Privacy

1. Controller

Smartweb GmbH, Richterstr. 14–16, 45143 Essen, Germany
Represented by Managing Director Marina Franz
Email: info@digitalbatterypass.eu

2. General information on data processing

We generally process personal data only where this is necessary to provide a functioning website and our content and services.

3. Hosting and server log files

The website and app are operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in data centres in Germany. When pages are accessed, the host processes technically necessary data such as IP address, date and time, page accessed and browser information. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and stable operation. Log files are deleted according to the host’s retention periods.

4. Fonts

Only if you consent do we load fonts from Bunny Fonts (BunnyWay d.o.o., Slovenia). This transmits your IP address to the provider. The legal basis is your consent under Art. 6(1)(a) GDPR. Without consent, the site uses your device’s fonts and sends nothing to Bunny Fonts.

5. Local storage on the website

The website sets no analytics or tracking cookies and includes no advertising services. We store your choice in the “privacy settings” dialog in your browser’s local storage (key “bp-consent”) so the dialog does not appear on every visit. This is necessary under § 25(2) TDDDG. No data is sent to us in the process. You can change your choice and withdraw consent at any time via “Cookie settings” in the footer. The obligation check and price calculator run only in your browser; your entries are not transmitted.

On the developer page, your browser also remembers the programming language you chose for code examples (key “bp_code_lang”), because you trigger this function yourself. The CSV checker on that page works only in your browser and does not transfer the file. When opened, the “System status” page calls a status address at app.digitalbatterypass.eu; this creates the log files described in section 3.

6. Contact

If you use the contact form, your details are sent to us by email via our server. To prevent abuse, we store a hash of your IP address for at most one hour. We process your details and messages by email or phone solely to handle your enquiry on the basis of Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR. The data is deleted once it is no longer required and no statutory retention obligations apply.

7. Using the app (app.digitalbatterypass.eu)

For an account we process company, name, email address and a password stored as a hash. In addition, there is the battery data you enter and a log of changes with person or API key and time. The legal basis is performance of the contract under Art. 6(1)(b) GDPR and, for the log and security, also Art. 6(1)(f) GDPR. The data is held in a database at IONOS SE. It remains stored as long as the account exists and legal duties require it.

The app sets a technically necessary session cookie so you stay logged in. It contains no advertising or analytics data and ends with the session; under § 25(2) TDDDG no consent is required. To protect against attacks we briefly store failed login attempts. For “forgot password” we send you an email with a time-limited link.

If you use two-factor sign-in, we store an encrypted secret and hashed recovery codes. If a company uses company sign-in, we receive the person’s name and email address from its sign-in provider. The legal basis is Art. 6(1)(b) and (f) GDPR.

If you enter personal data of your employees or third parties in the app, we process it on your behalf. For this we conclude a data processing agreement with you under Art. 28 GDPR.

On registration we send you a confirmation link by email and notify our team of the new account. To prevent abuse we limit new accounts per IP address and store these entries for at most one day. We record your acceptance of the terms and DPA with version and time.

8. REST API

For the REST API we store each key’s name, rights, expiry date, time of last use and a hash, never the key itself. Each call is logged with key name, method, path, status, duration and time, without content. The company’s administrators can see the log; it is usually deleted after 30 days. We store failed authentications with IP address, usually for at most one hour, and responses for safe retries, usually for at most 7 days. The legal basis is Art. 6(1)(b) and (f) GDPR.

9. Evidence and measurements

Evidence uploaded by customers is stored as files on webspace at IONOS, not publicly. It can only be accessed by the company and through time-limited download links. Measurements relate to the battery. If files, notes or fields contain personal data, we process it on the customer’s behalf under Art. 28 GDPR. The customer is then the controller.

10. If you are contacted as a supplier

Batterypass customers can ask you by email for data on a battery model. We received your name and email address from that customer. The customer is responsible for the request and we process the data on its behalf. We store name, email address, your entries and the time for as long as the customer uses its account or until it requests deletion. The link is valid for 30 days. The entry page sets a technically necessary session cookie so that the form can be submitted securely. You can assert your rights against the requesting customer or us; we forward requests.

11. Public passport pages

Anyone who scans a QR code or follows a GS1 link accesses a public passport page. Only the technical server log files from section 3 arise. The page sets no cookie for this and requires no account. Passport pages contain product data on the battery and the manufacturer details entered by the customer, no data on the person scanning.

Using a link on the passport page you can request access to restricted data. For this we process your name, company or authority, email address, group, purpose and IP address and pass them to the company that published the passport. That company decides on the request and is responsible for it; we act on its behalf. Retrievals with a personal link are recorded with name, company and time in that company’s log. The legal basis is Art. 6(1)(f) GDPR: the interest in giving access only to entitled parties and being able to prove this. Later changes to the data form a version chain. The proof data at the passport address contains only public data and hash values.

When a customer submits a passport to the European Commission’s DPP registry, we transmit the passport address, model and batch identifier. The registry then retrieves the passport itself.

12. Recipients and third countries

Recipients are IONOS SE as processor for hosting, database and email delivery, and Bunny Fonts if you consent to the fonts. On the instructions of the respective customer, the European Commission as operator of the DPP registry and the customer’s sign-in provider are also recipients. No transfer to third countries outside the EU and EEA is planned. There is no automated decision-making including profiling. The details in the account and contact form are required to conclude the contract or handle your enquiry; without them this is not possible.

13. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR). You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). To do so, write to info@digitalbatterypass.eu. You may also complain to a supervisory authority; ours is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

14. Updates

This privacy policy is updated whenever changes to features or the legal framework require it. Last updated: November 2026.