PRIVACY POLICY
Introduction
The protection of your personal data is a top priority for me.
As a freelance UX researcher, I process your personal data confidentially and in accordance with all legal data protection regulations, especially the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). In this privacy policy, I inform you about the nature, scope, and purpose of the data I collect and process.
Responsible Body and Contact Details
The person responsible for data processing is:
Sandra Schuster
Seefelderhofberg 7a
86919 Utting am Ammersee
Germany
Email: sandra@smartux.digital
Phone: +49 171 89 70 347
Types of Data Processed
I process personal data that you voluntarily provide to me in the course of our collaboration. This includes:
- Contact details: Title, first name, last name, email address, telephone number, address.
- Project data: Interview statements, survey responses, video and audio recordings, and notes from usability tests. In video recordings, all personal information is blacked out. However, the participant’s camera or profile picture may be visible if consent was given for the recording of the camera image.
When you visit my website, technically necessary data is also collected, such as your IP address, the date and time of access, and information about the browser and operating system you use.
Use of Cookies
My website uses only technically necessary cookies that are essential for the operation of the site. These cookies ensure the basic functions of the website, such as stability, security, and content delivery. Without these cookies, my website cannot function properly.
The following strictly necessary cookies are used in particular:
- Session cookies: These cookies are automatically deleted after your visit and are required for a stable user session.
- WordPress cookies: WordPress may set cookies to determine if your browser accepts cookies. These are also strictly necessary for the website’s functionality.
These cookies are not used for marketing, advertising, or tracking purposes. Since no cookies requiring consent are used, a cookie consent tool is not necessary on this website.
Purposes and Legal Basis for Data Processing
I process your data for the following purposes:
- For the performance of a contract (Art. 6 (1) (b) GDPR): The processing of your data serves the purpose of conducting the study in which you participate. Your participation is considered a contractual agreement that makes the processing of your data necessary for the stated purpose. The survey or test is exclusively for market research purposes for my clients and does not pursue any advertising or sales-promotion goals.
- Based on your consent (Art. 6 (1) (a) GDPR):
- Video and audio recordings: The processing of your personal data in the form of video and audio recordings is carried out exclusively on the basis of your voluntarily given and revocable consent. Participation in the study is also possible without consenting to the recording.
- Prize draws and promotions: When participating in a prize draw or recommending a potential study participant, the legal basis is the consent you have given. Participation is always voluntary and can be withdrawn at any time.
- Based on legitimate interests (Art. 6 (1) (f) GDPR):
- Communication: I use your contact details to respond to your enquiries and to contact you.
- Website Provision: Technical data (IP address, etc.) is processed for the purpose of displaying and ensuring the stability and security of the website.
- For the fulfillment of legal obligations (Art. 6 (1) (c) GDPR): I process data to comply with legal requirements (e.g., commercial or tax-related retention obligations).
Recipients of the Data
Your personal data is not passed on to third parties and remains with me. Only the anonymized or pseudonymized data, results, and findings from the research are passed on to the respective clients for whom the studies are conducted. This is a form of processing without direct personal reference. Video recordings in which personal data is blacked out but the camera image is visible may also be passed on to the client as part of these findings if you have consented to the video recording.
In the course of my work, I commission service providers (so-called data processors). These include providers for cloud storage (Google Ireland), online survey tools (LamaPoll), online meeting tools (Zoom), transcription and analysis tools (Condens, Miro), as well as providers for web hosting (IONOS) and video editing (Adobe). I have concluded data processing agreements in accordance with Art. 28 GDPR with these service providers.
Data transfer to Third Countries
Insofar as personal data is transmitted to service providers in third countries outside the EU or the EEA (e.g., to the USA), this only takes place if an adequacy decision from the EU Commission exists for the recipient country or if suitable safeguards (e.g., EU Standard Contractual Clauses) are in place. I have contractually agreed upon appropriate safeguards with my data processors.
Data Retention Period
I only store your personal data for as long as it is necessary for the above-mentioned purposes or as required by statutory retention periods. Once the contractual obligations have ceased to apply or if the data is no longer required for its original purpose, it will be blocked, deleted, or anonymized.
- Data from study participations is deleted after the completion of the study and the fulfillment of contractual obligations, unless there are legal retention obligations or you have expressly consented to further use.
- Data from prize draws will be deleted after the prize draw, unless you have expressly consented to further use.
- Legal retention periods for business records are, for example, 6 or 10 years.
Your Rights as a Data Subject
You have the following rights concerning your personal data:
- Right to information (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (“right to be forgotten”) (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw your consent (Art. 7(3) GDPR)
To exercise your right to erasure (“right to be forgotten”) or withdraw your consent, please send your request to the following email address: hello@smartux.digital
You also have the right to complain to a data protection supervisory authority about our processing of your personal data.
Changes to this Privacy Policy
I reserve the right to change this Privacy Policy at any time in compliance with legal requirements. Any changes will be published on this page.