Privacy Policy

1. Who we are

Here you can learn how we process personal data in connection with the use of this website. The following information applies to all persons who visit our website and use our offerings.

This privacy policy does not apply to our recruiting, nor to the processing of personal data within the Kultify platform. For the processing of data that our customers record in the Kultify platform, we conclude a separate data processing agreement (DPA) with the respective customer; this privacy policy does not apply to that processing.

Data protection, and in particular the General Data Protection Regulation (GDPR) applicable in the EU, is known to all Kultify employees and is part of their daily work.

Controller

Kultify GmbH, Lorenzer Platz 5A, 90402 Nuremberg, Germany

Phone: +49 911 477 116 001 · Email: info@kultify.de

We are responsible for this website, its content and the processing of personal data taking place on it. You can reach our data protection team at our postal address as well as by email at datenschutz@kultify.com.

Our data protection principles

• We lay our cards on the table.
• We process only the data we need for our work and our business.
• We process data only where we have a purpose and a legal basis for doing so.
• We secure our systems in line with the state of the art.
• We work with reliable service providers and review them regularly.
• We process and use data only for as long as necessary.
• We do not process sensitive data such as ethnic origin, political opinions, religious or philosophical beliefs and the like.
• We do not process data of children, as the use of our website and our offerings is not intended for persons under 16 years of age.
• We do not make solely automated decisions that produce legal or similarly significant effects on you. For advertising attribution and personalisation by Meta, please see the “Meta Pixel” section.

Providing your personal data is neither legally nor contractually required. Without your data, however, we cannot send you information, offer you services or conclude a contract for the provision of Kultify.

2. When do we process your personal data?

You contact us or visit our website, whether out of curiosity about us and our work, because you are looking for something specific, or because our paths cross on the internet. To provide and use certain offerings, we need your data. So that you can better understand how we process your data, we have provided all the necessary information below.

You visit our website

When you visit our website, we process data about your browser, your operating system, your approximate location, your IP address and some others, in order to ensure the functionality of the website, the security of the connection and a good browsing experience. In addition, we process data for statistical and marketing purposes, in part with the support of service providers. For this processing we ask for your consent. A precise list of all cookies can be found via the cookie settings.

• Which data: IP address, browser type and version, time zone setting, browser plug-in types, approximate geolocation, operating system and version, click behaviour, returning visits, use of third-party services
• Purposes: statistics, optimisation, security, marketing
• Legal basis: legitimate interests (Art. 6(1)(f) GDPR) where the processing is technically necessary; for data that is not technically necessary, solely your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG)
• Storage period: varies depending on the cookie and service, from the session duration up to 2 years; the specific storage periods of the individual services can be found in the respective sections below and in the cookie settings

You use our contact form, call us or send us an email

We are pleased that you are getting in touch, whether by web form, email or telephone. In doing so we process some of your data, such as your first and last name and your email address, in order to handle your request and to be able to contact you. We pass your data on to third parties only where this is necessary to handle your request.

• Which data: first and last name, company information, telephone number, email address, your request
• Purposes: handling your contact request, answering questions, feedback
• Legal basis: performance of pre-contractual measures or legitimate interest in answering your request (Art. 6(1)(b) and (f) GDPR)
• Storage period: until the purpose has been fulfilled

Provision of free information or events

When we make free information and knowledge content available to you, whether online or as part of our events, we need your data in order to be able to provide our offering to you.

If you subscribe to our newsletter, we need your consent. We first send you an email asking for confirmation. This two-step process is known as double opt-in and helps us ensure that we are actually communicating with you.

• Which data: depending on the request, first and last name, company information, telephone number, email address
• Purposes: provision of information, participation in and running of events (online or offline), relationship building, marketing or newsletter dispatch
• Legal basis: contract for the provision of free content in conjunction with your consent to marketing activities; for the newsletter, solely your consent (Art. 6(1)(a) and (b) GDPR)
• Storage period: three years since the contact's last activity or until you withdraw your consent

You request the GBU guide

When you request our guide to psychological risk assessment, we send you an email to confirm your address. You receive the download link only after you explicitly confirm on our website, and we also send it by email. Requesting the guide does not subscribe you to a newsletter or change any existing marketing consent. The following information applies to this download instead of the general information on the provision of free content.

