privacy notice

1. Controller

Kayba – Manuel Graupner
Waldwinkel 12
14532 Kleinmachnow
Germany

Email: service@wartung.kayba.de

2. Scope and definitions

This privacy notice covers the public website, website check, results links, customer accounts, orders and billing, Kayba Website Connector, support, maintenance, backups and related operations platform. Personal data is information relating to an identified or identifiable natural person. Processing includes collection, storage, use, transmission and deletion.

3. Legal bases

We process personal data where necessary for pre-contract measures or a contract (Art. 6(1)(b) GDPR), to meet a legal obligation (Art. 6(1)(c) GDPR), for our or third parties' legitimate interests not overridden by the person's interests (Art. 6(1)(f) GDPR), or with voluntary consent (Art. 6(1)(a) GDPR). The applicable basis is identified below for each process.

4. Website access and server logs

On access our systems process IP address, date and time, requested address, transferred volume, HTTP status, previous page, browser and operating system details, and technical error/security information. This is needed to deliver content, detect attacks and abuse, investigate errors and evidence secure operations. The basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure, stable and traceable platform operation.

Log data is retained only as long as needed for operations, error analysis and security defence. Security-related extracts may be retained longer if needed to investigate a specific incident or establish or defend claims.

5. Technically necessary cookies and local storage

For sign-in, customer context, sessions, CSRF protection and secure process states we use technically necessary cookies or comparable storage. These enable explicitly requested functions and are not used for advertising profiles. Device access is based on § 25(2) no. 2 TDDDG; subsequent processing follows Art. 6(1)(b) or (f) GDPR.

Optional statistics and campaign attribution are handled separately and activated only after your voluntary purpose selection; details are in sections 5a to 5c.

5a. Voluntary choices and withdrawal

Statistics and campaign attribution are two separate, voluntary purposes, initially disabled. In “Privacy settings” at the page bottom you can allow necessary functions only, both purposes or select individually. The website and check remain usable if declined. Acknowledging this notice and accepting the terms do not replace this voluntary choice.

Your choices are stored without a user identifier under kayba_privacy_choices_v1 in the current tab's session storage for at most 30 minutes. It contains the purpose version, yes/no choices and technical time limits. This preference implements your decision, not visitor analysis. Changes do not extend the period. If your browser blocks storage, choices apply only to the current document. Old campaign storage is not treated as consent.

Optional device access relies on consent under § 25(1) TDDDG; personal data processing relies on Art. 6(1)(a) GDPR. You can withdraw consent anytime in “Privacy settings”. No further optional data is then collected or sent; ongoing transfers are stopped where technically possible. Data already received by the server cannot be recalled this way. Prior processing remains lawful. For data already transmitted, contact the address in section 1.

5b. Data-minimising audience and search performance measurement

Only after selecting “Statistics” do we use self-hosted Umami and our own loading/interaction quality collection on public pages. Measurement runs on our infrastructure; no analytics goes to Google or advertising networks. Code sends the known public path without query parameters or fragment, website ID and optionally only the referring external domain. Six predefined click/form events are also counted. Form input, free labels, titles, email addresses and campaign parameters are not sent. Account, results, checkout, referral and admin pages and unknown paths are excluded.

The method sets no statistics cookies and stores no permanent statistics ID in the browser. Umami does process transmitted IP and user agent to identify browser, operating system, device and approximate region and derive time-limited session IDs. This is pseudonymous, not a promise of complete anonymity. A server-returned cache ID remains only in this document's memory and is discarded on withdrawal. “Do Not Track” and “Global Privacy Control” also disable measurement.

After statistics consent, LCP, INP and CLS may also be read from browser performance data. Measurement, public path, window width and navigation type are sent. Rounded value, device class, time and release reference are stored, not IP or user agent in the measurement record. Missing browser support is not shown as a good measurement. Field measurements are normally removed after 120 days; Umami events are automatically deleted and kept for at most 400 days.

5c. Optional campaign attribution for the website check

Only with separate consent may source, medium, campaign, content variant, a validated partner reference and the public entry path be retained for at most 30 minutes under kayba_attribution_v3 in the current tab's session storage. These values are not linked across tabs or devices. Secret referral codes are not stored as analytics dimensions. On rejection, withdrawal or expiry, attribution is discarded and removed from open form fields; if browser timers are suspended, no later than the next access, navigation or submission.

Only when a website-check request is submitted with separate consent still valid are the limited campaign fields stored with the request. Evidence includes the purpose version attribution-2026-09-12 and the server receipt time. Without consent the request is processed without campaign fields. Without JavaScript no browser statistics run; attribution is possible only through the expressly selected optional checkbox in the check. Consent is not a newsletter subscription. Sections 6, 15 and 19 govern request retention and deletion rights.

