1. Introduction
This Privacy Policy provides information about how Kladero GmbH i.G. (hereinafter referred to as “Kladero” or “we” or “us”) processes personal data. In particular, we process personal data relating to the following categories of individuals:
- Individuals who represent or work for our Customers (where “Customer” means any natural or legal person that enters into an agreement with Kladero, either as “Kladero Product Customer” if the agreement concerns access to a Kladero product, or as “Kladero Service Customer” if the agreement concerns the provision of services by Kladero), including contact persons, authorized representatives, account administrators, billing contacts, and authorized users of Kladero products or services (hereinafter collectively referred to as “Customer Personnel and Users”);
- Customers who are natural persons;
- Individuals who visit our websites, contact us, attend our events, interact with our communications or social media channels, or otherwise express an interest in Kladero or its products or services (hereinafter collectively referred to as “Prospects”);
- Individuals who create an account for, access, or otherwise use the Kladero Platform, whether on their own behalf or on behalf of another person or organization (hereinafter collectively referred to as “Kladero Platform Users”);
- Individuals who represent or work for our suppliers, service providers, professional advisers, cooperation partners, or other business partners (hereinafter collectively referred to as “Supplier and Business Partner Personnel”);
- Individuals who apply for employment or otherwise participate in a recruitment process with Kladero (hereinafter collectively referred to as “Job Applicants”); and
- Other individuals who communicate or otherwise interact with Kladero in a professional or business context (hereinafter collectively referred to as “Other Business Contacts”).
This Privacy Policy applies to Kladero Platform Users when they:
- create an account used to access or use the Kladero Platform through auth.kladero.com or through another method made available by Kladero (hereinafter referred to as a “Kladero Platform Account”);
- manage a Kladero Platform Account through a website made available under a Kladero domain or subdomain, or through another method made available by Kladero;
- log in or otherwise authenticate through auth.kladero.com or through another method made available by Kladero; or
- access or otherwise use the Kladero Platform.
Other privacy policies may apply where you interact with Kladero in another capacity, including as a Prospect, Customer, Customer Personnel and User, Supplier and Business Partner Personnel, Job Applicant, or Other Business Contact. For processing relating specifically to these categories, this Privacy Policy is supplemented by other privacy policies listed under the “Privacy” section of our Legal Center page.
Where another privacy policy applies to a separate interaction or processing activity, that privacy policy governs the relevant processing.
2. Controller responsible for processing
For the processing activities covered by this Privacy Policy, Kladero acts as the controller and determines the purposes and means of the processing. The contact details of Kladero are as follows:
- Company: Kladero GmbH i.G.
- Address: Rüttenscheider Straße 120, 45131 Essen, Germany
- Managing directors: Paul-Andrei Dragan, Sven Michael Smolka
- Telephone: +49 231 13751426
- Privacy contact email: contact@kladero.com
3. Definitions
For the purposes of this Privacy Policy, “personal data” means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person. Personal data does not include information that has been rendered anonymous in such a manner that the individual is no longer identifiable.
A “data subject” is the identified or identifiable natural person to whom personal data relates.
“Processing” means any operation performed on personal data, whether or not by automated means, including collecting, recording, organizing, structuring, storing, adapting, retrieving, consulting, using, disclosing, restricting, erasing, or destroying personal data.
4. Legal bases for processing
We process personal data in accordance with the General Data Protection Regulation (“GDPR”) and other applicable data protection laws. We process personal data only where an applicable legal basis permits the processing. The legal basis applicable to each purpose is identified in the relevant processing-activity section of this Privacy Policy.
4.1 Performance of a contract
We process personal data where the processing is necessary:
- to take steps at your request before entering into a contract; or
- to perform a contract to which you are a party.
The legal basis is Article 6(1)(b) GDPR (“Performance of Contract”). In connection with the Kladero Platform, this legal basis applies in particular where processing is necessary to:
- create, activate, administer, suspend, restore, or delete your Kladero Platform Account;
- authenticate you, maintain your session, recover Kladero Platform Account access, and provide the access rights assigned to you;
- provide the functions, settings, workflows, and organization or workspace access available through your Kladero Platform Account;
- process the actions and requests you submit through the Kladero Platform;
- provide communications necessary to create, administer, or use your Kladero Platform Account or the Kladero Platform; and
- receive, investigate, and resolve support requests relating to your Kladero Platform Account or use of the Kladero Platform.
Where processing is based on Performance of Contract, you must provide or permit the processing of the personal data necessary for the relevant Kladero Platform Account, access, Kladero Platform, communication, or support function. If you do not provide or permit this processing, we may be unable to create or administer your Kladero Platform Account, authenticate you, provide the relevant Kladero Platform function, communicate information necessary for use of the Kladero Platform, or investigate and resolve your support request.
4.2 Legal obligations
We process personal data where this is necessary to comply with a legal obligation to which Kladero is subject.
The legal basis is Article 6(1)(c) GDPR (“Legal Obligations”). In connection with the Kladero Platform, this legal basis may apply in particular where processing is necessary to:
- receive, assess, and respond to requests made under applicable data protection law;
- verify the identity of a person making a data protection request where necessary and proportionate;
- document the handling of data protection requests, objections, restrictions, withdrawals, or complaints;
- provide or document information required under applicable data protection law;
- cooperate with competent courts, supervisory authorities, or other public authorities where legally required; or
- retain records for a period prescribed by applicable law.