• Which data: email address, language, requested guide, random request and access identifiers, request and confirmation timestamps, delivery status and, where available, campaign information and the referring website without its full page path.
• Purposes and legal bases: providing the requested guide and confirming the recipient address under Art. 6(1)(b) GDPR; reliable delivery, abuse prevention and documenting the request based on our legitimate interests under Art. 6(1)(f) GDPR.
• Recipients: We use n8n Cloud, provided by n8n GmbH, Novalisstraße 10, 10115 Berlin, Germany, to process and temporarily store requests. n8n processes the data on our behalf as a processor. Emails are delivered through our email delivery service. Confirmed requests, including campaign information, are recorded in HubSpot; the information in the "HubSpot" section also applies here. Information about n8n is available at n8n.io/legal/privacy.
• Storage period: Access links are valid for 24 hours from the request. Temporary request data in n8n is deleted after seven days. The confirmed CRM request is subject to the existing retention period of three years since the contact's last activity; deletion in n8n does not delete the CRM contact. For existing customers, the periods described in the "Interest in Kultify" section apply.

Interest in Kultify

If you are interested in learning more about our products and services, we offer you an expert consultation or a web demo. For this purpose we need your contact details (e.g. email address, first and last name).

• Which data: first and last name, company information, telephone number, email address
• Purposes: provision of consultation appointments and web demos, marketing, initiating a customer relationship
• Legal basis: performance of pre-contractual measures or contract (Art. 6(1)(b) GDPR)
• Storage period: three years since the contact's last activity for prospects; for customers, for the duration of the customer relationship plus statutory retention periods

You exercise your data subject rights

If you would like to exercise your data protection rights, please contact us. To ensure that you can exercise your rights, we must process some of your data, for instance to verify your identity and to answer your request.

• Which data: first and last name, address where applicable, email address, content of the request
• Purposes: handling data subject requests
• Legal basis: legal obligation (Art. 6(1)(c) GDPR)
• Storage period: 2 years

3. Trusted third parties that process your data

In the course of our business activities and to provide certain services, we use processors. This takes place in marketing and customer support, for online surveys, the display of videos, the operation of the website (hosting, cookie banner, security and provision) and more. We have concluded data processing agreements (DPAs) with these service providers and, when transferring your data to third countries, we ensure an adequate level of protection. This is achieved either through countries recognised as safe by the EU (adequacy decision), through specific approved contracts (standard contractual clauses), or, where necessary, by obtaining your explicit consent.

For certain processing steps, individual providers act as joint controllers with us or as independent controllers. We explain these roles in the relevant service section, in particular for Meta Pixel.

Detailed information on the services used can be found in the settings options of the cookie banner, via the “Cookie settings” link at the bottom of every page of the website.

4. Analytics tools and third-party services

Consent management

We manage your consent to the use of cookies and comparable technologies via a self-hosted consent tool integrated directly into our website. No external consent-management provider (such as Cybot/Cookiebot) is used. The consent banner itself loads no third-party content; your browser does not connect to any service provider.

We store your selection in two places. First, locally on your device, namely in a first-party cookie (technical name cc_cookie) together with the time of your decision; the cc_cookie cookie is stored on your device for about 6 months (182 days). It serves to avoid asking you again on every visit.

Second, we record every consent decision on our server, both a grant and a refusal. We are legally required to be able to demonstrate a consent that has been given (Art. 7(1) GDPR); without such a record we would also be unable to show that we did not track you after a refusal. We record: a randomly generated identifier for your decision, the time, the categories you accepted and rejected, the version of the consent banner and of this privacy notice, and your browser identifier (user agent). We do not store your IP address. The legal basis is our legal obligation (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Consent is neither required nor possible for this, because the record is precisely the evidence of your decision.

The record is stored in a database of the Bunny Database service (provider: BunnyWay d.o.o., see the section on Bunny.net below), which we operate in the Frankfurt (Germany) region. The data does not leave the EU. We have concluded a data processing agreement with BunnyWay. The data is transmitted solely from our server; your browser does not connect to this database. We delete the log entries after three years.

Operating the consent tool itself is technically necessary and serves our legitimate interest in legally compliant consent management (Art. 6(1)(f) GDPR). The non-essential cookies and services that the tool gates are set solely with your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG).

