Privacy Policy
Privacy on the kaizea.com website – information under the GDPR
1. Data Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) for this website is:
Kaizea Michael Bader
Pfaffenhalde 30
73230 Kirchheim unter Teck
Email: privacy@kaizea.com
2. Hosting and Server Log Files
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre within the EU. A data processing agreement pursuant to Art. 28 GDPR is in place with the host.
Server log files
When you access the website, information transmitted by your browser is automatically recorded where technically necessary for secure and stable operation:
- IP address of the requesting device
- date and time of access
- page or file requested
- browser type and operating system
- referrer URL (previously visited page)
The legal basis is our legitimate interest in the secure and functional operation of the website (Art. 6(1)(f) GDPR). Log data is not combined with other data sources and is deleted after a short period.
3. Contact Form, Demo Request and Newsletter
When you use one of our forms, we process the data you enter in order to handle your request. Mandatory fields are marked as such.
Contact form
Data processed:
- Name
- Email address
- Club/organisation
- Role/function
- Phone number (optional)
- Your message (optional)
- Source/campaign identifier (UTM parameters, if you arrived via an advertising or campaign link)
The purpose is to handle your enquiry and to contact you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The enquiry is transferred to our internal CRM at app.kaizea.com, operated by the same controller.
Demo request and appointment booking
Data processed:
- Name
- Email address
- Club name
- Role/function
- Your message (optional)
To protect against spam and automated requests, the demo form uses Cloudflare Turnstile; your IP address is transmitted to Cloudflare in the process (see Section 4). To arrange an appointment you can use our booking calendar (Cal.com), which is only loaded after your explicit consent. The legal bases are Art. 6(1)(b) and (f) GDPR, and Art. 6(1)(a) GDPR for loading the booking calendar.
Newsletter
Data processed:
- Email address
- Time of sign-up and confirmation (as proof of consent)
The newsletter is sent using a double opt-in procedure: after signing up you receive an email with a confirmation link, and we only add you to the list after you confirm. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email or by writing to privacy@kaizea.com. Sending and management of the recipient list is handled via Resend (see Section 4).
4. Recipients and Processors
To operate the website we use carefully selected service providers who process personal data on our behalf. Where required, data processing agreements are in place. For transfers to the USA we rely on EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
| Provider | Purpose | Location | Legal basis |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, server log files | Germany (EU) | Data processing agreement (Art. 28 GDPR) |
| KAIZEA CRM (app.kaizea.com) | Receiving and handling contact and demo requests | EU | Same controller |
| Resend, Inc. | Sending confirmation and system emails, managing newsletter recipients | USA | Standard Contractual Clauses / DPF |
| Cloudflare, Inc. | Bot and spam protection (Turnstile) in the demo form | USA | Standard Contractual Clauses / DPF |
| Cal.com, Inc. | Appointment booking (only loaded after consent) | USA | Consent (Art. 6(1)(a)) / SCC |
We operate the Umami analytics ourselves on our own infrastructure in the EU; no data is passed on to third parties (see Section 5).
5. Analytics with Umami
To analyse website usage statistically we use Umami – privacy-friendly analytics software that we host ourselves on our own infrastructure in the EU. Umami works without cookies, does not set any cross-device identifier and does not build personal profiles. Only aggregated metrics such as page views, approximate origin and browser type are recorded. No combination with other data and no identification of individuals takes place.
The legal basis is our legitimate interest in privacy-friendly analytics (Art. 6(1)(f) GDPR). As no cookies are set and no personal profiles are created, no consent is required.
7. Retention Period
We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods:
| Data type | Retention period |
|---|---|
| Contact and demo requests | Until the request is fully handled; thereafter only where statutory periods require |
| Newsletter sign-up | Until you unsubscribe or withdraw consent |
| Server log files | Usually a few days |
8. Your Rights
Under the GDPR you have the following rights. To exercise them, an informal message to privacy@kaizea.com is sufficient:
Access (Art. 15)
You can request information about the data stored about you.
Rectification (Art. 16)
You can request the correction of inaccurate data.
Erasure (Art. 17)
You can request the deletion of your data, unless retention obligations apply.
Restriction (Art. 18)
You can request the restriction of processing.
Data portability (Art. 20)
You can receive the data you provided in a common, machine-readable format.
Objection (Art. 21)
You can object to processing based on legitimate interests.
Withdrawal of consent
Where you have consented to data processing (e.g. the newsletter or external embeds), you can withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
9. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR. The authority responsible for us is:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI)
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
You may also contact the supervisory authority of your habitual residence.
10. Data Security
We take technical and organisational measures to protect your data:
- Encrypted transmission of all pages and forms via HTTPS/TLS
- Server operation in a data centre within the EU
- Data minimisation – we only ask for what is necessary for the respective purpose
- Access to request data restricted to authorised persons
- Regular security updates of the software used
11. Changes to this Privacy Policy
We update this privacy policy when the legal situation or our services change. You will always find the current version on this page.
Last updated: July 2026
12. Use of the KAIZEA App
This privacy policy applies to the kaizea.com website. The separate privacy policy provided there applies to the use of the KAIZEA app and customer account at app.kaizea.com.