Where personal data is required for compliance with a legal obligation, failure to provide the necessary information may prevent us from processing a request, verifying your identity, or fulfilling the relevant legal requirement.
4.3 Legitimate interests
We process personal data where the processing is necessary for our Legitimate Interests or those of a third party, provided that those interests are not overridden by your interests, fundamental rights, or freedoms.
The legal basis is Article 6(1)(f) GDPR (“Legitimate Interests”). Depending on the processing activity, the interests pursued include:
- verifying Kladero Platform Account information and the authorization to create, activate, recover, or administer a Kladero Platform Account;
- enabling organizations, workspace administrators, and other authorized persons to manage user access, roles, permissions, and organization or workspace membership;
- maintaining an accurate and reliable Kladero Platform Account, authentication, access, communication, and support records;
- administering and verifying the delivery of Kladero Platform Account, service, support, and security communications;
- operating the Kladero Platform reliably and maintaining its availability, compatibility, stability, and technical performance;
- monitoring technical operation, diagnosing errors, and identifying recurring technical or support issues;
- reviewing and improving the functionality, usability, reliability, and support processes of the Kladero Platform;
- protecting Kladero Platform Accounts, the Kladero Platform, communications, systems, and related infrastructure against unauthorized access, misuse, fraud, attacks, technical failures, and other security threats;
- communicating important operational and security information concerning Kladero Platform Accounts or the Kladero Platform;
- maintaining evidence of terms, notices, policies, communications, acknowledgments, and other relevant activities;
- demonstrating the lawfulness and proper administration of processing activities where no more specific legal obligation applies; and
- investigating and resolving disputes and establishing, exercising, or defending legal claims.
Before relying on Legitimate Interests, we assess the interests pursued, the necessity of the processing, and the potential impact of the processing on the individuals concerned.
Where we process personal data on the basis of Legitimate Interests, you may object to the processing on grounds relating to your particular situation, as described in Section 5.
5. Your rights
Subject to the conditions and limitations set out in applicable data protection law, you have the following rights regarding the processing of your personal data:
5.1 Right of access
In accordance with Article 15 GDPR, you have the right to obtain confirmation as to whether we process personal data concerning you and, where this is the case, to obtain access to that personal data and the information specified in Article 15 GDPR.
5.2 Right to rectification
In accordance with Article 16 GDPR, you have the right to request the correction of inaccurate personal data concerning you and the completion of incomplete personal data.
5.3 Right to erasure
In accordance with Article 17 GDPR, you have the right to request the erasure of personal data concerning you where the applicable legal requirements are met.
5.4 Right to restriction of processing
In accordance with Article 18 GDPR, you have the right to request the restriction of the processing of your personal data where the applicable legal requirements are met.
5.5 Right to data portability
In accordance with Article 20 GDPR, where processing is based on consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and, where technically feasible, to have that data transmitted directly to another controller.
5.6 Right to object
In accordance with Article 21 GDPR, where we process your personal data on the basis of legitimate interests, you have the right to object to the processing on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including related profiling.
5.7 Right to withdraw consent
In accordance with Article 7(3) GDPR, where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5.8 Rights relating to automated decision-making
In accordance with Article 22 GDPR, where applicable, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the applicable legal exceptions and safeguards.
5.9 Right to lodge a complaint
In accordance with Article 77 GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
The supervisory authority responsible for Kladero is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), whose contact details are available at https://www.ldi.nrw.de.
6. Processed personal data
Depending on how you interact with us, we may process the following categories of personal data.
6.1 Personal data collected directly from you
We may collect the following categories of personal data directly from you when you communicate or otherwise interact with Kladero:
| Category of personal data | Description and examples | When we collect it |
|---|---|---|
| Identity data | Information used to identify or distinguish you, such as your first name, last name, salutation, title, or another personal identifier. | When you create or manage a Kladero Platform Account, use the Kladero Platform, contact the Kladero support services in connection with the Kladero Platform, or otherwise interact with Kladero in connection with the Kladero Platform. |
| Contact data | Information used to communicate with you, in particular your email address and, where provided, your telephone number or postal address. | When you create or manage a Kladero Platform Account, provide or update your contact details, or contact us in connection with the Kladero Platform. |
| Account data | Information relating to the creation and administration of your Kladero Platform Account, such as your account identifier, username, account status, account creation date, assigned roles and permissions, organization or workspace membership, and account configuration. | When you create, configure, access, update, or otherwise manage your Kladero Platform Account. |
| Authentication data | Information used to authenticate you and protect access to your Kladero Platform Account, such as password-related records, authentication tokens, login status, authentication method, multifactor-authentication information, and records of successful or failed authentication attempts. | When you create login credentials, log into the Kladero Platform, authenticate your identity, or use account security functions. |
| Professional and organizational data | Information concerning your professional role or organizational affiliation, such as your employer or organization, business unit, job title, professional responsibilities, and role within an organization or workspace. | When you create or join an organization or workspace, are invited to the Kladero Platform on behalf of an organization, or otherwise use the Kladero Platform in a professional capacity. |
| Platform support and communication data | Information provided by you in connection with support requests and other Kladero Platform-related communications, such as the content of your request, correspondence, screenshots, attachments, requested support, availability, and appointment or scheduling details. | When you request support, report a problem, ask a question, arrange a support call or meeting, or otherwise communicate with us concerning the Kladero Platform. |
