Privacy Policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Mario Deubler, Schödlbergergasse 16/53, 1220 Vienna, Austria, reachable at hallo@kiimu.at.

General information

We process personal data only in connection with this website and only to the extent necessary to provide a functional website and our content and services. Which data is processed in detail and for what purpose depends largely on the functions you use (e.g., accessing the page, using the contact form). Depending on the processing, the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract, or performance of a contract), Art. 6(1)(f) GDPR (legitimate interest, in particular in the secure and stable operation of the website) or Art. 6(1)(a) GDPR (consent), where consent is obtained.

Hosting (Vercel)

This website is hosted by Vercel Inc. (USA). The associated transfer of data to the USA is based on the EU Standard Contractual Clauses as appropriate safeguards under Art. 46 GDPR. When you access the website, server logs are created automatically and stored for a limited period, including the IP address, the timestamp of the access and the user agent of the browser used. This processing serves the technical delivery of the website and the detection of and defense against security incidents, and it is based on our legitimate interest under Art. 6(1)(f) GDPR.

Cookies and consent

On your first visit to this website, a banner asks for your consent to the use of cookies for analytics and marketing purposes (Google Analytics, Google Ads, Meta Pixel, PostHog). Without your consent, no such cookies are set; in that case, only cookieless, non-personal signals as part of Google Consent Mode and session-based, cookieless analytics data (PostHog) are transmitted. Your choice is stored locally in your browser. You can change or withdraw your decision at any time with effect for the future: Change cookie settings.

Storage of your consent decision

We record the decision you make in the banner so that we do not ask you again on every visit and so that we can demonstrate what you consented to (Art. 7(1) GDPR). To do so, we store your choice in your browser's local storage (entry kiimu-consent) and additionally mirror the marketing decision into a cookie named kiimu-consent-marketing with a lifetime of one year. The cookie is necessary because our server otherwise cannot tell whether a report to Meta is permitted; the server cannot read local storage. The cookie contains only the value 0 or 1 and no identifier by which you could be recognized. Storing the decision itself does not require consent: without it, your objection could not be implemented technically (§ 165(3) of the Austrian Telecommunications Act, TKG). You can delete both at any time in your browser settings.

Web analytics (Vercel Analytics)

To measure reach, we use Vercel Web Analytics, a service of Vercel Inc. (USA). Vercel Analytics does not use cookies and does not create cross-device user profiles; it collects aggregated data such as pages visited, referrer, country, browser type and device type. The IP address is not stored permanently; it is processed only to generate a short-lived, anonymized value. The transfer of data to the USA is based on the EU Standard Contractual Clauses under Art. 46 GDPR. The legal basis is our legitimate interest in the statistical evaluation of website use under Art. 6(1)(f) GDPR.

Google Analytics

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies that make it possible to analyze your use of the website (including pages visited, time spent, approximate location and the device used). The information generated in this way may be transferred to servers of Google LLC in the USA and processed there; Google is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and EU Standard Contractual Clauses are used in addition. Google Analytics 4 does not store the IP address. The legal basis for the processing is your consent under Art. 6(1)(a) GDPR; you can withdraw your consent at any time with effect for the future. You can find more information in Google's privacy policy.

Google Ads (conversion measurement)

We run ads through Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To measure which ad led to an inquiry, we report the successful submission of one of our forms to Google as a conversion. If you have consented to the “Marketing” category, cookies are set or read in the process, through which an ad click can be attributed to a later inquiry; on this basis, Google can show you relevant ads on third-party websites. Without your consent, no such cookies are set and you are not recognized; in that case, only cookieless signals as part of Google Consent Mode are transmitted, from which Google statistically estimates the number of conversions. For technical reasons, these signals also contain your IP address and the page visited. We transmit only the path of the page visited, without anything appended to the address; in particular, the website address you entered in the analysis form is not sent. A transfer to Google LLC in the USA is possible; Google is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and EU Standard Contractual Clauses under Art. 46 GDPR are used in addition. The legal basis for the consent-based processing is Art. 6(1)(a) GDPR; you can withdraw your consent at any time with effect for the future via the cookie settings.

