Privacy policy

1. Controller and scope

Kalman Control UG (haftungsbeschränkt), Kastanienstr. 5, 47269 Duisburg, Germany, is responsible for this company website, enquiries, account administration and its own legal-compliance processing. Contact info@kalmancontrol.de or +49 174 9648159 for privacy questions and requests. Our managing director is Hamid Pedram; further provider information appears in the Imprint.

This notice covers the company website and the functions it offers. Project storage, photos, documents and testing workflows in the separate Kalman FAT Suite application are explained in its full Privacy Policy at www.kalmanfat.com/legal/privacy. Where we process organisational project data on a customer’s behalf, a separately concluded Article 28 GDPR processing agreement is required.

2. Website delivery and security

Visiting the website sends technical information to its delivery and hosting providers, such as IP address, requested page or resource, time, browser/device information, referring page where transmitted and technical errors. This information is used to deliver the requested content, prevent abuse, maintain security and diagnose faults. The GDPR basis is Article 6(1)(f): our legitimate interests in providing a reliable and secure website, balanced against visitors’ rights. Necessary device storage is explained in the Cookie Policy.

Optional page-view analytics, user-presence tracking, advertising cookies, pixels and cross-site profiling are disabled in this version. Earlier versions could store activity/presence records including account identifiers or emails, paths, project identifiers, timestamps and browser information. Existing records are reviewed for deletion or anonymisation when no longer necessary for a specific security, support or legal purpose; their existence does not authorise continued tracking.

3. Enquiries, email and service communications

When you contact us, we process the contact details and information you provide: for example your name, company, email/phone, country, equipment or project description, requested scope, concerns and proposed schedule. The inspection and consultation forms send the entered details to our application server for validation, then prepare an email in your own email application. You must send that prepared email for email delivery; validation alone is not an automated booking or an email-delivery guarantee. Your email provider also processes the message under its own terms.

We process enquiries to take steps at your request towards a contract under Article 6(1)(b) GDPR. For an organisation’s business contacts or other enquiries, Article 6(1)(f) applies to our legitimate interest in answering relevant correspondence and managing the business relationship. Article 6(1)(c) applies to required legal records. A required privacy acknowledgment confirms receipt of this notice and your request to handle the enquiry; it is not a marketing consent or a waiver of rights.

Provide only information needed to understand the enquiry. Do not send passwords, access keys, special-category personal data, sensitive identification documents or confidential technical files through an ordinary enquiry. Ask us for an appropriate secure transfer method where needed. We do not use your enquiry to sell advertising profiles or train AI models.

4. Accounts and browser storage

If you use authenticated website administration or other account functions, the authentication service processes your email, account identifier, credentials/recovery information and session state. Optional profile information is processed only for the relevant requested functions. The basis is Article 6(1)(b) for your contract, or Article 6(1)(f) for administering an organisation’s authorised users and securing access. Account verification and password-recovery emails are necessary service messages.

The website can store a language preference, an authentication session, application cache and requested application preferences in your browser. Any local project-recovery drafts created in an application function may contain full project data and uploaded files, without application-level encryption at rest. Use trusted devices and remove unnecessary local copies after preserving unsynchronised work. Closing an account or deleting cloud content does not automatically erase downloaded files, another collaborator’s exports or site data on every device.

5. Recipients, providers and international processing

Authorised staff can access information needed to handle enquiries, operate or secure the service and fulfil legal duties. Hosting, database/authentication and email providers process the information needed for their respective functions. Required processing agreements, confidentiality duties and safeguards apply; information may also be disclosed for a binding legal request or necessary legal claim. We do not sell your personal or project data or disclose it to unrelated customers for their own purposes.

Vercel provides website delivery and application hosting. The application deployment is configured in US East (Northern Virginia, iad1); network delivery and provider operations can also use other locations. Supabase provides database, content storage and authentication; the configured project database region is Ireland. Provider contracting entities, support and downstream operations can be outside the EEA. Authentication messages use the configured transactional email service; correspondence uses our mailbox service and your chosen email service. Contact us for the current applicable mail provider and processing details.

An EU database region does not promise exclusive EU processing. Where no applicable EU adequacy decision covers a transfer, an appropriate Chapter V GDPR safeguard is required, normally the European Commission’s Standard Contractual Clauses with the relevant assessment and any supplementary measures. You can request information and a copy of the safeguards applicable to a transfer, with confidential details appropriately redacted.

Provider addenda and subprocessor information: Supabase’s Data Processing Addendum and subprocessor list; Vercel’s Data Processing Addendum and subprocessor list. Links are provided below.

6. External links and WhatsApp

Links to the FAT application, company social profiles or WhatsApp open the selected external destination. We do not embed a WhatsApp chat widget that receives your details merely from reading the contact information. If you follow the WhatsApp link or send a message, WhatsApp/Meta and your device’s service process the interaction under their own privacy terms. You can contact us by email or telephone instead. The same principle applies to external provider information links: the destination receives a request when you open it.

7. Retention, deletion and security

We keep enquiries until the matter is resolved, then only for justified business, legal-record or claim-limitation needs. Contractual/account records remain for the relevant relationship and applicable legal retention or limitation periods. Technical records remain only for the delivery, fault-diagnosis or security need, subject to the actual provider configuration. Historical activity records are reviewed separately as described above. We restrict any retained information to its continuing lawful purpose.

You may request account closure, deletion or retention details by email. Required records and contributions controlled by another organisation may need a different treatment from your personal profile. Deletion from the live service does not immediately erase isolated provider backups; residual copies are restricted from normal use until overwritten or deleted under the relevant documented cycle. Browser/downloaded copies remain under the control of the device user or recipient.

We use HTTPS and appropriate access and organisational safeguards for the risks involved. No system can guarantee absolute security, and ordinary email is not an appropriate archive for highly sensitive data. These practical limits do not remove our mandatory data-protection duties. Report suspected unauthorised access promptly to our contact email.

8. Rights, required data and changes

Subject to the applicable conditions, you may request access, rectification, erasure, restriction and data portability. You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f). Where consent is the basis, you can withdraw it for the future without affecting earlier lawful processing. No blanket marketing or optional tracking consent is required to send an enquiry.

Send requests to info@kalmancontrol.de. We may ask for proportionate identity verification and normally respond within one month; any lawful extension is explained. You can complain to an EU supervisory authority, particularly where you live, work or a suspected infringement occurred. Our local authority is LDI NRW, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany; poststelle@ldi.nrw.de; www.ldi.nrw.de. You need not contact us first.

Required form fields are needed to assess and answer the requested scope; without them the form may not submit. Direct email or telephone contact remains available. We do not make solely automated decisions with legal or similarly significant effects or create advertising profiles from your enquiries. We update this notice when processing changes, identify the version above and bring material changes to your attention. Any new processing requiring consent needs a separate choice.