Privacy Policy
Last updated: September 15, 2026
1. Data Controller
Below we inform you about the collection of personal data when you use our website. Personal data is any data that relates to you personally, such as your name, address, email address and user behavior. The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is: Smarter Start ab 14 e.V. Baron-Voght-Straße 73C 22609 Hamburg Germany Contact: hallo@handyexperiment.org When you contact us by email or via a contact form, we store the data you provide (your email address, where applicable your name and telephone number, and the content of your message) in order to answer your questions. Your data is processed as part of pre-contractual measures or on the basis of your express consent pursuant to Art. 6(1) sentence 1 (a) and (b) GDPR. We delete the data arising in this context once storage is no longer necessary, or we restrict processing if statutory retention obligations apply.
2. Your Rights
You have the following rights regarding your personal data: • Right to access, • Right to rectification or erasure, • Right to restrict processing, • Right to object to processing, • Right to withdraw consent given, • Right to data portability. You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.
3. Withdrawing Consent or Objecting to the Processing of Your Data
If you have given consent to the processing of your data, you may withdraw it at any time. Such a withdrawal affects the lawfulness of processing your personal data from the point you notify us. Insofar as we base the processing of your personal data on a balancing of interests, you may object to the processing. This is the case in particular where processing is not necessary to perform a contract with you, which we indicate in each case in the description of the functions below. If you exercise such a right to object, we ask that you explain why we should not process your personal data as we do. In the event of a justified objection, we will examine the matter and will either stop or adjust the data processing or show you our compelling legitimate grounds for continuing it.
4. Deletion of Personal Data
Data we process is deleted in accordance with statutory requirements once the purpose of processing your data no longer applies or the data is no longer needed for that purpose. Your data is also deleted if processing was based on your consent and you have withdrawn it. You can delete your account and registration data at any time on the "For me" page. It may be that storing your data is necessary for other legally permitted purposes, for example to comply with a legal obligation, to establish, exercise or defend legal claims, or for tax reasons. In these cases, your personal data is processed only for those purposes.
5. Collection of Personal Data When You Visit Our Website
When you use the website for information only, that is, when you do not register or otherwise transmit information to us, we collect only the personal data that your browser transmits to our server. When you view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis is Art. 6(1) sentence 1 (f) GDPR): • IP address • Date and time of the request • Time zone difference from Greenwich Mean Time (GMT) • Content of the request (specific page) • Access status/HTTP status code • Amount of data transferred • Website from which the request originates • Browser • Operating system and its interface • Language and version of the browser software. In addition to the data mentioned above, technically necessary cookies and, optionally if you give your consent, technically non-essential cookies are stored on your computer. Cookies are small text files that are stored on your hard drive, assigned to the browser you use, and through which certain information flows to the party that sets the cookie (here, us). They serve to make the website as a whole more user-friendly and effective. If cookies requiring your consent are set on our website, we will inform you separately within this privacy policy. If you have given your consent, you can withdraw it at any time via the cookie banner on our website. We use TLS encryption to protect your data. You can recognize this by the https:// prefix in your browser's address bar.
6. Other Functions and Services on Our Website
Besides purely informational use of our website, we offer various services you may use if interested. For this you usually have to provide further personal data, which we use to provide the respective service and to which the data processing principles described above apply. In some cases we use external service providers to process your data. These have been carefully selected and instructed by us, are bound by our instructions, and are regularly monitored. Insofar as our service providers or partners are based in a country outside the European Union (EU) or the European Economic Area (EEA), we inform you of the consequences of this at the relevant place in this privacy policy.
