of the OpenStreetMap Foundation (United Kingdom) established and your IP address transmitted. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR). Without a click, no connection is made.

The fonts used are embedded at build time and served from our own server. No connection to external font providers is made when the site is accessed.

We only disclose personal data where necessary to provide our services, where you have consented or where we are legally obliged to do so. The processors used are in particular: the hosting provider (Vercel) and the email delivery service (Resend). Agreements pursuant to Art. 28 GDPR are in place with all processors. We do not sell data.

Some of the service providers used (in particular Vercel and Resend) are based in the USA. Where personal data is transferred to a third country in this context, this is done on the basis of the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, further appropriate safeguards. No other transfers to third countries take place.

We store personal data only for as long as necessary for the respective purposes. The data is then deleted, unless statutory retention obligations – for example under the German Commercial Code (Section 257 HGB) or the Fiscal Code (Section 147 AO), with periods of generally six to ten years – require longer retention. Processing is restricted for that period.

This website uses TLS encryption (HTTPS) to protect the transmission of your data. In addition, we take appropriate technical and organisational measures to secure your data against loss, manipulation and unauthorised access.

There is no automated decision-making in individual cases, including profiling, within the meaning of Art. 22 GDPR.

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future.

To exercise your rights, a message to the contact details above is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate.

We update this privacy policy whenever changes to processing or the legal situation require it. The version published on this page applies. As of: August 2026.