1. Responsible person
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
AB-Tools GmbH
Marsstraße 78
80335 Munich
Germany
Telephone: +49 89 38898588
Fax: +49 89 38898589
Email: info@ab-smarthouse.com
Represented by the Managing Director: Andreas Breitschopp
Commercial Register: HRB 202859, Munich Local Court
VAT ID No.: DE268720895
2. General information on data processing
2.1 Scope of processing
We generally only process personal data of our users to the extent necessary for the provision of a functional website and our content and services, where consent has been given or where a legal basis permits the processing.
2.2 Legal basis
Depending on the processing, we rely on:
- Article 6 paragraph 1 letter a GDPR — Consent (e.g., optional cookies, analytics)
- Article 6 paragraph 1 letter b GDPR — Contract fulfillment and pre-contractual measures (order processing, customer account)
- Article 6 paragraph 1 letter c GDPR — legal obligation (commercial and tax law retention)
- Article 6 paragraph 1 letter f GDPR — legitimate interests (IT security, technical operation, prevention of misuse)
The following also applies to consents: Section 25 Paragraph 1 TDDDG for storing information on or accessing information in the user's terminal equipment; we base technically necessary processes on Section 25 Paragraph 2 No. 2 TDDDG.
2.3 Deletion and storage period
Personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Data will be stored beyond this point if there are legal retention obligations – in particular… 10 years for booking documents and invoices (§ 147 AO, § 257 HGB) and 6 years For received and sent commercial or business letters. Data processing will be restricted for this period.
3. Provision of the website and server log files
When you access our website, the server automatically collects information that your browser transmits (server log files):
- IP address
- Date and time of access
- Name and URL of the retrieved file
- Referrer URL
- browser and operating system used
- Amount of data transferred and access status
Purpose: Ensuring a trouble-free connection setup, comfortable use, evaluation of system security and stability.
Legal basis: Article 6 paragraph 1 letter f GDPR (legitimate interest in technically flawless and secure operation).
Storage duration: 14 days.
Hosting
Our website is hosted by an external service provider:
AB-Soft GmbH, Marsstraße 78, 80335 Munich, Germany
The provider processes the aforementioned data on our behalf. We have an agreement with them. Data processing agreement pursuant to Article 28 GDPR.
Encryption
This website uses SSL/TLS encryption for security reasons. You can recognize an encrypted connection by the following:„https://“ in the address bar of your browser.
4. Cookies and consent management
4.1 Cookies
We use cookies and similar technologies. Technically necessary cookies (e.g., shopping cart, session management, saving your cookie preferences) are set on the basis of Section 25 Paragraph 2 No. 2 of the German Telemedia Act (TMG) or Article 6 Paragraph 1 Letter f of the GDPR. All other cookies are only set with your consent.
The necessary cookies used by our shop system (WooCommerce) include in particular woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_* for shopping cart and session management.
4.2 Consent management with CookieYes
We use the consent management tool to obtain and manage your consents. CookieYes of the provider CookieYes Limited, 3 Warple Mews, Ealing, London, W3 0RF, United Kingdom.
When you access the website, a script is loaded from a server of the provider; in doing so, your IP address transferred. CookieYes stores your consent decision in a cookie (cookieyes-consent), in order to take these preferences into account on future visits. In particular, a pseudonymous consent identifier, the selected cookie categories, and the time of consent are recorded.
Purpose: Fulfillment of the legal obligation to obtain and document consents.
Legal basis: Article 6 paragraph 1 letter c GDPR in conjunction with Article 7 paragraph 1 GDPR (obligation to provide evidence) and Article 6 paragraph 1 letter f GDPR.
Third country transfer: The United Kingdom has an adequacy decision from the EU Commission.
You can change or withdraw your consent at any time with effect for the future via the cookie settings on our website.
5. Order processing in the online shop
5.1 Orders
When you place an order, we collect the data required for processing the contract:
- First and Last Name
- Billing and delivery address
- E-mail address
- Phone number (if applicable)
- Order and payment details
- Company name and VAT ID number (if applicable).
Purpose: Processing of the purchase contract, delivery, invoicing, customer communication, handling of warranty and cancellation cases.
Legal basis: Article 6 paragraph 1 letter b GDPR; for storage additionally Article 6 paragraph 1 letter c GDPR.
Recipient: Payment service providers, shipping service providers, tax advisors and IT service providers as data processors (see below).
The shop system WooCommerce It is operated on our own web space; the order data is stored in the database of our website.
5.2 Customer account
You can create a customer account. The data you provide will be stored until you delete your account. Registration is voluntary; orders can also be placed as a guest.
Legal basis: Article 6 paragraph 1 letter b GDPR.
After the account is deleted, data will be retained to the extent that legal retention obligations exist (see section 2.3).
5.3 Payment processing via PayPal
For payment processing — both for payments via a PayPal account and for card payments — we use the service PayPal PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg.
When selecting this payment method, the data required for payment processing (including name, address, email address, invoice amount, order details, IP address) will be transmitted to PayPal. You enter your card details directly at PayPal; we do not receive or process complete card data.
Purpose: Payment processing, fraud prevention.
Legal basis: Article 6 paragraph 1 letter b GDPR (contractual performance); insofar as PayPal processes data for its own purposes (e.g. credit check, fraud prevention), this is done under PayPal's own responsibility.
Third country transfer: PayPal may transfer data to affiliated companies, including those in the USA.