Meta Pixel (Facebook, Instagram)

If you have consented to the “Marketing” category, we use the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The Meta Pixel allows us to measure the effectiveness of our ads on Facebook and Instagram and to show relevant ads there to visitors of this website. In the process, cookies are set and information about your use of this website is transmitted to Meta, in particular pages visited, your IP address, information about your browser and device, and the submission of our contact form as a “Lead” event (without the contents of the form fields, except for the email address described below, which is transmitted as a cryptographic hash value (SHA-256)). This data may be linked to an existing Facebook or Instagram account and further processed by Meta for its own purposes; to that extent, we and Meta are joint controllers under Art. 26 GDPR. A transfer to Meta Platforms, Inc. in the USA is possible; Meta is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and EU Standard Contractual Clauses under Art. 46 GDPR are used in addition. The legal basis is exclusively your consent under Art. 6(1)(a) GDPR; without your consent, the Pixel is not loaded. You can withdraw your consent at any time with effect for the future via the cookie settings. You can find more information in Meta's privacy policy.

Meta Conversions API (server-side transmission)

If you have consented to the “Marketing” category, we additionally report the successful submission of one of our forms via the Meta Conversions API. Unlike with the Meta Pixel, this transmission does not take place in your browser; it goes from our server to Meta. The following is transmitted: your email address, exclusively as a cryptographic hash value (SHA-256, which neither we nor Meta can convert back into plain text, but which is suitable as a means of recognition), your IP address, your browser's identifier, the page from which the form was submitted, and the click and browser identifiers assigned by Meta, if available. We do not transmit any further information from the form, in particular not your name, your phone number, the website address you entered or your answers in the AI readiness check.

The purpose is to measure the effectiveness of our ads. The Pixel report and the server report carry the same event identifier so that a single action is not counted twice. Here, too, we and Meta are joint controllers under Art. 26 GDPR. The legal basis is exclusively your consent under Art. 6(1)(a) GDPR; without this consent, no transmission takes place. You can withdraw your consent at any time with effect for the future via the cookie settings.

Ad click identifier (fbclid)

If you reach us through one of our ads on Facebook or Instagram, Meta appends a click identifier (“fbclid”) to the address of this website. Only if you have consented to the “Marketing” category do we store this identifier in a cookie named kiimu-fbc with a lifetime of 90 days, so that we can attribute the ad through which you arrived to a later inquiry. Without your consent, the identifier is not stored; it expires when you leave the page. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG.

Product analytics (PostHog)

To analyze the use of our website, we use PostHog, an analytics service of PostHog Inc. (USA). We use PostHog's EU cloud; the data is processed and stored on servers within the European Union (Frankfurt am Main). We collect interactions with the website such as page views, clicks and form interactions. We do not collect the contents of form fields, with one exception: when you submit the contact form, we transmit the size class of your company that you selected (for example “100–300”), so that we can evaluate which company sizes our offering suits. We do not transmit your name, your email address, your phone number or your company name to PostHog. For the AI readiness check, we do not transmit any of your answers. If your signup results in an account, we additionally transmit the event “account created” from our server to PostHog. It contains the user ID assigned by our signup service, the page on which you created the account and whether your confirmation email is still pending. Your email address, your name and your company name are not included, and the event is not linked to any identifier of your browser. The legal basis is our legitimate interest in knowing how many started signups lead to an account, Art. 6(1)(f) GDPR. If you scan the QR code on one of our pilot program letters, we transmit the event “letter scan” from our server to PostHog. It contains the code printed on your letter (once in a uniform spelling, with capital letters and digits only, and once exactly as it arrived with the request), whether the code in its uniform spelling has the expected format, the identifier of your browser and device (user agent) and the address from which the request came (referrer). Each letter carries a different code, and we can match it to the recipient of the letter; we do not pass it on to the booking page, and the event is not linked to any identifier of your browser or to any other visit to this website. The legal basis is our legitimate interest in knowing which recipients respond to our mailing, Art. 6(1)(f) GDPR. You can object to this processing at any time at hallo@kiimu.at; if you instead arrange the appointment informally by email to hallo@kiimu.at, the event is not created at all. Without your consent, data is collected only per session, cookieless, in your browser's memory and with no persistent identifiers (legal basis: legitimate interest in improving our offering, Art. 6(1)(f) GDPR). Only with your consent under Art. 6(1)(a) GDPR are cookies or local storage entries set that allow recognition across several visits; you can withdraw this consent at any time via the cookie settings. Where access by the US parent company cannot be ruled out, it takes place on the basis of the EU Standard Contractual Clauses under Art. 46 GDPR. You can find more information in PostHog's privacy policy.

Fonts

The fonts used on this website are self-hosted and are not loaded from external servers (e.g., Google Fonts). Loading the fonts therefore does not transmit any of your data to third parties.