Plausible Analytics

We use Plausible Analytics to statistically evaluate the use of our website and to improve our offering. The provider is Plausible Insights OÜ, Estonia. Plausible works in a privacy-friendly manner, sets no cookies and does not create cross-device profiles. No information is stored on or read from your device, so no consent under Sec. 25 TDDDG is required for this; only aggregated data that cannot be traced back to you is processed. The data is processed within the EU; reach measurement runs first-party via our own domain (kultify.de), so that your browser does not connect directly to Plausible.

The legal basis is our legitimate interest in privacy-friendly reach measurement (Art. 6(1)(f) GDPR); no consent is required for this. You have the right to object to this processing. Further information at plausible.io/data-policy.

PostHog

We use the analytics tool PostHog to analyse user behaviour on our website and to improve our online offering. The provider is PostHog, Inc., USA. Processing and storage take place on servers within the European Union (EU hosting). No sensitive data such as health data is collected. The cookies set by PostHog (ph_*) are stored on your device for up to 12 months.

The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). Your data is stored only for as long as is necessary for the stated purposes or required by law. You can withdraw your consent at any time. Further information can be found in PostHog’s privacy policy at posthog.com/privacy. Objection requests can be directed to privacy@posthog.com.

HubSpot

For our customer relationship management (CRM), the processing of form requests, appointment booking and for marketing purposes, we use HubSpot. The provider is HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland (parent company: HubSpot, Inc., USA). Data processing takes place via servers within the EU. HubSpot may set cookies to recognise your interaction with our website. The cookies set by HubSpot are stored for varying periods: __hstc and hubspotutk for up to 6 months, __hssc for 30 minutes and __hssrc for the duration of the session.

The legal basis for processing form and booking requests is the performance of (pre-)contractual measures or our legitimate interest (Art. 6(1)(b) and (f) GDPR). For setting non-essential cookies, we rely on your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG).

Where personal data is thereby transferred to HubSpot, Inc. in the USA, this transfer is safeguarded by the EU-U.S. Data Privacy Framework. With its adequacy decision of 10 July 2023 (Decision (EU) 2023/1795), the European Commission determined that an adequate level of data protection exists for US companies certified under this framework; HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework. Further information at legal.hubspot.com/de/privacy-policy.

Advertising attribution (ktfy_ad)

In order to attribute enquiries to the correct advertising campaigns, we set our own first-party marketing cookie with the technical name ktfy_ad. In it we store advertising click identifiers (e.g. Google gclid, Meta fbclid, OpenAI oppref and the corresponding identifiers from Microsoft, LinkedIn, TikTok and X) and UTM parameters that are passed when our website is opened via an advertisement. If you later submit an enquiry, we can attribute it to the original advertising campaign (campaign attribution).

The ktfy_ad cookie is stored on your device for 90 days and is set solely after your consent to marketing. Where the stored click identifiers are transmitted to the respective advertising platform (e.g. Google Ads) for success measurement, this takes place for the purpose of conversion measurement; details are provided in the Google Ads and OpenAI Ads sections.

The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). Consent can be withdrawn at any time.

OpenAI Ads (conversion measurement)

We use OpenAI Ads to advertise Kultify in ChatGPT and attribute completed enquiries to our ads. After you consent to the marketing category, a completed demo, pricing or contact enquiry triggers a transfer of the OpenAI click reference oppref, a random event ID, the time and the page address without URL parameters to OpenAI. The transfer takes place server-side through n8n. Your browser does not connect to OpenAI for this purpose. Names, email addresses, phone numbers, message content and your IP address are not sent to OpenAI through this integration.

OpenAI can link the click reference to an ad interaction and process the data to measure and optimise advertising. We and OpenAI each act as independent controllers for this processing. OpenAI Ireland Limited processes data from the European Economic Area. Under the Ad Tools DPA, OpenAI Ireland Limited uses a valid transfer mechanism for onward transfers to countries without an adequate level of data protection. Processing outside the EEA, including in the United States, is possible.

The legal basis for the transfer is your consent under Art. 6(1)(a) GDPR. Storage of the click reference is described in the advertising attribution section. You can withdraw consent at any time through the cookie settings with effect for the future. We will then stop sending further conversion events. OpenAI's retention period depends on the processing purpose and legal requirements; further information and contact details are provided in OpenAI's privacy policy.

