Privacy policy

This policy describes which personal data we process when you visit this website, write to us or use Smart Templates, and which rights you have (Art. 13 and 14 GDPR).

1. Controller

The controller responsible for data processing is:

We have not appointed a data protection officer because we are not legally required to. For all questions about data protection, please contact the address above.

2. The most important points in brief

• This website uses no analytics or tracking tools, sets no cookies of its own and loads no third-party fonts, maps or videos.
• Only on the contact page do we embed the spam protection Cloudflare Turnstile; it starts when you open that page. Your request arrives as an email in our mailbox; we do not store any of it in our database.
• Smart Templates creates your documents entirely in your own Dynamics environment. Documents, templates and your business data do not reach us.
• For the license, Smart Templates contacts our license service. Only technical details are transmitted, such as the identifier of your organization (tenant ID) and the installed version; documents and users are not counted.
• Payment is made only on the payment page of Stripe, never on this website.

3. Visiting this website

This website and the manual at /handbuch/ (German only) are hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. With every visit, Cloudflare processes technically necessary connection data:

• IP address of the requesting device
• date and time of access
• requested address, amount of data transferred and status code
• browser identifier (user agent) and the page visited before (referrer), if your browser transmits them

Purpose: to deliver the page, to ensure its security and to fend off attacks. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure and functional website. We do not evaluate this data to recognize visitors or to build profiles.

Cloudflare processes the data as our processor (Art. 28 GDPR). Cloudflare operates a worldwide network of data centers; processing in the USA can therefore not be ruled out (see Section 13).

4. Cookies and browser storage

This website sets no cookies of its own and uses no analytics, advertising or tracking services. All fonts, images and scripts are delivered from the same server as the page itself.

Two exceptions are technically necessary:

• Cloudflare protection features: If Cloudflare detects suspicious, automated access, it may set a technically necessary cookie (e.g. “__cf_bm” or “cf_clearance”) that is valid for a short time and serves only to fend off attacks.
• Manual: If you choose a programming language for the code examples in the manual, your browser remembers that choice in local storage (entry “hb-codesprache”). The entry does not leave your device; you can delete it at any time in your browser settings.

Both are strictly necessary for a service you have expressly requested (Section 25(2) no. 2 TDDDG) and therefore need no consent; we base the subsequent processing on Art. 6(1)(f) GDPR. There is therefore no consent banner on this website. For Cloudflare Turnstile on the contact page, see Section 5.

5. Contact form

Using our contact form, you can ask us a question, request a demonstration (offered on the German form only), request a trial version, request a quote or report a bug.

Which data

• Always: name and email address, as well as the type of request you chose.
• Additionally required, depending on the request: company (demonstration, trial, quote), your message or bug description (question, report a bug), the billing address (quote) and, for a trial, your confirmation that the license terms apply to the trial.
• Voluntary, if you provide it: company (for a question and a bug report), position, comments, VAT identification number and the offer you want (purchase + maintenance contract, purchase or subscription) for a quote, and the installed version of Smart Templates for a bug report.
• Automatically: language and address of the page you send from, time of receipt, a random reference number, the result of the spam protection and your IP address.

In bug reports, please write only what is needed to track down the bug, and no personal data of third parties (such as your customers).

How your request reaches us

Your browser sends the details, encrypted, to our service at Cloudflare (the “license service”, see Section 9). It checks the input and the spam protection and from that sends exactly one email to our mailbox. It is sent via Scaleway Transactional Email of Scaleway SAS (Paris, France), which processes the email exclusively in data centers in France; our mailbox is hosted at Zoho Mail in the data center of the Zoho group in the EU. Your email address appears in this email as the reply address so that we can answer you directly. Your details appear only in the text of the email and in the reply address; the subject contains only the type of request, the reference number and, where applicable, our spam protection’s note “Verdacht Spam” (suspected spam). Scaleway deletes the text after delivery and does not store the reply address (Section 14). The license service keeps no record of this email.