| Consent records | Records demonstrating the giving, confirmation, withdrawal, or refusal of consent, including the relevant wording and privacy information presented to you, the method of collection, timestamps, confirmation status, and associated technical records. | When you provide, confirm, refuse, or withdraw consent in connection with the Kladero Platform. |
| Email confirmation data | Records relating to the confirmation of an email address, such as confirmation status, confirmation timestamps, and the confirmation method used. | When we ask you to confirm an email address in connection with the creation, activation, recovery, or administration of your Kladero Platform Account. |
| Data-subject request and compliance data | Information relating to requests made under data protection law, such as the type and content of the request, correspondence concerning the request, identity-verification information, records of our assessment and response, and any restriction or objection resulting from the request. | When you exercise or seek to exercise a right relating to your personal data, submit a privacy complaint, or otherwise communicate with us about data protection. |
| Terms, notice, and acknowledgment data | Records concerning terms, privacy information, notices, policies, declarations, or other legal information presented to you, and any acceptance or acknowledgment by you, including the relevant version, date, time, method, and associated technical records. | When we provide legal information or ask you to accept or acknowledge terms, notices, policies, or declarations relating to your Kladero Platform Account or use of the Kladero Platform. |
| Other data provided by you | Any other personal data that you voluntarily provide and that is not covered by one of the categories above, including personal data contained in free-text fields, attachments, or other materials submitted to Kladero. | When you voluntarily provide such information while using the Kladero Platform or communicating with us about your Kladero Platform Account or the Kladero Platform. |
6.2 Personal data generated through communications and use of the Kladero Platform
6.2.1 Personal data automatically generated through communications
We may generate the following personal data when we send or otherwise manage communications concerning your Kladero Platform Account or your use of the Kladero Platform:
| Category of personal data | Description and examples | When we generate it |
|---|---|---|
| Communication delivery and status data | Technical and status information concerning communications, such as email delivery status, bounce information, failed delivery attempts, and whether a communication was successfully delivered. | When we send or attempt to send Kladero Platform Account-related, security, support, or other Kladero Platform communications. |
6.2.2 Personal data automatically generated when you use the Kladero Platform
We may generate or automatically collect the following personal data when you create or access a Kladero Platform Account or otherwise use the Kladero Platform:
| Category of personal data | Description and examples | When we collect or generate it |
|---|---|---|
| Network and connection data | Information concerning the connection between your device and the Kladero Platform, such as your IP address, date and time of access, requested domain, network protocol, response status, and amount of data transferred. | When your device establishes a connection with, requests a resource from, or otherwise communicates with the Kladero Platform or related infrastructure. |
| Device and browser data | Technical information concerning the device, software, and configuration used to access the Kladero Platform, such as device type, operating system, browser type and version, language settings, and supported technical capabilities. | When your browser or device transmits this information or when it is required to display, operate, or secure a function of the Kladero Platform. |
| Request and server-log data | Records generated in connection with requests to the Kladero Platform, such as the requested resource, request method, timestamp, response code, request identifier, application event, and error record. | When our servers, applications, or infrastructure receive and process requests relating to your Kladero Platform Account or use of the Kladero Platform. |
| Authentication and access event data | Records concerning access to a Kladero Platform Account, such as login timestamps, authentication method, successful or failed login attempts, logout events, session status, and Kladero Platform Account access events. | When you log in, log out, authenticate, or otherwise access your Kladero Platform Account or use the Kladero Platform. |
| Session and security identifier data | Temporary or persistent technical identifiers used to maintain or protect your Kladero Platform Account and sessions, such as session identifiers, CSRF tokens, request identifiers, authentication tokens, and similar integrity-protection values. | When such identifiers are created, transmitted, or verified to establish or maintain an authenticated session, protect a request, or secure a function of the Kladero Platform. |
| Security event and misuse-prevention data | Information relating to actual or suspected security events or misuse, such as unusual or failed requests, rate-limit events, blocked requests, indicators of automated activity, suspected attack patterns, and records of security investigations or remedial measures. | When our systems detect, assess, prevent, investigate, or respond to suspected misuse, fraud, unauthorized Kladero Platform Account access, attacks, or other security threats. |
| Platform interaction and functional usage data | Information concerning how the Kladero Platform is used, such as functions accessed, actions performed, navigation paths, interactions with forms or interface elements, application events, and the sequence or duration of interactions. | When you navigate through or interact with the Kladero Platform, to the extent such information is collected through its functionality. |
| Diagnostic and performance data | Information used to assess the technical operation of the Kladero Platform, such as loading times, latency, application failures, browser errors, crash information, availability measurements, and other diagnostic events. | When a technical event, failure, performance measurement, or diagnostic process occurs in connection with your Kladero Platform Account or use of the Kladero Platform. |
| Cookie and similar-technology data | Information stored or accessed through cookies or comparable technologies used to authenticate you, maintain your session, remember essential settings, or secure the Kladero Platform. | When a cookie or comparable technology is used through the Kladero Platform. |
6.3 Personal data obtained from third parties
In limited circumstances, we may obtain personal data concerning you from another person or organization in connection with the creation, administration, or use of your Kladero Platform Account.
Where we obtain personal data from a third party and have not already provided you with the relevant privacy information, we provide that information within the period required by Article 14 GDPR, unless an applicable exception applies.
6.3.1 Google authentication
Where you register for or log in to the Kladero Platform using your Google account, we receive personal data from Google that is necessary to authenticate you and associate your Google account with your Kladero Platform Account. Depending on the information made available by Google, this may include your identity data, contact data, and authentication data.