Google Ads (conversion measurement)

To measure the success of our advertising, upon a completed enquiry we transmit to Google, server-side, your SHA-256-hashed email address and the Google click identifier (gclid/gbraid/wbraid) from the ktfy_ad cookie. No cookie is set in the process and your browser does not connect to Google. The provider is Google Ireland Limited, Dublin, Ireland (parent company: Google LLC, USA). The transmission only takes place if you have previously consented to the marketing category.

The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). You can withdraw it at any time with effect for the future via the cookie settings (Art. 7(3) GDPR); the lawfulness of the transmission carried out before the withdrawal remains unaffected. Where data is thereby transferred to Google LLC in the USA, this is safeguarded by the adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC is certified. Further information at policies.google.com/privacy.

Meta Pixel

After you consent to the “Marketing” category, we load Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We use it to measure whether our Facebook and Instagram ads lead to website visits and demo requests and to improve ad delivery. Without this consent, our website does not load the pixel or send data to Meta through it.

The pixel sends pageviews (“PageView”) and successfully completed demo requests (“Lead”). Meta receives the page address, the previously visited page (referrer), event time, IP address, browser and device information, and browser and ad-click identifiers. For a demo request, we also send a random event identifier to prevent duplicate counting. We do not pass names, email addresses, phone numbers or free-text form content to the pixel. Automatic event detection is disabled in our integration.

Meta can associate events with a Facebook or Instagram account and combine them with other information, for example to create usage profiles and personalise advertising. This can also occur when you subsequently visit Meta services. Our advertising reports show aggregated results; they do not give us access to individual Meta profiles.

The pixel may set the first-party cookies _fbp (browser identifier) and _fbc (ad-click identifier). Each lasts up to 90 days from being set or renewed. Meta may also use its own cookies on its domains, depending on your settings there. Further information about those cookies and retention at Meta is available in Meta's cookie policy and privacy policy.

For the collection and transmission of event data to Meta, we act as joint controllers under Art. 26 GDPR. The allocation of responsibilities is governed by Meta's Controller Addendum. In particular, we are responsible for consent and information about our integration. Meta is responsible for the security of its systems and handling data subject requests concerning data stored by Meta. You can exercise your rights against either controller; you can contact us at datenschutz@kultify.com. Meta is independently responsible for its subsequent processing.

Data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; transfers rely on the corresponding adequacy decision under Art. 45 GDPR. Its certification is available in the US Department of Commerce's register.

The legal bases are your consent under Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. You can withdraw it at any time, with effect for the future, through “Cookie settings” at the bottom of the page. We then stop transmission, remove _fbp and _fbc on our domain and reload the page to stop the running pixel. Withdrawal does not automatically recall or delete data already sent to Meta; you can exercise your data protection rights for this purpose.

Snitcher (company identification)

We use Snitcher to identify which companies visit our website and which content interests them. The provider is Snitcher B.V., Oude Enghweg 2, 1217 JC Hilversum, Netherlands. The tracker is loaded only after you have consented to the Marketing category. Before that, no connection to Snitcher is made.

The data processed includes the IP address to match a visit to a company, browser and device characteristics, visited pages including their URLs, the referring page, timestamps and visit duration, and pseudonymous device and session identifiers. Snitcher derives technical fingerprints from browser and device characteristics, including graphics, fonts and audio properties. Results are analysed at company level. Snitcher checks form entries in the browser for email addresses and sends their domain, the part after the @, for company identification. Transmission of complete form contents and session recordings is disabled; we do not send names or complete email addresses through the identify API.

After your consent, Snitcher uses the first-party cookie and local storage entry snitcher_device_id, which last for one year. snitcher_session in local storage groups pageviews into a session and expires 30 minutes after the last activity. The technical cookie __sn_tld_probe checks the cookie domain and is deleted immediately. Technical caches in session storage expire when the tab is closed.