7. What Data We Collect
When you create an account: • First and last name • Email address • Password (stored encrypted; we have no access to the plain-text password) When you register for the 2027 Smartphone Experiment: • Role (student, teacher, private individual, company/organization) • Name and email address • Location data of your school or your location (see section 3) • for teachers, optionally: estimated number of students
8. Location Data in Detail
When registering, you select a school or location from an address search, or manually place a pin on a map. In doing so, we collect and store: • the name of the school/location • the address • the GPS coordinates (latitude and longitude) of this place Important: this is the location of the school or of the place you have chosen — not your own current GPS location. The website never queries the live location of your device. The address search and the map display use map data from OpenStreetMap: your search input is sent to the geocoding service Photon (komoot GmbH), and the map tiles are loaded directly from OpenStreetMap servers. Both run without Google services and without API keys; the privacy policy of komoot and of the OpenStreetMap Foundation additionally applies. We use the location data to: • display registrations on a map (for admins, without names/email addresses) • count how many participants come from the same school For the role "private individual", providing a location is optional.
9. Purpose of Processing
We process this data to enable your registration for the 2027 Smartphone Experiment, to send you information about it, to show the progress of the initiative (e.g. the number of participating schools), and to provide you with a personal account with a status overview.
10. Legal Basis
Processing is based on the performance of a contract (Art. 6(1)(b) GDPR). You can terminate this contract at any time, e.g. by deleting your account.
11. Disclosure to Third Parties
Your data is not sold. It is processed by: • Supabase (database and account hosting, EU server location) • komoot GmbH / Photon (geocoding for the address search) and OpenStreetMap (map tiles) • Google Analytics (only after your consent in the cookie banner) • SMTP2Go (sending of emails/newsletter, if you register for it) • Vercel (hosting of the website) Project admins see registration data (name, email, school) in the admin area in order to organize the initiative.
12. Conditions for Transferring Personal Data to Third Countries
In the exceptional cases where personal data is transferred to countries outside the European Economic Area (EEA), i.e. to third countries, this takes place under the conditions set out in Art. 44 et seq. GDPR. We inform you of the details of the respective transfers below at the relevant places. For some third countries, the European Commission has certified, through so-called adequacy decisions, a level of data protection comparable to the EEA standard. In other third countries to which personal data may be transferred, however, there may not be a consistently high level of data protection due to a lack of statutory provisions. Where this is the case, we ensure that data protection is adequately safeguarded. This is possible through binding corporate rules, standard contractual clauses of the European Commission for the protection of personal data pursuant to Art. 46(1), (2)(c) GDPR, certificates or recognized codes of conduct.
13. Cookies
We use technically necessary cookies (e.g. for login and language preference) as well as, after your consent in the cookie banner, cookies for Google Analytics. You can change your choice at any time via the cookie banner.
14. Google Analytics 4.0
Where you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The entity responsible for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Analytics 4 uses cookies that enable an analysis of your use of our websites. The information collected by the cookies about your use of this website is generally transmitted to a Google server in the USA and stored there. With Google Analytics 4, IP address anonymization is enabled by default. Due to IP anonymization, your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. During your visit to the website, your user behavior is recorded. In addition to the personal data mentioned in section 5 of this policy, the following is recorded, among other things: • First visit to the website • Start of the session • Pages visited • Your "click path", interaction with the website • Scrolls (whenever a user scrolls to the end of the page (90%)) • Clicks on external links • Internal search queries • Interaction with videos • File downloads • Ads seen / clicked On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics serve to analyze the performance of our website. Recipients of the data are/may be • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR) • Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA • Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA For the USA, the European Commission adopted its adequacy decision on July 10, 2023. Google LLC is certified under the Data Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example Singapore) cannot be completely ruled out, we have also concluded standard contractual clauses with the provider. Data we send that is linked to cookies is automatically deleted after 2 months. The maximum lifetime of Google Analytics cookies is 2 years. Data whose retention period has been reached is deleted automatically once a month. The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1 (a) GDPR, which you can withdraw at any time. Further information on the terms of use of Google Analytics and on data protection at Google can be found here.
15. Minor Participants
The Smartphone Experiment is aimed in part at students, some of whom are minors. For participants under 16, we recommend registering together with a parent/guardian or through the teacher/school.
16. Changes to This Policy
We may adapt this privacy policy if the website or legal requirements change. The current version is always available on this page.