5d. Server-side process totals and search performance data

Necessary business processes such as requests, website checks, checkout and contracts are analysed from their business records independently of optional browser statistics. Browser events never determine payments or contract status. Required contractual processing relies on Art. 6(1)(b) GDPR; data-minimising operational analysis on Art. 6(1)(f) GDPR, serving reliable and improvable service operations.

We may also import aggregated performance data for our own website from Google Search Console or Bing Webmaster Tools into protected Operations. Exports include date, target page, query, device, clicks, impressions, CTR and average position. Queries may exceptionally contain personal terms. They are not linked to visitor, customer or contract profiles, are accessible only to authorised operators and deleted by the centrally evidenced process after at most 395 days. The purpose is improving content discoverability under Art. 6(1)(f) GDPR. No Google or Bing tracking code is loaded in your browser for this.

6. Website check

For the website check we process the entered website and business email address, time and version of acknowledged privacy notice and terms, business-status confirmation, technical request data, public website features, results and minimised evidence. Acknowledging the privacy notice is not separate consent to arbitrary data processing.

The purposes are the requested initial technical analysis, results delivery, plan assignment, abuse prevention and, where applicable, preparing a customer account. Bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR for security, evidence and abuse prevention. Check data and dependent findings are designed for 30-day retention, then removed by regular cleanup unless part of a subsequent contract or required evidence.

The check retrieves only publicly accessible resources of the specified website. Kayba's server address may appear in the website's or provider's logs. The requester must be authorised to have the website checked.

7. Results links and recommendations

Results are provided through cryptographically signed, time-limited links. URLs contain no email address or raw technical evidence. Public results are normally accessible for seven days; underlying check data follows cleanup described in section 6.

8. Customer account, contract and authentication

During account creation and contract performance we process business contact/master data, email, website assignments, booked plans, contract/billing status, secure access tokens, connection states, setup progress, user actions and audit events. Plaintext passwords and connection tokens are not stored as readable business data.

Purposes are account and contract management, secure authentication, website assignment, service delivery, communication and evidence. Bases are Art. 6(1)(b) and (f) GDPR and Art. 6(1)(c) GDPR for statutory documentation and retention duties.

9. Orders, payment and Stripe

We use Stripe for checkout, subscriptions, invoices, payment-method management and fraud prevention. Stripe receives business contact and billing data, website/plan assignment, amount, currency, transaction/contract IDs and payment data you enter directly in Stripe. We generally do not receive full card or bank-account details.

For EEA users, services involve in particular Stripe Payments Europe, Limited and Stripe Technology Company, Limited in Ireland. Depending on the activity, Stripe acts as processor and as independent controller for its own statutory or regulatory purposes. Stripe may use affiliates and providers outside the EEA with required safeguards, particularly adequacy decisions and EU standard contractual clauses. More information is in the Stripe privacy notice and in the Stripe Privacy Center. The legal bases for our transfer are Art. 6(1)(b), (c) and (f) GDPR.

10. WordPress maintenance, connector and maintenance platform

After engagement, Kayba Website Connector and our self-hosted maintenance management environment process website address, technical IDs, WordPress/PHP/plugin/theme versions, update/security states, availability, SSL status, diagnostics, maintenance results and pseudonymous connection evidence. Administrator access and permissions are limited to what agreed maintenance requires.

Purposes are setup, monitoring, controlled updates, error analysis, restoration and documenting maintenance. Kayba's own contract and operational data is processed under Art. 6(1)(b) and (f) GDPR. Personal data for which the business customer is controller is processed only under an Art. 28 GDPR agreement and documented instructions.

11. Backups and restoration

Depending on the plan, backups cover database, plugins, themes, uploads, other WordPress content and technical metadata. Backups may contain personal data processed on the customer's website. Archives are encrypted before external storage, checksum-verified and stored separately per tenant. Payload encryption keys are not delivered to customer websites or browsers.

Regular retention is 14, 30 or 60 days depending on the plan; separately agreed monthly archives may last longer. Incomplete, orphaned or faulty backup remnants are automatically detected, quarantined and cleaned in a controlled process. After contract termination, backups are removed when retention expires unless a specific preservation, evidentiary or legal duty prevents it.

12. Support, tickets and email

For contact and support requests we process name, business email, website assignment, subject, message, attachments, technical diagnostics, processing status and communication history. Please send no passwords or unnecessary special-category personal data.