Snitcher processes visitor data on our behalf as a processor. The data processing agreement states that it forms part of the terms and conditions. According to the provider, the central infrastructure is in Frankfurt am Main, Germany. The agreement also lists Sentry for error logging in the USA and CloudFront for worldwide content delivery. Data may therefore be processed outside the EEA. For these transfers, the agreement provides for an adequacy decision or appropriate safeguards under Art. 46 GDPR. We use Snitcher only on the marketing website, not within the Kultify platform.

Snitcher also processes limited technical data as an independent controller to provide, operate and improve its services. According to the agreement, this processing uses aggregated, anonymised or pseudonymised data, without attribution to us or our website and without retaining complete email addresses or form contents for these independent purposes.

Under the agreement, server-side processing lasts as long as necessary to provide the service. After the contract ends, personal data processed on our behalf must be deleted unless statutory retention duties require otherwise.

The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG). You can withdraw it at any time with effect for the future via the cookie settings (Art. 7(3) GDPR). We then delete Snitcher identifiers from the browser and reload the page to stop the running tracker. Further information: Snitcher's privacy policy, visitor data and browser storage, and Snitcher's subprocessors.

Crisp (help chat)

For our help chat on the website we use Crisp. The provider is Crisp IM SAS, 2 boulevard de Launay, 44100 Nantes, France. The chat is loaded only after you have consented to the “Help chat” category; before that, nothing is loaded from Crisp and nothing is stored on your device.

After your consent, Crisp stores a cookie (crisp-client/session/…) on your device with a default storage period of 6 months, together with entries in local storage under crisp-client/* which we delete at the latest when you withdraw your consent. These serve to recognise your chat session so that a conversation is retained across a page navigation. When you use the chat, we process the messages you enter and, if you provide them, your name and email address, timestamps and technical metadata of your visit.

The chat data is stored within the EU (messaging data in the Netherlands, plugin data in Germany). In addition, Crisp operates relay servers in the USA, the United Kingdom and Singapore, which store no chat content but log connection data (IP address, time of the connection, user agent and referring website). Insofar as this constitutes a transfer to a third country without an adequacy decision (USA, Singapore), it is safeguarded by standard contractual clauses pursuant to Art. 46(2)(c) GDPR; for the United Kingdom, an adequacy decision of the European Commission exists.

Empty chat sessions in which no message was sent expire about 30 minutes after your last visit. Sessions containing messages are stored by us until the purpose ceases and are then deleted.

The legal basis is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG); consent can be withdrawn at any time. We have concluded a data processing agreement with Crisp. Further information at crisp.chat/privacy.

AI chat on the website

When you send a message in the AI chat, an AI system answers your questions about Kultify. We use Mistral Agents and Conversations with a model from the Mistral Medium family. The provider is Mistral AI SAS, 15 rue des Halles, 75001 Paris, France. Use is voluntary; you can also reach us through the contact form, by email or by telephone. Please do not enter health data, confidential employee data or other sensitive information.

• Data and purpose: We process your messages, the answers and suggested follow-up questions, conversation and message identifiers, timestamps and technical data used to associate and secure the conversation. This enables us to answer your questions, provide conversation history and prevent abuse. Authorised staff may review conversations to check answer quality and resolve errors. The chat does not make decisions about you that have legal or similarly significant effects.
• Topic hints: At the start of a conversation, we may transmit fixed topic categories derived from your entry page, the current page and recognised campaign parameters, such as "employee survey". For this purpose, the chat does not transmit full URLs, referrers, original campaign values or advertising click identifiers, and does not read an advertising cookie.
• Mistral: Our server sends conversation content to Mistral. Mistral stores messages and answers as conversation history. An additional request containing a limited extract of the conversation may generate optional follow-up questions. Mistral processes chat data on our behalf under a data processing agreement; Mistral's own processing for abuse monitoring is governed by its privacy notice.
• Bunny Database: In a separate database at BunnyWay d.o.o. in Frankfurt, we store a hash associating conversations with the browser, conversation identifiers, timestamps, expiry and processing status, technical checksums, usage counters and the generated text of follow-up questions with their message identifiers. These suggestions may refer to your input. We do not store full transcripts there. Your browser connects only to our website for the chat; connections to Mistral and Bunny are server-to-server.
• Legal bases: We answer general questions and secure the chat on the basis of our legitimate interests in providing accessible, reliable information about our services, checking answer quality and preventing abuse under Art. 6(1)(f) GDPR. Where your enquiry concerns entering into a contract with you, Art. 6(1)(b) GDPR applies.