The license service does not store your details in its database. It merely counts how many requests arrive per day (with no link to you as a person). We have switched off the automatic recording of individual calls with the data of the request. In its operational logs at Cloudflare, the license service writes only technical events, such as the fact that a request was sent, with the type of request and language, but neither your name nor your email address nor your message; Cloudflare deletes these logs after seven days at the most. The license service uses your IP address only briefly: the rate limiting at Cloudflare counts requests per sender over about a minute in order to reject excessive requests, and for verification the address goes to Cloudflare Turnstile. We do not send a confirmation of receipt by email; you see the confirmation with your reference number on the page.

Spam protection with Cloudflare Turnstile

Only on the contact page do we load Cloudflare Turnstile from Cloudflare, Inc. Turnstile starts as soon as you open the contact page so that the check is already complete when you submit. Cloudflare therefore processes the following data even if you do not submit the form. Turnstile checks whether the request comes from a human. For this, according to its own statements, Cloudflare processes in particular your IP address, characteristics of the connection (TLS fingerprint), the browser identifier (user agent) as well as the identifier of our form and the address of our page; for this, Turnstile reads characteristics of your browser and may store short-lived, technically necessary data on your device. According to Cloudflare, these characteristics serve solely to detect and fend off bots and not to identify individuals or build profiles. We do not use the optional “pre-clearance” feature, in which Turnstile sets a “cf_clearance” cookie.

For bot detection, Cloudflare acts as our processor. According to its own statements, Cloudflare also uses these characteristics under its own responsibility to improve its bot detection; details are in Cloudflare’s Turnstile Privacy Addendum. The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in protecting our form and our mailbox from automated mass requests. The access to your device that Turnstile needs for this is strictly necessary so that we can provide the contact form you want to use by opening the contact page in a protected way (Section 25(2) no. 2 TDDDG).

Purpose and legal basis

We use your details to answer your request: to arrange a demonstration, to provide you with the trial version and support you during the trial period, to prepare a quote or to process a reported bug. The legal basis is Art. 6(1)(b) GDPR, insofar as your request is aimed at a contract with you or concerns an existing contract. If you inquire on behalf of your company or the request is a general one, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering inquiries from prospects and customers.

We do not use your details for advertising and do not pass them on to third parties, except to the service providers named in Section 12.

Storage period

Your request is stored as an email in our mailbox. We delete it as soon as it has been dealt with and no statutory retention obligation stands in the way. If no contract results from the request, we delete it no later than two years after our last contact. If a contract results, we keep the correspondence for as long as commercial and tax law require (see Section 14).

6. Contact by email

If you write to us directly by email, we process your email address, your name and the content of your message in order to reply. Our mailbox is hosted at Zoho Mail in the data center of the Zoho group in the EU. The same applies to purpose, legal basis and storage period as for the contact form (Section 5).

7. Online demonstrations

If we arrange a demonstration, we invite you by email to an online meeting via Microsoft Teams (provider in the EU: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). In doing so, Microsoft processes your displayed name, possibly your email address, audio and video if you switch on your microphone and camera, chat messages and technical connection data. We do not record demonstrations.

The legal basis is Art. 6(1)(b) GDPR insofar as the demonstration prepares a contract with you, and otherwise Art. 6(1)(f) GDPR (our interest in demonstrating Smart Templates to prospects online). Microsoft acts as our processor; a transfer to the USA cannot be ruled out (see Section 13). For the Teams application itself, Microsoft’s privacy terms apply in addition.

8. Smart Templates in your Dynamics environment

Smart Templates creates documents entirely within the Dynamics 365 environment of the respective customer. Documents, templates, records from Dynamics and details about your users are not transmitted to us for this purpose. For the creation of your documents we are therefore not your processor.

If you use the AI functions, such as Microsoft Copilot or an AI of your choice with the AI package, that processing takes place between you and the respective provider; we receive nothing of it.

The only connection to us is the license check with the technical details from Section 9. If, in an individual case, you give us access to your system or send us sample data, for example to track down a bug, we will agree on a data processing agreement beforehand.

9. License service: license check, updates and purchase

Before every document, Smart Templates checks a signed license key stored in your Dynamics environment. This check needs no outbound connection. Smart Templates receives the key and notices of new versions from our license service, a service we operate at Cloudflare.

When Smart Templates makes contact

Only the part of Smart Templates that runs on Microsoft’s servers in your Dynamics environment talks to the license service, never your browser. It makes contact when someone opens the designer (at most once a day per browser), when someone opens the “License & updates” page or starts a purchase there, in the background when a new key is due, and when no document could be created without a new key.