Further information: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
5.4 Shipping
For the purpose of delivering the goods, we will forward your address details and, if applicable, your email address/telephone number (for shipment notifications) to the commissioned shipping service provider:
Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany
DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany
Hermes Europe GmbH, Essener Bogen 1, 22419 Hamburg, Germany
FedEx Express Deutschland GmbH, Haberstraße 2, 53842 Troisdorf, Germany
Legal basis: Article 6 paragraph 1 letter b GDPR. The transfer of your email address/telephone number for the purpose of shipment notification will only take place if you have consented to this or if it is necessary for the performance of the contract.
5.5 Tax reporting obligations (One-stop shop)
For cross-border deliveries within the EU, we process order and sales data to fulfill VAT reporting and record-keeping obligations (OSS procedure).
Legal basis: Article 6 paragraph 1 letter c GDPR.
6. Making contact
6.1 Contact form
Our website includes a contact form (using the "WPForms" plugin). The data you enter there (including your name, email address, and message text) will be processed to handle your request and sent to us via email.
Purpose: Processing the request.
Legal basis: Article 6 paragraph 1 letter b GDPR, insofar as the request relates to a contract, otherwise Article 6 paragraph 1 letter f GDPR (legitimate interest in answering requests).
Storage duration: Until your request has been fully processed, provided there are no legal retention obligations to the contrary.
6.2 Contact via email, telephone or fax
When you contact us by email, telephone, or fax, we process the data you provide to handle your request. The legal basis and storage period are set out in section 6.1.
6.3 Email sending and logging
We use an SMTP service for sending system and order emails:
AB-Soft GmbH, Marsstraße 78, 80335 Munich, Germany
7. Web analytics: Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“).
Use with Google Consent Mode v2
We use Google Analytics with the so-called Consent Mode v2 a:
- Without your consent become No cookies set and no persistent identifiers are processed. Only cookieless, aggregated signals ("cookieless pings") are transmitted to Google; your IP address processed and used by Google for statistical modeling. Your device will not be recognized.
- With your consent Additional cookies (among others) will be used.
_ga,_ga_) set and usage data (including pages visited, time spent, referrer, shortened IP address, device information) is transmitted to Google in pseudonymized form.
Purpose: Statistical analysis of website usage for the purpose of tailoring our services to meet user needs and continuously optimizing them.
Legal basis: Article 6 paragraph 1 letter a GDPR and Section 25 paragraph 1 TDDDG (consent) for the use of cookies and the analysis based thereon.
Storage duration: The retention period for usage data at the user and event level is set out on 14 months set.
Third country transfer: Data may be transferred to Google LLC in the USA. Google LLC is subject to the EU-US Data Privacy Framework Certified; the framework has an adequacy decision from the EU Commission. In addition, Google has concluded standard contractual clauses.
You can withdraw your consent at any time via the cookie settings. Additionally, you can prevent tracking by Google's browser add-on: https://tools.google.com/dlpage/gaoptout
Further information: https://policies.google.com/privacy
8. Safety measures
8.1 Protection against login attempts
To protect against automated attacks on the login area, we use a protection function that logs failed login attempts and temporarily blocks IP addresses in case of repeated failed attempts (plugin „Limit Login Attempts Reloaded“).
Legal basis: Article 6 paragraph 1 letter f GDPR (legitimate interest in IT security).
Storage duration: 3 months.
8.2 Spam protection
To protect against spam, we use "Antispam Bee". The check is performed locally on our server; no data is transmitted to third parties.
Legal basis: Article 6 paragraph 1 letter f GDPR.
8.3 Data backups
To protect against data loss, we create regular backups of the website, including the database (plugin "UpdraftPlus").
Backup storage location: Own server.
Legal basis: Article 6 paragraph 1 letter f GDPR, Article 32 GDPR.
8.4 Other local functions without data transmission
The following functions are performed entirely on our own server; no data is transferred to third parties. not instead of:
- Fonts: The fonts used (Poppins) are delivered locally from our server. No connection to Google Fonts servers is established. not instead of.
- Multilingualism: The translation is done using the locally installed plugin "TranslatePress".
- Page cache: To speed up delivery, static copies of pages are cached on our server (plugin "Cache Enabler").
9. Recipients and processors
We only disclose personal data to the extent necessary for the performance of the contract, if you have given your consent, or if there is a legal obligation to do so. Categories of recipients are:
- Hosting and IT service providers
- Payment service provider
- Shipping service provider
- Tax consulting and auditing
- Authorities within the framework of legal obligations
We have concluded data processing agreements with service providers who process data on our behalf in accordance with Article 28 GDPR.
10. Your rights as a data subject
You have the following rights with regard to your personal data:
- Information (Article 15 GDPR)
- Correction (Article 16 GDPR)
- deletion (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Revocation of granted consent with effect for the future (Art. 7 para. 3 GDPR)
Right to object (Art. 21 GDPR)
If we process your personal data based on legitimate interests (Art. 6 para. 1 lit. f GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. If your data is processed for direct marketing purposes, you have the right to object at any time without giving reasons.
To exercise your rights, simply send an informal notification to the contact details listed under point 1.
Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The supervisory authority responsible for us is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
11. No automated decision-making
Automated decision-making, including profiling as defined in Article 22 of the GDPR, does not take place.
12. Changes to this Privacy Policy
We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements or to reflect changes to our services. The current version will apply to your next visit.
As of August 8, 2026
