Privacy

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as the legal requirements for one (§ 38 BDSG, Art. 37 GDPR) are not met.

This website is a static information site. It sets no cookies, stores nothing in your browser, includes no advertising services and has no contact forms. For anonymous visitor statistics we use Vercel Web Analytics (section 5). Fonts are served from our own server; no content is loaded from third parties.

Personal data is processed in three cases only: technically when a page is requested (server log files, section 3), briefly for visitor statistics (section 5) and when you contact us by email or phone (section 4).

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through its global network. When you request a page, your browser automatically sends data to Vercel's servers, where it is stored in log files:

• —IP address of the requesting device
• —date and time of the request
• —page or file requested and amount of data transferred
• —referrer URL (the previously visited page, if your browser sends it)
• —browser type and version, and operating system
• —HTTP status code

The purpose of this processing is to deliver the website, keep it running reliably and detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and functioning operation of the website. Vercel keeps the log files only briefly and then deletes them. We do not analyse them or combine them with other data.

We have concluded a data processing agreement with Vercel under Art. 28 GDPR. As Vercel is based in the USA, data may be transferred to a third country. Vercel is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR); in addition, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR). Further information is available in Vercel's privacy notice at vercel.com/legal/privacy-notice.

When you email or call us, we process the data you give us: usually your name, email address or phone number and the content of your message. We use this data only to handle your enquiry and to communicate with you.

The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract or concerns an existing contract, and Art. 6(1)(f) GDPR otherwise; our legitimate interest lies in answering enquiries addressed to us.

We delete the data once your enquiry has been dealt with, unless statutory retention obligations apply. Business correspondence relevant under commercial or tax law is kept for six or eight years under § 257 HGB and § 147 AO.

Our mailbox is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Processing takes place on servers in Germany; a data processing agreement under Art. 28 GDPR is in place with IONOS.

Please note that unencrypted emails can in principle be read by third parties in transit. Do not send us confidential information by unencrypted email.

To see how often the website and which pages are visited, we use Vercel Web Analytics, a service of our host Vercel Inc. (address in section 3). When a page is requested, a script sends the following to Vercel:

• —page visited and referrer URL
• —time of the visit
• —country, derived from the IP address
• —device type, operating system and browser

Vercel Web Analytics sets no cookies and stores nothing in your browser. To count individual visits, Vercel creates a hash from the IP address and browser identifier combined with a random value that changes daily; this hash is discarded after 24 hours. The IP address itself is not stored. We only see aggregated figures and cannot attribute a visit to a specific person.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in measuring the reach of the website and improving its content. For the transfer to the USA, what is said in section 3 applies (data processing agreement, EU-US Data Privacy Framework, standard contractual clauses). You can object to this processing at any time under Art. 21 GDPR; a content blocker in your browser also prevents it.

No marketing or social media services are used beyond this. As no cookies are set, there is no cookie banner.

The website contains links to external websites: to the partners' LinkedIn profiles and to a press release of the Technical University of Munich (tum.de). These are plain links, not embedded content or plugins: merely visiting our website sends no data to these providers. Only when you click such a link do you leave our website; from then on the privacy notice of the respective provider applies, for LinkedIn that of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (linkedin.com/legal/privacy-policy), for TUM the notice available at tum.de/datenschutz.

We disclose personal data only to the processors named in this notice (Vercel, IONOS) and where we are legally obliged to, for example to authorities or courts. We do not sell data or pass it on to third parties for advertising.

The website is delivered exclusively over an encrypted HTTPS connection (TLS). Our mailboxes and systems are secured with two-factor authentication. We keep our technical and organisational measures up to date with the state of the art.

You have the following rights regarding personal data concerning you:

• —access to the data processed (Art. 15 GDPR)
• —rectification of inaccurate data (Art. 16 GDPR)
• —erasure (Art. 17 GDPR)
• —restriction of processing (Art. 18 GDPR)
• —data portability (Art. 20 GDPR)
• —objection to processing (Art. 21 GDPR, see section 10)

To exercise these rights, an informal email to hello@kadvern.com is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, datenschutz.hessen.de. You may also contact the supervisory authority of your usual place of residence.

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. The objection can be sent informally to hello@kadvern.com.

We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR).

We update this privacy notice when the website, the services used or the legal situation change. The version published here applies.