Which data is transmitted

• the identifier of your organization at Microsoft (tenant ID) and the identifier of the Dynamics environment (environment ID)
• the installed version of Smart Templates and the language (German or English)
• the reason for the request and the number of the existing license key
• a random value that binds the response to the request in a tamper-proof way
• whether the signed-in user may install solutions (just yes or no, no name)
• for a purchase, additionally the product chosen (subscription, purchase or maintenance contract)
• technically, the IP address of the requesting server; that is an address in Microsoft’s data center, not that of your device. We use it only briefly (counting requests over about a minute) to fend off overload, and do not store it.

Not transmitted are documents, templates, records, names, email addresses or identifiers of your users. We count neither documents nor users.

What we store

In the license service’s database (Cloudflare D1, storage location within the EU legal area) we store: the tenant ID, the environment IDs that have reported in, with installed version and time of the first and last report, the language, the status of your license (type, start and end of the trial period, term or maintenance end), the issued license keys and the identifiers under which Stripe records your purchase (e.g. customer, subscription and invoice numbers), as well as, for 30 days, a dispatch record for each email about your license (Section 11). The license service does not store names, addresses, email addresses or IP addresses. It does not record individual requests, it only keeps per-day counters with no link to individuals; its operational logs at Cloudflare contain only technical events and are deleted after seven days at the most.

Purpose and legal basis

We process these details in order to issue and renew license keys, to grant the trial period once per organization, to assign payments to the right license, to draw your attention to new versions and important notices and to fend off misuse. A tenant ID generally designates a company and is then not personal data. Insofar as it does relate to a person, for example in a sole proprietorship, the legal basis is Art. 6(1)(b) GDPR (performance of the license contract or the trial period) and, for the prevention of misuse and the one-time trial period, Art. 6(1)(f) GDPR.

Good to know

• The license service answers requests about a tenant ID without sign-in so that each new environment receives its key without any action on your part. Anyone who knows a tenant ID can therefore query the type and term or maintenance end of the associated license, but no names, prices or payment data.
• If your environments are not allowed to open outbound connections, you can switch off the automatic synchronization on the “License & updates” page and insert the license key, which you then receive from us by email, by hand.

10. Payment via Stripe

Purchases are made only in Smart Templates itself, on the “License & updates” page, never on this website. To pay, the payment page of Stripe opens (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). There you enter company, name, billing address, email address, if desired your VAT identification number, and your payment details (e.g. card or IBAN). We do not receive your payment details. For assignment purposes, Stripe receives from us the tenant ID, the environment ID, the chosen product and the language.

Stripe handles the payment, collects the annual amounts for a subscription and maintenance contract, issues the invoices and provides you with a customer portal in which you can change payment methods, billing address and invoice email, retrieve invoices and cancel. Sign-in there works via a code sent to your invoice email.

The legal basis is Art. 6(1)(b) GDPR (conclusion and performance of the contract), Art. 6(1)(c) GDPR (tax and commercial law retention obligations) and Art. 6(1)(f) GDPR (protection against payment fraud). Stripe processes the data for payment processing on our behalf and for its own purposes, such as fraud prevention and compliance with its own legal obligations, under its own responsibility; for this, the Stripe privacy policy applies. Stripe may also transfer data to the USA (see Section 13).

11. Emails about your license

The license service sends emails that belong to your contract, from the address lizenz@smart-templates.eu: for example payment reminders and dunning notices, the confirmation of a cancellation, notices about the end of maintenance, and links to payment. The recipient is always the invoice email you stored at Stripe. The license service reads it from Stripe only at the moment of sending and does not store it. The emails are sent via Scaleway Transactional Email of Scaleway SAS (Paris, France), exclusively in data centers in France. The legal basis is Art. 6(1)(b) GDPR. We do not send advertising or newsletters this way.

Delivery check: So that we learn when one of these emails does not arrive (for example because the mailbox no longer exists), the license service records for each email the identifier under which Scaleway keeps it, together with the tenant ID, the type of email (e.g. payment reminder or cancellation confirmation), the time of sending and the delivery result, which it later queries from Scaleway. It does not store your email address, the subject or the text of the email for this. If an email could not be delivered, we receive an internal notice so that we can reach you another way. The license service deletes these details 30 days after sending. The legal basis for the delivery check is Art. 6(1)(f) GDPR: we have a legitimate interest in recognizing when an email about your contract does not reach you.