Google processes personal data in connection with your use of its authentication service in accordance with its own privacy policy.
6.3.2 Organizations, administrators, and inviting users
Where an organization administrator, your employer, a colleague, or another authorized person invites you to the Kladero Platform, creates or configures access for you, or assigns you to an organization or workspace, we may receive the following personal data:
| Category of personal data | Description and examples | When we receive it |
|---|---|---|
| Identity data | Information used to identify you, such as your first name and last name. | When another authorized person creates or initiates access to the Kladero Platform for you. |
| Contact data | Information used to send an invitation or communicate with you, in particular your email address. | When another authorized person invites you to create or access a Kladero Platform Account. |
| Professional and organizational data | Information concerning your organization, professional role, business unit, or organizational affiliation. | When another authorized person assigns you to an organization, workspace, team, or professional role. |
| Account data | Information concerning the access intended for you, such as your assigned role, permissions, organization or workspace membership, and invitation status. | When an administrator or another authorized person configures or manages your access to the Kladero Platform. |
7. Processing activities
The following sections describe how we process personal data in connection with specific activities relating to your Kladero Platform Account and use of the Kladero Platform.
For each activity, we provide information about the scope of the processing, the categories of personal data processed, the purposes of the processing, and the applicable legal basis. Where relevant, we also explain activity-specific choices available to you.
7.1 Account and access management
7.1.1 Scope
This section applies when we create, activate, administer, suspend, restore, or delete your Kladero Platform Account, or when you register, log in, authenticate, reset your credentials, or otherwise manage access to the Kladero Platform.
It also applies where an organization administrator or another authorized person invites you to the Kladero Platform, assigns you to an organization or workspace, or manages your roles and permissions.
7.1.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify you and associate you with your Kladero Platform Account | Performance of Contract |
| Contact data | To create and administer your Kladero Platform Account and communicate with you about Kladero Platform Account access | Performance of Contract |
| Account data | To create, configure, administer, suspend, restore, or delete your Kladero Platform Account and provide your assigned Kladero Platform Account functions | Performance of Contract |
| Authentication data | To authenticate you, manage login credentials, enable Kladero Platform Account access, and support credential recovery | Performance of Contract |
| Professional and organizational data | To provide Kladero Platform Account access and functions associated with your organization, workspace, team, professional role, or access level | Performance of Contract |
| Professional and organizational data | To enable an organization administrator or another authorized person to assign and manage your organization or workspace membership, roles, and permissions | Legitimate Interests |
| Email confirmation data | To verify the email address associated with your Kladero Platform Account and prevent the creation, activation, or recovery of a Kladero Platform Account using an incorrect or unauthorized email address | Legitimate Interests |
| Authentication and access event data | To administer login, logout, authentication, and Kladero Platform Account access processes | Performance of Contract |
| Authentication and access event data | To detect and investigate failed, unusual, or unauthorized Kladero Platform Account access | Legitimate Interests |
| Communication delivery and status data | To administer and verify the delivery of Kladero Platform Account activation, credential recovery, authentication, and other Kladero Platform Account-access communications | Legitimate Interests |
| Terms, notice, and acknowledgment data | To record the terms applicable to your Kladero Platform Account and any acceptance or acknowledgment required to create or continue using the Kladero Platform Account | Performance of Contract |
| Terms, notice, and acknowledgment data | To maintain evidence of the terms, notices, policies, and other legal information presented to or acknowledged by you | Legitimate Interests |
Where processing is based on Performance of Contract, the processing is necessary to create and administer your Kladero Platform Account, authenticate you, provide your assigned access and Kladero Platform Account functions, and enable you to access and use the Kladero Platform.
Our Legitimate Interests are to verify the accuracy and authorization of Kladero Platform Account information, enable organizations to administer access for their users, protect Kladero Platform Accounts against unauthorized access and misuse, maintain reliable Kladero Platform Account and access records, and administer Kladero Platform Account-related communications.
7.1.3 Your choices
You must provide the information necessary to create, administer, and secure your Kladero Platform Account, authenticate your access, and provide your assigned Kladero Platform Account functions. If you do not provide this information, we may be unable to create or activate your Kladero Platform Account, authenticate you, recover your access, or permit you to use the Kladero Platform.
Where an organization administrator manages your Kladero Platform Account, organization or workspace membership, roles, or permissions, certain changes may need to be requested from that administrator.
7.2 Provision and operation of the Kladero Platform
7.2.1 Scope
This section applies when we provide, operate, administer, and maintain the Kladero Platform and make its functions available through your Kladero Platform Account.
7.2.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Account data | To provide Kladero Platform Account-specific Kladero Platform functions, settings, roles, permissions, and organization or workspace access | Performance of Contract |
| Professional and organizational data | To provide Kladero Platform functions in the context of your organization, workspace, team, or professional role | Performance of Contract |
| Platform interaction and functional usage data | To process your actions, provide requested functions, maintain Kladero Platform state, and enable navigation and workflows | Performance of Contract |
| Network and connection data | To establish and maintain communication between your device and the Kladero Platform | Performance of Contract |
| Device and browser data | To display and operate the Kladero Platform correctly on your device and browser | Performance of Contract |
| Request and server-log data | To receive and process requests necessary to provide Kladero Platform functions | Performance of Contract |
| Session and security identifier data | To establish and maintain sessions required to provide Kladero Platform functions | Performance of Contract |
| Cookie and similar-technology data | To authenticate you, maintain your session, remember essential settings, and provide the Kladero Platform functions you request | Performance of Contract |
| Diagnostic and performance data | To identify technical failures and maintain the availability, reliability, compatibility, and performance of the Kladero Platform | Legitimate Interests |
| Request and server-log data | To monitor the technical operation of the Kladero Platform and diagnose errors or failed requests | Legitimate Interests |
Where processing is based on Performance of Contract, the processing is necessary to provide the Kladero Platform functions you request, maintain your Kladero Platform Account-specific settings and access, process your actions, and enable communication between your device and the Kladero Platform.