AI chat: cookie, storage and deletion

• Cookie: We set the technically necessary first-party cookie kultify_chat only when you send a message. It contains a random identifier, protects access to your conversations and lets you continue them in the same browser. It lasts for 30 days from being set, is renewed when you send a message and is restricted to the chat API. It is protected with HttpOnly, Secure and SameSite=Lax. Storage and access are based on Sec. 25(2) no. 2 TDDDG because the cookie is necessary to provide the chat you requested.
• Conversation history: A conversation is available for 30 days from its creation. Further messages do not extend this period. You can delete individual conversations earlier using the trash icon in the chat history. Once you confirm deletion or the period expires, we immediately block access through the website. Deleting the cookie alone does not delete stored conversations.
• Background deletion: A regularly scheduled task then deletes stored follow-up suggestions and request data at Bunny and requests deletion of the conversation at Mistral. If provider deletion fails, we retry it; a technical deletion identifier is retained for this purpose while the browser association is removed. Request counters are cleared after their short abuse-prevention period, normally after two days.
• Storage at Mistral: Stored conversations are excluded from Mistral's zero data retention offering. Our deletion request is distinct from any further retention by Mistral for abuse monitoring, legal obligations or legal proceedings. For the additional API request generating follow-up questions, Mistral ordinarily provides for retention for abuse monitoring for up to 30 days; an activated zero data retention arrangement covering that request may exclude this. Details are available in Mistral's privacy notice.
• Processing locations: Mistral describes the EU as its default storage location. Depending on the service used, data may also be processed outside the EU; exclusively European processing is not promised for this chat. For transfers to countries without an adequacy decision, Mistral provides contractual safeguards, in particular EU standard contractual clauses. Further information is available in the Mistral Trust Center and the international transfers section of this notice.
• Contact requests: The chat does not automatically forward the transcript to our CRM or analytics services. A contact proposal opens a separate form which you review and submit yourself. The sections on the contact form, HubSpot and screening form submissions for bots apply to the information submitted there. Deleting the chat does not delete a separately submitted contact request.

Screening of form submissions for bots (Mistral AI)

When you submit one of our web forms, the submitted data is checked by an AI model to determine whether the submission originates from a bot or spammer. The provider is Mistral AI SAS, 15 rue des Halles, 75001 Paris, France; the model mistral-small-latest is used via Mistral's API. Transmitted in the process are the data you entered in the form (name, company, email address, telephone number, number of employees, interests and your message) and the time you took to fill in the form. No cookie is set and nothing is read from your device, so Sec. 25 TDDDG does not apply.

A submission is never discarded solely on the basis of the AI's assessment; a case classified as suspicious is merely flagged for manual review by a person. Mistral does not retain inputs and outputs beyond the respective request (zero data retention) and does not use them to train its models. Processing takes place on servers in the EU; where Mistral transfers data to a third country, it relies on adequacy decisions or standard contractual clauses. We have concluded a data processing agreement with Mistral.

The legal basis is our legitimate interest in preventing spam and automated submissions and thus in the security of our network and information systems (Art. 6(1)(f) GDPR, cf. Recital 49). Further information at legal.mistral.ai/terms/privacy-policy.

Bunny.net (video delivery, consent record and AI chat)

The provider is BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. We use video delivery and databases from this provider. We have concluded a data processing agreement with BunnyWay. Further information at bunny.net/privacy.

Video delivery. To deliver videos, for instance customer testimonials, we use the content delivery service Bunny.net. When you play a video, your IP address is transmitted to Bunny.net so that the video content can be delivered to your browser. The legal basis is your consent or our legitimate interest in fast and reliable delivery of the content (Art. 6(1)(a) and (f) GDPR).

Consent record (Bunny Database). In a database of the Bunny Database service, which we operate in the Frankfurt (Germany) region, we store the record of your consent decisions (see the "Consent management" section above). Your browser does not connect to Bunny.net for this; the data is transmitted solely from our server and does not leave the EU. No IP address is stored. The legal basis is our legal obligation to be able to demonstrate a consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). The retention period is three years.

