Privacy Policy

1. Controller

SmartDance
Christina Brandl
Durheimerstraße 30
94081 Fürstenzell
Email: {{ email }}
Phone: {{ tel }}

2. Overview: Purposes for Which We Process Data

We process personal data in order to conclude and perform course contracts (registration, collection of fees, communication), to provide the parent portal and the parent app and — only with consent — for photos and videos from lessons. We do not sell any data and do not carry out any advertising tracking.

3. Website Hosting (Vercel)

This website and the parent portal are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, Vercel processes technically necessary data (IP address, time of access, page accessed, browser type) in server log files. The legal basis is Art. 6(1)(f) GDPR (secure provision of the website). A data processing agreement has been concluded with Vercel; transfers to the USA are based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

4. Registration, Parent Portal and Parent App (Supabase)

When you register, we process the data you provide: name and contact details of the parents, name and date of birth of the child, institution and course, plan and bank details (IBAN, account holder) for the direct debit. In the parent portal and the app, this is supplemented by login data (email, password), consents given and messages exchanged with the dance instructors. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

This data is stored with Supabase (Supabase Inc.), project region EU (Ireland, AWS eu-west-1). A data processing agreement has been concluded with Supabase. The bank details are additionally stored with restricted access and are accessible only to the administration.

5. Payment Processing (Stripe)

Course fees are collected by SEPA Direct Debit via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. For this purpose, we transmit the name, email address, IBAN and the amount to be collected to Stripe. The legal basis is Art. 6(1)(b) GDPR. As a payment service provider, Stripe acts in part as an independent controller; further information is available at stripe.com/de/privacy.

6. Photos and Videos from Lessons

We make and display recordings of a child exclusively with the prior express consent of the persons with parental responsibility (Art. 6(1)(a) GDPR). The recordings are stored in our Supabase environment in the EU (Ireland), are not published on social networks and are made accessible only to the respective authorised parents and the administration — never to other parents. Consent may be withdrawn at any time with effect for the future in the parent portal or in text form; the recordings will then no longer be displayed. Recordings are used for advertising purposes only with separate consent.

7. Notifications and Push Messages

We send contract-related emails (registration confirmation, SEPA pre-notification, notices of failed collections, login credentials) via a European email service provider or one bound by a data processing agreement. The legal basis is Art. 6(1)(b) GDPR.

The parent app can deliver push notifications via Google Firebase Cloud Messaging (Google Ireland Limited, Dublin). In this process, a pseudonymous device token is processed. Push notifications can be switched off at any time in the app and in the device settings.

8. Chat Assistant in the App (Anthropic)

For the question assistant in the app, the questions entered are transmitted to Anthropic PBC (USA) in order to answer them. We do not transmit any bank or health data in this process; please do not enter any sensitive data in the chat. The legal basis is Art. 6(1)(f) GDPR (efficient handling of enquiries); the transfer to the USA is based on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Use of the assistant is voluntary.

9. Accounting and Administration

For invoicing and accounting, we use lexoffice/Lexware (Haufe-Lexware GmbH & Co. KG, Freiburg). The data required for billing (name, address, amounts) is transferred there. The legal bases are Art. 6(1)(b) and (c) GDPR (performance of a contract, legal obligations).

On a transitional basis, master data is still managed in Airtable (Airtable Inc., USA, EU Standard Contractual Clauses); this service is being replaced by our own system.

10. Google Fonts

This website uses fonts provided by Google (Google Ireland Limited, Dublin). When a page is accessed, your browser loads the fonts from Google servers; in the process, your IP address is transmitted. The legal basis is Art. 6(1)(f) GDPR (consistent presentation).

11. YouTube Videos

On some pages (e.g. the parent app page and during registration) we show a video hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We use the privacy-enhanced mode (youtube-nocookie.com): as long as you do not click the video, no connection to YouTube is made; only a preview image from our own server is shown. Only when you click play does your browser load the video from YouTube, transmitting among other things your IP address and technical device data to Google, including to the USA. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google is certified under the EU-US Data Privacy Framework. More at policies.google.com/privacy.

12. Cookies and Local Storage

We do not use any tracking cookies. Technically necessary storage (login session in the portal, saved form progress) takes place in your browser or your app and is not analysed for advertising purposes.

13. Storage Period

We store contract and billing data for the duration of the contract and thereafter within the statutory retention periods (up to ten years under commercial and tax law). We store photo and video recordings until consent is withdrawn. Portal accounts are deactivated after the end of the contract and subsequently deleted, unless retention obligations apply.

14. Your Rights

As a data subject, you have the right of access (Art. 15 GDPR), the right to rectification (Art. 16), the right to erasure (Art. 17), the right to restriction of processing (Art. 18), the right to data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You may withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Ansbach.