12. Recipients and processors

We use the following service providers:

• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: hosting of the website and the manual, operation of the license service and its database, spam protection Turnstile. Processor (Art. 28 GDPR).
• Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France: sending of the license service’s and contact form’s emails (Scaleway Transactional Email), processing exclusively in data centers in France. Processor (Art. 28 GDPR); the data processing agreement is part of our contract with Scaleway.
• Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands: our email mailbox (Zoho Mail) in the data center in the EU. Processor (Art. 28 GDPR).
• Stripe Payments Europe, Ltd., Dublin, Ireland: payment processing and invoices, partly as processor, partly under its own responsibility (Section 10).
• Microsoft Ireland Operations Limited, Dublin, Ireland: online demonstrations via Microsoft Teams. Processor (Art. 28 GDPR).

Beyond that, we pass on data only if we are legally obliged to do so (for example to tax authorities) or insofar as it is necessary for our bookkeeping (for example to a tax advisor who is bound to confidentiality). We do not sell data and do not pass on data for advertising purposes.

13. Transfers to third countries

Cloudflare, Inc. is based in the USA and operates a worldwide network; with Stripe and Microsoft, too, data may reach the USA. For the USA there is an adequacy decision of the European Commission on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795); Cloudflare, Stripe and Microsoft are certified under it. In addition, these providers have agreed the European Commission’s standard contractual clauses. Zoho processes our data in the data center in the EU; insofar as Zoho group companies outside the EU access it, for example in support, this is done on the basis of standard contractual clauses. Scaleway processes the emails exclusively in France; email sending data is not stored, replicated or backed up outside the EU.

14. Storage periods

We store personal data only for as long as necessary for the respective purpose. In detail:

• Connection data when visiting the website: We do not store it ourselves. According to its privacy policy, Cloudflare keeps it only as long as necessary for delivery, security and the prevention of attacks, and deletes it afterward; Cloudflare does not state a fixed period for this.
• Operational logs of the license service: seven days at the most; they contain no details from your request (Section 5).
• Requests via the contact form or by email: until dealt with; without a contract, no later than two years after the last contact (Section 5).
• Dispatch records of emails about your license in the license service (identifier of the email at Scaleway, tenant ID, type of email, time, delivery result): 30 days after sending (Section 11).
• When sending emails via Scaleway: Scaleway deletes the content of an email as soon as the receiving mail server accepts it or delivery finally fails, at the latest after 36 hours of unsuccessful delivery attempts. Scaleway deletes emails classified as spam after 72 hours and emails held back because of a blocked domain after 15 days; Scaleway keeps encrypted backups for 7 days. Scaleway keeps the sending data (sender and recipient address, subject, time and delivery status) for as long as our sender domain is set up there.
• License data in the license service: for as long as your license exists and for as long as we need it for questions about your contract. We also keep the tenant ID and the data of your trial period afterward so that each organization can use the trial period only once.
• Invoices and accounting records: eight years, business letters six years, in each case from the end of the calendar year (Section 147 AO, Section 14b UStG).

15. Your rights

You have the following rights against us:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR, see Section 16)

Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR); processing carried out until then remains lawful. We do not currently obtain any consents. For all requests, simply contact the address in Section 1.

16. Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data that we base on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. We do not process your data for direct marketing. An informal objection to the address in Section 1 is sufficient.

17. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

18. Further information

Obligation to provide data

You are neither legally nor contractually obliged to provide us with data. Without the required details in the contact form, however, we cannot process your request; you can also write us an email instead. Without the details from Section 9, Smart Templates cannot obtain a license key, and without the details on the payment page, no purchase is possible.

No automated decision-making

There is no automated individual decision-making, including profiling (Art. 22 GDPR). The license check does decide automatically whether a document is created; for this, however, it evaluates no characteristics of individuals, only the license key of your organization.

Security

This website, the contact form and the license service transmit all data exclusively in encrypted form (HTTPS).

Changes to this policy

We adapt this policy as soon as the processing changes. The version published here at any given time applies.

As of: 25 October 2026

← Back to home page