Privacy Policy
1. Privacy at a glance
General information
The following information provides an overview of what happens to your personal data when you visit this website. Personal data means any information relating to an identified or identifiable natural person.
Who is responsible for data processing?
The controller for the processing carried out through this website is K&S German Equity GmbH. Full contact details are provided in Section 3 below.
How do we collect your data?
You provide some data directly, for example when you complete the contact form or Market Assessment, contact us by email, or telephone us. Other data, especially technical data such as your IP address, browser type, operating system, referrer URL, and time of access, is collected automatically when you use the website. Optional third-party content is processed only in accordance with the consent choices described below.
How do we use your data?
We process data to provide the website securely and reliably, respond to inquiries, assess whether our services may be suitable for a prospective client, take steps before entering into a contract, comply with legal obligations, and, with your consent, understand how visitors use the website through Google Analytics 4. We do not use advertising pixels or Google Analytics advertising features.
What rights do you have?
Subject to the applicable legal requirements, you may request access to, correction or deletion of, or restriction of processing of your personal data. You may also object to certain processing, withdraw consent with effect for the future, receive certain data in a portable format, and lodge a complaint with a supervisory authority. Details appear in Section 9.
2. Hosting and email services
This website and the associated email service are hosted by:
united-domains GmbH
Gautinger Strasse 10
82319 Starnberg
Germany
Personal data collected through the website may be stored on the host’s servers. This can include IP addresses, server log data, website access data, contact and communication data, form submissions, and other data generated through use of the website. According to united-domains, its hosting servers for webspace and email are located in Germany.
The processing is carried out to provide the website securely and efficiently and, where relevant, to perform a contract or take steps at the visitor’s request before entering into a contract. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. Where processing depends on consent, the legal basis is Article 6(1)(a) GDPR together with Section 25(1) TDDDG.
We have entered into a data processing agreement with united-domains as required by Article 28 GDPR. united-domains processes personal data on our documented instructions to the extent necessary to provide the contracted hosting and email services.
Provider privacy information: View information
3. Controller
The controller responsible for processing personal data through this website is:
K&S German Equity GmbH
represented by its Managing Director, Tim Kröger
Timms Hege 9
22397 Hamburg
Germany
Phone: +49 176 20846992
Email: info@k-s-gmbh.de
The controller is the natural or legal person that determines, alone or jointly with others, the purposes and means of processing personal data.
4. General information
Data protection and security
We treat personal data confidentially and in accordance with applicable data protection law and this Privacy Policy. Internet transmission can nevertheless involve security risks, and complete protection against access by third parties cannot be guaranteed.
This website uses SSL or TLS encryption to protect confidential content transmitted to us. An encrypted connection is generally indicated by https:// and a lock symbol in the browser address bar.
Retention periods
Unless a more specific retention period is stated below, we retain personal data only for as long as necessary for the purpose for which it was collected. We delete data when the purpose no longer applies, when you validly request deletion, or when you withdraw consent, unless statutory retention obligations, the establishment, exercise or defense of legal claims, or another lawful ground requires continued storage. Data subject to statutory commercial or tax retention obligations is deleted after the applicable period expires.
Legal bases
Depending on the processing activity, we rely on one or more of the following legal bases: consent under Article 6(1)(a) GDPR; performance of a contract or steps taken before entering into a contract under Article 6(1)(b) GDPR; compliance with a legal obligation under Article 6(1)(c) GDPR; or our legitimate interests under Article 6(1)(f) GDPR. Where information is stored on or accessed from a user’s terminal device, Section 25 TDDDG also applies. Any consent may be withdrawn at any time with effect for the future.
Recipients
Within K&S German Equity GmbH, personal data is accessible only to persons who require it for the relevant purpose. We may disclose data to service providers acting on our behalf, including our hosting and email provider, or to professional advisers and public authorities where legally required. Processors receive data only under a valid data processing agreement. We do not sell personal data.
Transfers outside the European Economic Area
Some third-party services described below may process data in the United States or other countries outside the European Economic Area. Where applicable, transfers are based on an adequacy decision, including the EU-US Data Privacy Framework for certified organizations, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Further details are provided in the relevant service sections and the providers’ privacy information.
5. Cookies and comparable technologies
Cookies
Our website may use cookies and comparable technologies such as local storage. Session cookies are deleted after the browser session. Persistent cookies remain on the device until they expire or are deleted by the user. Cookies may be set by us or by third-party providers.