Our Legitimate Interests are to monitor the technical operation of the Kladero Platform, identify and diagnose errors, and maintain its availability, reliability, compatibility, and performance.
7.2.3 Your choices
You must provide or permit the processing of personal data necessary to provide the Kladero Platform and its requested functions. If you do not provide or permit this processing, the relevant function or the Kladero Platform as a whole may be unavailable or may not operate correctly.
7.3 Platform support
7.3.1 Scope
This section applies when you request support, report a problem, ask a question, arrange a support call or meeting, or otherwise communicate with us concerning your Kladero Platform Account or the Kladero Platform.
7.3.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify the person submitting or involved in the support request | Performance of Contract |
| Contact data | To communicate with you concerning the support request | Performance of Contract |
| Account data | To identify the affected Kladero Platform Account, organization, workspace, roles, permissions, or configuration | Performance of Contract |
| Platform support and communication data | To receive, assess, manage, and respond to the support request and arrange any related support call or meeting | Performance of Contract |
| Authentication and access event data | To investigate and resolve reported authentication or Kladero Platform Account access problems | Performance of Contract |
| Platform interaction and functional usage data | To understand and reproduce the reported problem, identify the affected Kladero Platform function, and resolve the support request | Performance of Contract |
| Request and server-log data | To investigate technical events and determine the cause of the reported problem | Performance of Contract |
| Diagnostic and performance data | To diagnose and resolve technical failures, compatibility issues, and performance problems | Performance of Contract |
| Other data provided by you | To process the support request in accordance with the information you provide | Performance of Contract |
| Platform support and communication data | To document completed support requests, maintain consistent support records, and review and improve our support processes | Legitimate Interests |
| Request and server-log data, Diagnostic and performance data, and Platform interaction and functional usage data | To identify recurring technical problems and improve the reliability and effectiveness of our support processes | Legitimate Interests |
Where processing is based on Performance of Contract, the processing is necessary to receive, investigate, and resolve support requests relating to your Kladero Platform Account or use of the Kladero Platform, communicate with you concerning the request, and restore or maintain the Kladero Platform functions available to you.
Our Legitimate Interests are to maintain appropriate and consistent support records, identify recurring technical problems, review the effectiveness of our support activities, and improve our support processes.
7.3.3 Your choices
You must provide the information necessary to identify the affected Kladero Platform Account, understand and investigate the reported problem, and communicate with you concerning the support request. If you do not provide this information, we may be unable to investigate or resolve your request.
You may choose whether to provide additional information that is not necessary to process the support request.
7.4 Account, service, and security communications
7.4.1 Scope
This section applies when we send communications concerning the creation, administration, access, security, or operation of your Kladero Platform Account or the Kladero Platform. These communications may include Kladero Platform Account activation messages, credential recovery messages, security alerts, administrative notices, and information concerning Kladero Platform availability or changes to Kladero Platform functions.
7.4.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To address communications necessary to create, administer, access, or use your Kladero Platform Account or the Kladero Platform | Performance of Contract |
| Contact data | To send Kladero Platform Account activation, credential recovery, access-related, and other communications necessary to administer your Kladero Platform Account or provide the Kladero Platform | Performance of Contract |
| Account data | To determine the Kladero Platform Account, organization, workspace, role, permission, or Kladero Platform function to which an Kladero Platform Account-related or service communication relates | Performance of Contract |
| Terms, notice, and acknowledgment data | To provide terms, policies, notices, and information necessary to create, administer, or continue using your Kladero Platform Account or the Kladero Platform | Performance of Contract |
| Identity data, Contact data, and Account data | To send administrative or operational notices concerning Kladero Platform availability, maintenance, changes, incidents, or other matters relevant to the reliable use of your Kladero Platform Account or the Kladero Platform | Legitimate Interests |
| Identity data, Contact data, Account data, and Security event and misuse-prevention data | To notify you of suspected unauthorized access, security incidents, misuse, or protective measures affecting your Kladero Platform Account or use of the Kladero Platform | Legitimate Interests |
| Communication delivery and status data | To administer delivery, identify failed deliveries, and determine whether important Kladero Platform Account, service, or security communications were successfully delivered | Legitimate Interests |
| Terms, notice, and acknowledgment data | To maintain evidence of the terms, policies, notices, and other information presented to or acknowledged by you | Legitimate Interests |
Where processing is based on Performance of Contract, the processing is necessary to create and administer your Kladero Platform Account, support Kladero Platform Account access and credential recovery, provide information necessary to use the Kladero Platform, and communicate matters directly related to the Kladero Platform functions available to you.
Our Legitimate Interests are to communicate important operational and security information, notify users of incidents and protective measures, maintain reliable records of communications and their delivery, and ensure the secure and reliable use of Kladero Platform Accounts and the Kladero Platform.
