for the SmoovOps website and the SmoovOps application, operated by ···
···
c/o ···
···
···, Germany
When using SmoovOps, it's important to distinguish between two different roles Northwood UG plays:
This privacy policy primarily describes the processing for which we act as controller (Section 1). Details on data processing on your behalf are governed by the DPA.
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the website | Server log data (IP address, browser type, timestamp) | Art. 6(1)(f) GDPR |
| Account creation & contract performance | Name, email, company details, billing data | Art. 6(1)(b) GDPR |
| Contact form / support requests | Name, email, message content | Art. 6(1)(a) or (f) GDPR |
| Newsletter (if subscribed) | Email address | Art. 6(1)(a) GDPR |
| Payment processing | Payment data (via payment provider) | Art. 6(1)(b) GDPR |
| Non-essential cookies/tracking (if used) | Usage data | Consent, Sec. 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR |
SmoovOps runs on Amazon Web Services (AWS) infrastructure. Both the backend infrastructure (including AWS Lambda and DynamoDB) and the static frontend files (hosted via Amazon S3) are located in the AWS data center eu-central-1 (Frankfurt).
To deliver the website, we additionally use Amazon CloudFront (a content delivery network) and AWS WAF (a web application firewall) for protection against attacks. CloudFront is a global service with delivery locations ("edge locations") distributed worldwide. We have technically restricted delivery to locations in North America, Europe, and Israel ("Price Class 100") and additionally restricted access via a geo-restriction to visitors from the EU/EEA. However, exclusive delivery from locations within the EU/EEA cannot be technically guaranteed, since CloudFront automatically routes requests to the nearest available location from a network perspective.
Since Amazon Web Services, Inc. is a US-based company, use of CloudFront (and potentially other AWS services) may involve a transfer of data to a third country within the meaning of Art. 44 et seq. GDPR. AWS is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023); in addition, the AWS Data Processing Agreement includes the EU Standard Contractual Clauses as a fallback mechanism should that adequacy decision be invalidated in the future.
When you access our website, our provider automatically collects and stores information in server log files that your browser automatically transmits to us:
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technically error-free and secure provision of the website). This data is not combined with other data sources.
Technically necessary cookies or comparable storage methods (e.g. to maintain your login session) are used on the basis of Sec. 25(2) No. 2 TTDSG in conjunction with Art. 6(1)(f) GDPR.
For SmoovOps only essential cookies or comparable storage methods are used.
For storing user interface settings, localStorage is used.
To provide SmoovOps' offline capability, IndexedDB is used.
If you contact us via the contact form or by email, we store the data you provide (including name, email address, and message content) to process your request and any follow-up questions.
The legal basis for pre-contractual inquiries is Art. 6(1)(b) GDPR; otherwise it is your consent under Art. 6(1)(a) GDPR or our legitimate interest in responding to inquiries under Art. 6(1)(f) GDPR. Data is deleted once it is no longer required for processing, at the latest after 2 years, unless statutory retention obligations require otherwise.
Using SmoovOps requires registering a user account. In doing so, we collect:
The legal basis is Art. 6(1)(b) GDPR (performance or initiation of the usage agreement).
In the course of using the application, we process — on behalf of and under the instructions of our customers (see Section 1.2) — the following categories of data that you yourself enter into SmoovOps:
This data is used exclusively to provide the respective feature and is not analyzed by Northwood UG for its own purposes, except where necessary to operate the service itself (e.g. troubleshooting) or required by law.
SmoovOps supports importing and exporting your data in common formats (CSV, Excel, ODS). Files created via export are your own responsibility; please handle exported files with the same care as the original data within SmoovOps.
We offer payment via the payment provider Stripe. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland (or its affiliate Stripe, Inc., USA). The legal basis is Art. 6(1)(b) GDPR. For details on the safeguards applicable to processing by the US affiliate, see Section 9.
If you subscribe to our newsletter, we use your email address exclusively to send the requested information via AWS SES. The legal basis is your consent under Art. 6(1)(a) GDPR. You may unsubscribe at any time via the unsubscribe link in the newsletter or by an informal message to ···.
We generally do not share data with third parties unless this is necessary for contract performance or required by law. We currently use the following categories of processors/recipients:
Data Processing Agreements under Art. 28 GDPR are in place with all listed providers that process personal data on our behalf.
Content delivery / attack protection: Amazon CloudFront, AWS WAF (Amazon Web Services, Inc., USA / AWS EMEA entities — delivery restricted to locations in Europe, North America, and Israel per price class configuration, with an additional geo-restriction limiting access to EU/EEA visitors)
In connection with the providers listed in Section 8, personal data may be transferred to third countries outside the EU/EEA within the meaning of Art. 44 et seq. GDPR:
All other processors listed in Section 8 process data exclusively within the EU/EEA.
We generally store personal data only as long as necessary for the respective purpose:
Under the GDPR, you have the following rights where the respective legal requirements are met:
To exercise these rights, please contact: ···
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority is generally the one for the German federal state in which we are based:
Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Alt-Moabit 59-61
10555 Berlin
This privacy policy is currently in effect. As SmoovOps evolves (e.g. new features, new payment providers, AI features), it may become necessary to update this policy. The version available at the time of your visit applies.
Last updated: 29.07.2026