Appointment booking (Google Calendar)

On the pages /demo-buchen and /en/book-demo, we integrate an appointment scheduler of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in an embedded frame (iframe). If you scan the QR code on one of our pilot program letters, we redirect you directly to such an appointment scheduler at Google, with no page in between; you are then directly on a Google page. The scheduler is loaded when the page is called; in the process, your IP address, information about your browser and device, and the address called are transmitted to Google. If you are signed in to a Google account at that time, Google can associate this visit with your account. If you book an appointment, Google processes the data you enter in the process (name, email address and, where applicable, your message) and transmits it to us so that we can attend the appointment. A transfer to Google LLC in the USA is possible; Google is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), and EU Standard Contractual Clauses under Art. 46 GDPR are used in addition. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, with regard to embedding the scheduler and the redirect from the QR code, our legitimate interest in simple appointment scheduling under Art. 6(1)(f) GDPR. If you want to avoid the transmission, arrange an appointment informally by email to hallo@kiimu.at instead. You can find more information in Google's privacy policy.

Contact form

If you request a conversation or access through one of our contact forms (on /anmelden, /en/signup, /use-cases/rechnungsverarbeitung, /archive/v1 or /use-case-finden), we process the data you provide (name, company, phone, email, number of employees) to handle your inquiry and to contact you, on the basis of Art. 6(1)(b) and (f) GDPR. On /anmelden and /en/signup, the same information is also used to create your user account; this is described in the section “User account and waitlist (Supabase)”. Which of this information is requested depends on the form in question. To deliver the inquiry by email, we use Proton Mail (Proton AG, Geneva, Switzerland); for Switzerland, there is an adequacy decision of the European Commission under Art. 45 GDPR. We do not pass this data on to third parties beyond this, with two exceptions: the report of the submission described in the sections “Google Ads”, “Meta Pixel” and “Meta Conversions API”, which takes place only with the corresponding consent and in which we do not transmit your name, your phone number or your company name; and the transmission of your company's size class described in the section “Product analytics (PostHog)”. The data is deleted as soon as the purpose of the inquiry has been fulfilled and no statutory retention obligations prevent deletion.

User account and waitlist (Supabase)

If you create an account on /anmelden or /en/signup, we process the data you provide (company, name, email address and your password) to create and manage your user account. We also store the language of the page you signed up on (“de” or “en”); it determines the language of the emails about your account. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). We store your password exclusively as a cryptographic hash; we cannot read it, and it is neither sent by email nor transmitted to third parties. We send a confirmation link to your email address to make sure that the address belongs to you.

For the account and the database, we use Supabase (Supabase, Inc., USA). The instance operated for us runs in the EU region (Frankfurt am Main, Germany); your account data is stored there. Supabase acts as our processor under Art. 28 GDPR. Where access from the USA may occur in the course of support or maintenance, it is based on the Standard Contractual Clauses of the European Commission under Art. 46(2)(c) GDPR. For details, see Supabase's privacy policy.

Resend (Plus Five Five, Inc., San Francisco, USA) delivers the confirmation email on our behalf. For this, Resend receives your email address and the content of the email, that is, your name and the confirmation link, and processes this data in the USA. Resend acts as our processor under Art. 28 GDPR; the transfer to the USA is based on the Standard Contractual Clauses of the European Commission under Art. 46(2)(c) GDPR. For details, see Resend's privacy policy.

A newly created account is not approved at first: for this purpose, we internally record the approval status and the time of any approval. As long as approval is pending, you cannot sign in and no payment obligation arises. In addition to creating the account, we send your information to ourselves by email (without your password), as described in the section “Contact form”, so that we can get in touch with you. You can request the deletion of your account informally at any time at hallo@kiimu.at; we then delete it together with the associated data, to the extent that no statutory retention obligations prevent this.

AI readiness check and factsheet

Through the AI readiness check on /archive/v1, you can answer five questions about your current use of AI and then request our EU AI factsheet. For this purpose, we process your information (email, company and your answers to the readiness questions) exclusively to send you the factsheet and to contact you about your request, on the basis of Art. 6(1)(b) and (f) GDPR. As with the contact form, delivery takes place by email via Proton Mail (Proton AG, Geneva, Switzerland; adequacy decision under Art. 45 GDPR). We do not pass this data on to third parties beyond this, except for the report of the submission described in the sections “Google Ads”, “Meta Pixel” and “Meta Conversions API”, which takes place only with the corresponding consent. We do not transmit your answers in the AI readiness check as part of that report. The data is deleted as soon as the purpose has been fulfilled and no statutory retention obligations prevent deletion.

Your rights

Within the scope of the applicable statutory provisions, you generally have the following rights: the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object to processing and the right to withdraw consent you have given at any time with effect for the future. An informal message to hallo@kiimu.at is sufficient to exercise these rights.

Right to lodge a complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.