7.4.3 Your choices
You must provide valid contact information where it is necessary to create or administer your Kladero Platform Account, recover access, or receive information required to use the Kladero Platform. If you do not provide valid contact information, we may be unable to activate or administer your Kladero Platform Account, help you recover access, or provide the relevant Kladero Platform functions.
Account, service, and security communications are not marketing communications and cannot generally be disabled while you maintain a Kladero Platform Account.
7.5 Security and prevention of misuse
7.5.1 Scope
This section applies when we process personal data to protect Kladero Platform Accounts, the Kladero Platform, communications, systems, and related infrastructure against unauthorized access, misuse, fraud, attacks, technical failures, and other security threats.
7.5.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Network and connection data | To monitor connections, detect unusual activity, and investigate security incidents | Legitimate Interests |
| Device and browser data | To identify technical or security anomalies and protect Kladero Platform Account and Kladero Platform access | Legitimate Interests |
| Request and server-log data | To monitor Kladero Platform requests, diagnose failed or unusual requests, and investigate technical or security incidents | Legitimate Interests |
| Authentication and access event data | To detect and investigate unauthorized or suspicious Kladero Platform Account access | Legitimate Interests |
| Session and security identifier data | To protect sessions, secure Kladero Platform functions, prevent abusive requests, and enforce rate limits | Legitimate Interests |
| Security event and misuse-prevention data | To detect, prevent, assess, investigate, and respond to misuse, fraud, attacks, unauthorized access, and other security threats | Legitimate Interests |
| Diagnostic and performance data | To identify technical failures affecting security, availability, or reliability | Legitimate Interests |
| Cookie and similar-technology data | To protect authenticated sessions and secure access to Kladero Platform Accounts and the Kladero Platform | Legitimate Interests |
Our Legitimate Interests are to protect the confidentiality, integrity, availability, and reliability of Kladero Platform Accounts, the Kladero Platform, communications, systems, and related infrastructure; prevent unauthorized access and misuse; detect and investigate technical or security incidents; and maintain secure and stable Kladero Platform operation.
7.5.3 Your choices
These security measures are necessary to protect Kladero Platform Accounts, the Kladero Platform, and other users and cannot generally be disabled for an individual Kladero Platform User.
7.6 Platform analytics and improvement
7.6.1 Scope
This section applies where we analyze the technical operation and use of the Kladero Platform to understand how Kladero Platform functions are used, identify errors and performance issues, and improve the reliability, usability, and functionality of the Kladero Platform.
Where possible, we use aggregated statistics for these purposes. Aggregated information that no longer permits the identification of an individual is not personal data.
7.6.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Platform interaction and functional usage data | To understand how Kladero Platform functions are used and identify opportunities to improve Kladero Platform workflows, usability, and functionality | Legitimate Interests |
| Diagnostic and performance data | To identify errors, failures, latency, availability issues, and other technical problems and improve Kladero Platform performance | Legitimate Interests |
| Request and server-log data | To analyze technical events and generate statistics concerning the operation and reliability of the Kladero Platform | Legitimate Interests |
| Device and browser data | To assess compatibility and improve the operation of the Kladero Platform across supported devices and browsers | Legitimate Interests |
Our Legitimate Interests are to understand the general use and technical performance of the Kladero Platform, identify and resolve operational problems, improve the usability and functionality of the Kladero Platform, and maintain a reliable and compatible service.
7.7 Data protection requests
7.7.1 Scope
This section applies when you contact Kladero to exercise your rights concerning your personal data or submit another data-protection-related request.
7.7.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify you and verify your identity where necessary | Legal Obligations |
| Contact data | To communicate with you concerning the request | Legal Obligations |
| Account data | To locate the relevant Kladero Platform Account and personal data and determine the scope of the request | Legal Obligations |
| Authentication data | To verify your identity or Kladero Platform Account access where necessary and proportionate | Legal Obligations |
| Data-subject request and compliance data | To assess, process, respond to, and document your request | Legal Obligations |
| Other data provided by you | To understand and process your request in accordance with its content | Legal Obligations |
Where processing is based on Legal Obligations, the processing is necessary to receive, assess, and respond to requests made under applicable data protection law, verify the identity of the requesting person where necessary, locate relevant personal data, and document the handling of the request.
7.7.3 Your choices
You must provide the information necessary for us to identify you, verify your identity where required, locate the relevant Kladero Platform Account or personal data, and understand the scope of your request. If you do not provide this information, we may be unable to process or respond to your request.
7.8 Data protection compliance and documentation
7.8.1 Scope
This section applies where we retain or otherwise process information to comply with, and demonstrate compliance with, applicable data protection law.
7.8.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Consent records | To demonstrate that consent was obtained, confirmed, refused, or withdrawn and that the relevant choice was respected | Legal Obligations |
| Data-subject request and compliance data | To document the assessment and handling of data protection requests, objections, restrictions, complaints, and related decisions | Legal Obligations |
| Terms, notice, and acknowledgment data | To demonstrate which privacy information, notices, policies, terms, or declarations were presented or acknowledged | Legal Obligations or Legitimate Interests |
| Identity data | To document the identity of the person concerned where necessary for compliance records | Legal Obligations |
| Contact data | To associate compliance records with the relevant person and document related communications | Legal Obligations |
| Account data | To associate compliance records with the relevant Kladero Platform Account, organization, workspace, role, or permission | Legal Obligations or Legitimate Interests |
Where processing is based on Legal Obligations, the processing is necessary to comply with and demonstrate compliance with applicable data protection requirements.