Email transport uses IONOS SE. Processing serves request handling, contract performance, troubleshooting and traceable communication under Art. 6(1)(b) and (f) GDPR. Messages are deleted once the case is closed and no legal retention, security or evidentiary interests remain.

13. Hosting and recipients

The platform, databases, maintenance control and encrypted object storage run at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in European data centre regions. Hetzner processes technical data under a data processing agreement.

Other recipients are only those needing data for the purpose: Stripe for payments, IONOS for email, professional advisers bound by confidentiality, and authorities or courts where legally required. Personal data is not sold or shared for advertising.

14. Third-country transfers

The core platform and backup storage run in Europe. Payments or communication may involve providers with affiliates or subcontractors outside the EEA. Transfers occur only where Art. 44 et seq. GDPR requirements are met, particularly adequacy decisions, suitable safeguards such as EU standard clauses or statutory exceptions. Request details of specific safeguards at the address in section 1.

15. Retention periods and deletion

We retain data only as long as required for its purpose. Check and backup periods follow sections 6 and 11. Account data is needed during the customer relationship. After full account deletion, operational access is promptly blocked, websites are removed from management in a controlled process and related operational data is deleted after successful offboarding.

Invoice and tax evidence is stored separately with restricted access for statutory retention; invoice storage is designed to run through the end of the eighth following year. Data may additionally be retained until limitation periods expire where necessary to establish, exercise or defend legal claims. Once the reason ends, it is deleted or anonymised.

16. Account deletion

Business customers can request full account deletion through the designated account function. The process revokes access tokens, ends assigned services, removes websites and customers from maintenance management, deletes the Stripe customer object where possible and removes operational platform data. Legally retained invoice evidence is limited to necessary details and stored separately until expiry.

17. Automated processing

Website checks, plan suggestions, status checks and operational jobs are partly automated. Alone they have no legal effect within Art. 22 GDPR. A plan recommendation can be changed before checkout; technical rejections or findings can be referred for manual review.

18. Data security

We use risk-appropriate technical and organisational measures: TLS transmission, access separation, role permissions, encrypted backups, separate key management, signed time-limited links, logged state changes, retry/error controls and regular cleanup of unneeded artefacts. No method guarantees absolute security; safeguards are therefore continuously reviewed and developed.

19. Data subject rights

Subject to legal conditions, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). Consent-based processing may be withdrawn at any time for the future. Prior processing remains lawful.

To exercise your rights, simply send a message to service@wartung.kayba.de. To prevent unauthorised disclosure, we may require reasonable identity verification.

20. Objection to legitimate interests

You may object on grounds relating to your situation to processing under Art. 6(1)(f) GDPR. We then stop processing unless overriding compelling legitimate grounds exist or processing serves legal claims. Personal data is not processed for direct marketing after objection to that use.

21. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our location is:

The Brandenburg State Commissioner for Data Protection and the Right of Access to Files
Stahnsdorfer Damm 77
14532 Kleinmachnow
Phone: 033203 356-0
Email: Poststelle@LDA.Brandenburg.de
www.lda.brandenburg.de

22. Optional AI product advice

Product advice explicitly labelled AI answers questions about public Kayba services. Only after active, non-preselected consent and submission are your question and up to three previous question-answer pairs sent to the OpenAI API. The basis is consent (Art. 6(1)(a) GDPR). Use is voluntary; website checks, contact and booking work without AI. Please enter no customer data, credentials or confidential content.

The adviser accesses no customer accounts, tickets, contracts or your website. Page content, visited URLs and account data are not automatically sent to OpenAI. Conversation history remains only in the current tab's memory, not cookies, local storage or a chat database. “Clear history” removes this local history. Abuse prevention uses time-limited request counters and technical error categories without conversation content.

The recipient of voluntarily submitted information is OpenAI as the API service provider. The interface is used with store=false when called. This prevents storage as retrievable API response history but does not exclude provider security and abuse logs, which may contain content and, according to the provider, generally be kept for up to 30 days subject to legal requirements. Exclusively European processing or zero storage is not promised. OpenAI gives details in its API data controls.

Withdraw consent for further transfers at any time by unchecking the box. Closing the assistant stops waiting for a reply but cannot undo a transfer already made. Contact the privacy contact above for access or deletion of processed information. AI replies may contain errors and replace neither a binding offer nor personal advice.

23. Updates to this notice

We update this notice when functions, recipients, legal bases or statutory requirements change. The version displayed during the website check is logged with a timestamp for documented acknowledgement.

Dated: 29.09.2026 · Version: privacy-2026-09-29