AI chat (Bunny Database). We use a separate database in Frankfurt for the AI chat. Data categories, purposes, legal bases and deletion rules are described in the AI chat sections. The consent record retention period does not apply to these data.

Hosting (OVH)

This website is hosted by OVH. The provider is OVH GmbH, Dürerstraße 24, 50668 Cologne, Germany. The servers are located in Germany. When the website is accessed, OVH processes server log data including your IP address in order to ensure the delivery and security of the website. These server log data are stored for 90 days for security purposes and then deleted.

The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with OVH. Processing takes place exclusively within the EU.

Error monitoring (GlitchTip, self-hosted)

In order to detect and fix software errors on this website, we operate the open-source tool GlitchTip on our own infrastructure at errors.kultify.com. The servers are located at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; processing takes place exclusively in Germany. No external error-monitoring provider is involved, and the error data does not leave the EU. We have concluded a data processing agreement with Hetzner.

We record the error message and the associated program flow (stack trace), the address accessed (URL), your browser and operating system, and the time of the error. No account or form data is transmitted; IP addresses are anonymised before storage. GlitchTip sets no cookie and stores no information on your device. Error data is deleted after 90 days.

• Errors in your browser: The error report is only transmitted if you have consented to the “Analytics” category. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time, with effect for the future, via the cookie settings.
• Errors on our server and reports of Content Security Policy (CSP) violations: These arise on our side, or are reported by the browser on the basis of a security directive in the response header; they are necessary for the secure and stable operation of the website. The legal basis is our legitimate interest in the security of our network and information systems (Art. 6(1)(f) GDPR, cf. recital 49). No consent is required for this.

Right to object (Art. 21(4) GDPR): You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. Please address your objection to datenschutz@kultify.com.

5. International data transfers

In specific cases, the data collected in connection with this website may be passed on to third parties located in countries outside the European Economic Area (EEA), for instance in the USA. Some of these countries may not have the same data protection laws as the EEA. In particular, these countries may not offer the same level of protection for your personal data, may not grant you the same rights, and may not have a data protection supervisory authority that can assist you with concerns.

When transferring your personal data outside the EEA, we ensure, where the applicable data protection laws require it, that at least one of the following safeguards is implemented: (1) we transfer your data only to countries or organisations that, in the opinion of the European Commission, provide an adequate level of protection (adequacy decision, e.g. the EU-U.S. Data Privacy Framework); or (2) we use contracts approved by the European Commission, commonly known as “standard contractual clauses”. For the transfer to our US service provider HubSpot, Inc., we rely on the adequacy decision for the EU-U.S. Data Privacy Framework (Decision (EU) 2023/1795), under which HubSpot, Inc. is certified (see the HubSpot section above). For the transfer to Google LLC (USA) in the context of conversion measurement, we likewise rely on the adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC is certified (see the Google Ads section above). For the connection data logged by the relay servers of our chat provider Crisp IM SAS in the USA and Singapore, we rely on standard contractual clauses pursuant to Art. 46(2)(c) GDPR (see the Crisp section above). Please contact us if you would like further information on the specific mechanisms.

6. How we use cookies

Cookies are text information stored on your device via the internet browser. Cookies have various functions.

Technically necessary cookies are required to ensure the website functions. Without them the website would not work. We do not need consent for these (Sec. 25(2) TDDDG). For all other cookies, that is functional cookies, marketing cookies, Crisp help-chat cookies and those for displaying videos, we ask for your consent (Sec. 25(1) TDDDG).

We manage your consent via a self-hosted consent tool. You can change or withdraw your selection at any time by reopening the cookie settings via the “Cookie settings” link at the bottom of every page.

7. Data security

For security reasons and to protect the transmission of personal data and other confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar changes from “http://” to “https://” and by the padlock symbol in your browser bar. When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

8. Your data protection rights

You have the right to be informed about the processing of your personal data. We provide this information with this privacy policy. In addition, you have the right of access, the right to rectification, the right to erasure and the right to restriction of processing. You have the right to a copy of the data we process and may withdraw any consent given at any time with effect for the future. Where we process data on the basis of legitimate interest, you have the right to object. Where we process your personal data by automated means on the basis of your consent or for the performance of a contract, you also have the right to data portability (Art. 20 GDPR); on request, we will provide the data you have given us in a structured, commonly used and machine-readable format.