Our Legitimate Interests are to maintain reliable evidence of the information and choices associated with a Kladero Platform Account, demonstrate the lawfulness of processing where no more specific legal obligation applies, and establish, exercise, or defend legal claims.
7.9 Disputes and legal claims
7.9.1 Scope
This section applies where a dispute arises concerning your Kladero Platform Account or use of the Kladero Platform or where personal data is necessary to establish, exercise, or defend legal claims.
7.9.2 Processed personal data, purposes, and legal basis
| Personal data processed | Purpose of processing | Legal basis |
|---|---|---|
| Identity data | To identify the persons involved in the dispute or legal claim | Legitimate Interests |
| Contact data | To communicate with you and other relevant persons concerning the dispute or legal claim | Legitimate Interests |
| Account data | To determine the Kladero Platform Account, organization, workspace, role, permission, configuration, or access involved in the dispute or legal claim | Legitimate Interests |
| Professional and organizational data | To understand the organizational and professional context of the dispute or legal claim | Legitimate Interests |
| Platform support and communication data | To assess the positions of the persons involved, investigate the dispute, communicate concerning it, and document its handling | Legitimate Interests |
| Authentication and access event data | To verify relevant Kladero Platform Account access and authentication events | Legitimate Interests |
| Platform interaction and functional usage data | To investigate relevant Kladero Platform actions and verify the circumstances of the dispute | Legitimate Interests |
| Request and server-log data | To investigate technical events, verify relevant requests, and preserve evidence | Legitimate Interests |
| Session and security identifier data | To investigate security-related circumstances and preserve relevant evidence | Legitimate Interests |
| Security event and misuse-prevention data | To investigate suspected misuse, unauthorized access, fraud, attacks, or other security-related circumstances | Legitimate Interests |
| Terms, notice, and acknowledgment data | To determine which terms, notices, policies, or declarations were presented or acknowledged and preserve evidence relevant to the dispute or legal claim | Legitimate Interests |
| Other data provided by you | To investigate and resolve the dispute or establish, exercise, or defend legal claims | Legitimate Interests |
Our Legitimate Interests are to investigate and resolve disputes, protect Kladero’s legal rights, preserve relevant evidence, and establish, exercise, or defend legal claims.
8. Recipients of personal data
We disclose personal data only where necessary for the purposes described in this Privacy Policy. We do not sell or trade personal data.
Depending on the relevant processing activity, personal data may be disclosed to the following recipients:
- authorized employees and other personnel of Kladero who require access to the personal data to perform their duties;
- professional advisers, including lawyers, tax advisers, accountants, and auditors;
- public authorities, courts, and other public bodies where disclosure is required or permitted by applicable law; and
- other recipients where you have expressly authorized the disclosure or where disclosure is otherwise required or permitted by applicable law.
We also engage service providers that process personal data in connection to the Kladero Platform and our communication. Our principal service providers are listed below:
| Category of service provider | Provider | Principal processing location |
|---|---|---|
| Website hosting and infrastructure | Hetzner Online GmbH | European Union |
| Transactional and marketing email delivery | Mindbaz SAS (Sweego) | European Union |
| Network services | Cloudflare, Inc. and its affiliates | European Union and other countries, including the United States |
| Business email and related business applications | Zoho group companies | European Union and, in limited circumstances, other countries |
| Authentication and account access | Google Ireland Limited / Google LLC | European Union and other countries |
9. Retention and erasure of personal data
We retain personal data only for as long as necessary for the purposes for which it was collected, unless continued retention is required or permitted by applicable law.
The applicable retention period depends on the category of personal data, the relevant processing purpose, the duration of your Kladero Platform Account and use of the Kladero Platform, and any applicable statutory retention or limitation period.