Technically necessary storage or access is used only to transmit communications or provide a digital service expressly requested by the user. Section 25(2) TDDDG applies to such technologies, and any associated personal data processing is based on the applicable provision of Article 6(1) GDPR. Non-essential storage or access takes place only after consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.
You can manage or withdraw your choices at any time through the Cookie Settings link on the website. You can also configure your browser to restrict or delete cookies. Disabling technically necessary cookies may limit website functionality.
Consent management
The website uses a consent management mechanism to obtain, document, and manage choices for optional cookies and third-party content. A technically necessary cookie or local-storage entry records the consent status so that the website can respect the selected preferences. This record remains until it expires under the configured settings, is deleted from the device, or consent is withdrawn. The processing used to document consent is based on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR; the necessary device storage is based on Section 25(2) TDDDG.
Server log files
The hosting provider automatically collects and stores information sent by the browser in server log files. This may include browser type and version, operating system, referrer URL, hostname or IP address, and time of the server request. We do not combine this data with unrelated data sources.
Log processing is necessary for secure, stable, and technically correct delivery of the website and is based on Article 6(1)(f) GDPR. Log data is deleted when it is no longer required for these purposes, unless an identified security incident or legal obligation requires longer retention.
6. Contacting us and the Market Assessment
Contact form
If you submit an inquiry through the contact form, we process the information entered in the form, associated contact details, the content of the inquiry, and technical metadata needed to transmit and protect the submission. The data is used to respond to the inquiry and handle follow-up questions.
The submission is delivered to us by email through united-domains and is also stored in the WordPress database. Access is restricted to authorized persons. We do not disclose the submission to independent third parties without a legal basis.
Where the inquiry concerns a potential contract or requested services, processing is based on Article 6(1)(b) GDPR. In other cases, it is based on our legitimate interest in responding effectively to inquiries under Article 6(1)(f) GDPR, or on consent under Article 6(1)(a) GDPR where expressly requested.
We retain the data until the inquiry and any reasonably expected follow-up are complete and the data is no longer required, unless the inquiry results in a contractual relationship, statutory retention obligations apply, or the data is required for legal claims.
Market Assessment
The multi-step Market Assessment is used to understand a prospective client’s needs and assess whether our services may be suitable. Depending on the responses provided, we process a business email address, telephone number, assessment answers, and any other business or project information voluntarily submitted. Please do not submit special-category data or other sensitive information that is not necessary for the assessment.
The assessment data is delivered by email through united-domains and stored in the WordPress database. We use it to review the inquiry, communicate with the prospective client, prepare or discuss a service proposal, and take steps requested before a possible contract. The principal legal basis is Article 6(1)(b) GDPR. Where no contract-related request is involved, processing is based on our legitimate interest in evaluating and responding to business inquiries under Article 6(1)(f) GDPR.
The assessment may apply predefined criteria to indicate whether our services appear suitable. This is a preliminary and non-binding business assessment. It does not constitute automated decision-making that produces legal effects or similarly significantly affects a person within the meaning of Article 22 GDPR.
Assessment data is retained until the evaluation and any reasonably expected follow-up are complete and is then deleted, unless a contract is entered into, statutory retention obligations apply, or the data is required for legal claims.
Contact by email or telephone
If you contact us by email or telephone, we process the inquiry and resulting contact and communication data to handle the matter. The legal basis is Article 6(1)(b) GDPR where the communication concerns a contract or pre-contractual steps. Otherwise, processing is based on Article 6(1)(f) GDPR or, where requested, Article 6(1)(a) GDPR. The same retention criteria described for contact-form inquiries apply.
7. Social media links and sharing functions
Ordinary links
Our website contains ordinary links to social media profiles, including services operated by Meta Platforms and X. Merely displaying a standard link does not establish a connection to the social network. When you click a link, you leave our website and the selected provider receives the request and related technical data, such as your IP address and referrer information. The provider then processes data under its own responsibility and privacy terms.
Share buttons
The website also provides sharing functions for selected social networks. Where a share button is implemented as a simple link, data is transmitted to the selected network only when the button is clicked. Where a provider script or embedded element is required, the function must remain blocked until consent is given under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn at any time through Cookie Settings.
When a sharing function is activated, the provider may receive the visited page, IP address, device and browser data, and information linked to a logged-in social-media account. We cannot control the provider’s subsequent processing.
Meta Platforms – Facebook and Instagram
For users in the European Economic Area, Facebook and Instagram are generally provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may also be processed in the United States and other countries. Where Meta content is activated on our website, we and Meta may be joint controllers for the collection and transmission of data to Meta under Article 26 GDPR; Meta is responsible for its subsequent processing.