To do so, please use our contact form or contact our data protection officer directly at datenschutz@kultify.com.

We would prefer that, in the event of a complaint, you first contact us. However, you have the right to lodge a complaint directly with the supervisory authority responsible for Kultify GmbH. Our competent authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, telephone: +49 981 180093-0, email: poststelle@lda.bayern.de.

A list of supervisory authorities in the EEA and their contact details can be found at edpb.europa.eu/about-edpb/about-edpb/members.

9. Data protection officer

Kultify GmbH has appointed Jan Kühnlein as internal data protection officer. You can reach him at:

Kultify GmbH – Data Protection Officer, Lorenzer Platz 5A, 90402 Nuremberg, Germany

Email: datenschutz@kultify.com

10. General terms and conditions

All information on our general terms and conditions and our data processing agreement can be found under Terms and Conditions.

Last updated: November 2026

Change history

• v1.0.0 (1 April 2024): First version based on the privacy notice published on the website, extended with data security (SSL/TLS), server log retention (90 days) and the right to data portability (Art. 20 GDPR).
• v1.1.0 (8 July 2026): Consent management moved from Cookiebot to a self-hosted tool; consent is stored locally in the first-party cookie cc_cookie. Legal basis for operating it: legitimate interest (Art. 6(1)(f) GDPR).
• v1.2.0 (8 July 2026): Per-service retention periods added (cc_cookie, PostHog, HubSpot). Marketing cookie ktfy_ad added. Legal basis for Plausible restated (legitimate interest, cookieless). Transfer to HubSpot identified as covered by the EU-U.S. Data Privacy Framework.
• v1.3.0 (10 July 2026): Crisp help chat added, including its relay servers in the USA, the United Kingdom and Singapore and the standard contractual clauses (Art. 46(2)(c) GDPR). AI-supported bot screening of form submissions via Mistral AI added.
• v1.3.1 (10 July 2026): Help-chat details clarified: cookie name crisp-client/session/…, retention 6 months, local storage until consent is withdrawn.
• v1.3.2 (10 July 2026): Address of BunnyWay d.o.o. updated (Dunajska cesta 165, 1000 Ljubljana, Slovenia).
• v1.3.3 (12 July 2026): Retention for lead and customer contact data updated to three years since the contact's last activity, matching the retention policy held in the CRM.
• v1.4.0 (13 July 2026): Error monitoring via self-hosted GlitchTip added (Hetzner, Germany). Browser errors after consent to "Analytics", server-side errors on legitimate interest; IP anonymised, no cookie, 90 days.
• v1.5.0 (14 July 2026): Server-side consent record added (Art. 7(1) GDPR). Stored are an identifier, timestamp, categories, banner and notice version and user agent, without IP address; Bunny Database, Frankfurt region, deleted after three years.
• v1.6.0 (16 July 2026): Conversion measurement via Google Ads added (hashed email address and click identifier, consent under Art. 6(1)(a) GDPR; transfer covered by the EU-U.S. Data Privacy Framework). Plausible section clarified (first-party via our own domain).
• v1.6.1 (17 July 2026): Change history shortened and restated.
• v1.7.0 (24 August 2026): Leadfeeder (Dealfront) added for company identification (marketing consent, cookies _lfa / _lfa_consent).
• v1.8.0 (8 September 2026): Company identification changed to Snitcher; information on consent, browser storage and data processing updated.
• v1.8.1 (8 September 2026): Snitcher: processing roles, international transfers and server-side retention added.
• v1.9.0 (9 September 2026): OpenAI Ads server-side conversion measurement added; advertising attribution and consent information updated.
• v1.10.0 (14 October 2026): GBU guide: email verification, download, temporary storage in n8n and documentation of confirmed requests in HubSpot added.
• v1.10.1 (22 October 2026): Bot screening (Mistral AI): information on retention period updated.
• v1.11.0 (3 November 2026): AI chat with Mistral, conversation storage, follow-up suggestions, browser association, deletion and separate contact requests added; Bunny Database usage extended.
• v1.12.0 (4 November 2026): Meta Pixel added for pageviews and completed demo requests, including marketing consent, cookies, joint controllership, transfers to the USA and withdrawal. Information on profiling clarified.