9.1 Principal retention periods
The principal retention periods applicable to the processing activities described in this Privacy Policy are set out below:
| Retention period | Personal data and processing context |
|---|---|
| For as long as your Kladero Platform Account remains active and for the period necessary to complete its closure and deletion | Identity data, Contact data, Account data, Professional and organizational data, and other personal data necessary to create, administer, and provide your Kladero Platform Account and assigned access to the Kladero Platform |
| Until the relevant invitation expires, is withdrawn, is rejected, or results in the creation or activation of a Kladero Platform Account | Identity data, Contact data, Professional and organizational data, and Account data processed in connection with an invitation to the Kladero Platform |
| For as long as the relevant organization or workspace membership, role, or permission remains applicable and until the corresponding change or removal has been completed | Account data and Professional and organizational data used to administer organization or workspace membership, roles, permissions, and access rights |
| For as long as the relevant credentials, authentication method, token, or session remains valid and for the limited period necessary to complete invalidation, replacement, or technical deletion | Authentication data, Session and security identifier data, and Cookie and similar-technology data used to authenticate you, maintain sessions, or provide secure Kladero Platform Account access |
| For the duration of your Kladero Platform Account and, where necessary, for a limited period after Kladero Platform Account closure | Email confirmation data and Communication delivery and status data used to verify contact information and administer Kladero Platform Account, service, support, or security communications |
| Until the support request has been resolved and any necessary operational follow-up has been completed | Identity data, Contact data, Account data, Platform support and communication data, and Other data provided by you that are required to process a support request |
| Generally for up to three years from the end of the calendar year in which the support request was resolved, where retention is necessary to maintain support records, document the services provided, or establish, exercise, or defend legal claims | Platform support and communication data and relevant Account data, Authentication and access event data, Platform interaction and functional usage data, Request and server-log data, and Diagnostic and performance data associated with the support request |
| Generally for no more than 30 days after collection, unless a technical or security event requires further investigation | Network and connection data, Request and server-log data, Authentication and access event data, and ordinary Diagnostic and performance data generated through use of the Kladero Platform |
| For the period necessary to generate the relevant operational statistics or analysis, after which the underlying personal data is erased or aggregated where possible | Platform interaction and functional usage data, Device and browser data, Request and server-log data, and Diagnostic and performance data processed for Kladero Platform analytics and improvement |
| Until the relevant security event or suspected misuse has been investigated and resolved and any necessary protective or remedial measures have been completed | Security event and misuse-prevention data and related Network and connection data, Device and browser data, Request and server-log data, Authentication and access event data, Session and security identifier data, and Diagnostic and performance data |
| Generally for up to three years from the end of the calendar year in which the security event was resolved, where continued retention is necessary to document the incident, preserve evidence, or establish, exercise, or defend legal claims | Security event and misuse-prevention data and other records relevant to a security incident, unauthorized access, misuse, fraud, or attack |
| Generally for three years from the end of the calendar year in which the relevant activity ended, unless a different statutory period applies | Consent records, Terms, notice, and acknowledgment data, Data-subject request and compliance data, and other records retained to demonstrate compliance or establish, exercise, or defend legal claims |
| Until the dispute or proceeding has been finally resolved and the applicable limitation periods have expired | Personal data necessary to investigate or resolve a dispute or to establish, exercise, or defend legal claims |
9.2 Account closure
When your Kladero Platform Account is deleted or your access to the Kladero Platform is permanently terminated, we erase or anonymize the personal data that is no longer necessary to provide or administer the Kladero Platform Account.
Kladero Platform Account closure does not necessarily result in the immediate erasure of all personal data associated with the Kladero Platform Account. We may retain limited information where this is necessary to complete the deletion process, comply with applicable law, document Kladero Platform Account administration or security events, resolve outstanding support requests or disputes, or establish, exercise, or defend legal claims.
Where an organization administrator removes you from an organization or workspace without deleting your Kladero Platform Account, we remove or update the relevant organization or workspace membership, roles, and permissions. Other Kladero Platform Account information may continue to be retained where your Kladero Platform Account remains active.
9.3 Extended retention
We may retain personal data beyond the principal retention periods where this is required by applicable commercial, tax, accounting, data protection, or other statutory retention obligations, or where retention is necessary to establish, exercise, or defend legal claims.
Unless a different limitation period applies, records relevant to potential civil-law claims may generally be retained until the expiry of the regular statutory limitation period. Under German law, this period is generally three years and usually begins at the end of the calendar year in which the relevant claim arose and the party entitled to assert the claim became aware, or should have become aware without gross negligence, of the relevant circumstances and the identity of the other party.
Longer periods may apply where proceedings are pending, a limitation period has been suspended or restarted, a claim has been legally established, or a special statutory retention or limitation period applies.
Where personal data is retained solely for a statutory retention obligation or for legal claims, we restrict its processing to those purposes. It is not used for Kladero Platform analytics, improvement, or other ordinary operational purposes during the extended retention period.
9.4 Erasure and anonymization
After the applicable retention period has expired, we erase or irreversibly anonymize the personal data unless continued retention is required or permitted by applicable law.
Where we create anonymous aggregated statistics from personal data, we may retain those statistics because they no longer permit us to identify you.
Erasure may take place through a scheduled deletion process rather than immediately upon expiry of the relevant retention period.
Personal data contained in backup systems may remain for a limited period until the relevant backup is overwritten or deleted in accordance with our backup procedures. During that period, the data is not used for ordinary operational purposes and is restored only where necessary for business continuity, security, or disaster recovery.
10. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.
11. International data transfers
Kladero’s primary hosting infrastructure for the Kladero Platform is located within the European Union. Some of our service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred to a country for which the European Commission has adopted an adequacy decision, we rely on that adequacy decision. Where no applicable adequacy decision exists, we use appropriate safeguards in accordance with Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses.
Further information about the safeguards applicable to a particular transfer, including information on how to obtain a copy of the relevant safeguards, may be requested from us using the contact details provided in this Privacy Policy.
12. Changes to this Privacy Policy
We may amend this Privacy Policy to reflect changes in applicable law, our services, or our processing activities.
The current version of this Privacy Policy is available on our website. Where a change materially affects the processing of your personal data or your rights, we will inform you before the change takes effect. Where a change requires your consent, we will request your consent before carrying out the relevant processing.
13. Information about minors
Our websites, products, and services are intended for persons aged 18 or older and are not directed to minors.
We do not knowingly collect personal data from persons under the age of 18. If we become aware that we have collected personal data from a minor, we will take appropriate steps to delete it, unless we are legally required or otherwise permitted to retain it.
If you believe that we may have collected personal data from a person under the age of 18, please contact us using the privacy contact details provided in this Privacy Policy.
14. Language
This Privacy Policy may be made available in multiple languages. In the event of any inconsistency between the English version and a translated version, the English version shall prevail.