Meta privacy information: View information
Instagram privacy information: View information
Meta controller addendum: View information
X (Twitter)
X functions are provided by X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, United States. For persons outside the United States, the relevant entity may be Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Data may be transferred to the United States. X may associate a visit or sharing action with an account if the user is logged in.
X privacy information: View information
X data-transfer information: View information
8. Plugins and media content
Self-hosted video content
Videos currently displayed on this website are uploaded to and delivered from our WordPress hosting environment. No connection to YouTube, Vimeo, or another external video platform is established solely because a video is displayed or played. When a video file is requested, the technical data described in the server-log section may be processed by united-domains to deliver the file securely and reliably. The legal basis is Article 6(1)(f) GDPR.
If we later use an external content delivery network or video provider, we will update this Privacy Policy and, where required, the consent settings before activating that service.
Google reCAPTCHA v2
We use Google reCAPTCHA v2 to distinguish human input from automated access and protect forms against spam and abuse. The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When reCAPTCHA is activated, Google may process technical and behavioral information such as the IP address, browser and device information, referrer URL, time spent on the website, mouse movements, and interaction with the reCAPTCHA challenge. Google may also use cookies or comparable technologies. The information may be transferred to Google servers, including servers in the United States.
reCAPTCHA is activated only after consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Without consent, a protected form may not be available; you can instead contact us directly by email or telephone. Consent can be withdrawn through Cookie Settings. Google may rely on the EU-US Data Privacy Framework where available and Standard Contractual Clauses for international transfers.
Google privacy information: View information
Google terms: View information
Google Fonts hosted locally
We use locally hosted Google Fonts for consistent typography. The font files are stored on our own hosting environment, and no connection to Google servers is made solely to display these fonts.
Google Fonts FAQ: View information
Google Analytics 4
With your consent, this website uses Google Analytics 4 (“GA4”), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 helps us understand how visitors use the website and improve its content, navigation, and technical performance.
When activated, GA4 may process online identifiers, browser and device information, approximate location, referrer information, pages viewed, interactions, timestamps, and session information. Cookies or comparable technologies may be used to distinguish browsers and sessions. According to Google, GA4 does not log or store individual IP addresses; for users in the European Economic Area, the IP address is used only transiently to derive coarse location information and is discarded before the resulting data is logged.
GA4 is blocked until you give consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent at any time through Cookie Settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We configure GA4 without Google Signals, User-ID, advertising personalization, or links to Google advertising products. Data sharing with Google for its own product-improvement purposes is disabled. The retention period for user-level event data is set to 14 months and does not restart upon new activity. Aggregated data in standard reports is not affected by this setting and may remain available for longer.
Google may process data in the United States and other countries outside the European Economic Area. Where applicable, transfers rely on the EU-US Data Privacy Framework for certified recipients or on the European Commission’s Standard Contractual Clauses. We have accepted Google’s data processing terms for processing carried out on our behalf.
We do not currently use Google Ads conversion tracking, Meta Pixel, LinkedIn Insight Tag, or comparable advertising tracking technologies. We will update this Privacy Policy and the consent settings before introducing any such service.
Google Analytics privacy information: View information
Google Analytics data-retention information: View information
Google privacy information: View information
9. Your rights
Withdrawal of consent
You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
Right to object
Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is required for legal claims. You may object to processing for direct marketing at any time; after objection, the data will no longer be used for that purpose.
Access, rectification, and erasure
Within the limits of applicable law, you may request confirmation whether we process your personal data, access to that data and related information, correction of inaccurate data, and deletion of data where the legal requirements are met.
Restriction of processing
You may request restriction of processing, in particular while the accuracy of data is being verified, where processing is unlawful and you prefer restriction to deletion, where we no longer need the data but you require it for legal claims, or while an objection is being assessed.
Data portability
Where processing is automated and based on consent or a contract, you may receive personal data that you provided to us in a structured, commonly used, machine-readable format and request transmission to another controller where technically feasible.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority responsible for private-sector organizations established in Hamburg is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Strasse 22
20459 Hamburg
Germany
Email: mailbox@datenschutz.hamburg.de
Telephone: +49 40 42854-4040
Supervisory authority website: View information
How to exercise your rights
To exercise your rights or ask a privacy question, contact us at info@k-s-gmbh.de or use the postal address in Section 3. We may request information necessary to verify identity before responding.
10. Changes to this Privacy Policy
We may update this Privacy Policy when our website, services, legal requirements, or data-processing practices change. The current version is made available on this website with its effective date. Material changes will be reflected before any newly introduced processing begins where required.
